{"ip":"18.97.5.91","data_as_of":"2026-10-23T09:58:26+00:00","observed":true,"total_events":60,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["The address is in a published scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 7 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,628 bytes sent","bytes_sent":3628,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-02-20T08:37:46","last_seen":"2026-10-21T07:24:40","events_24h":0,"events_7d":1,"interactive_sessions":7,"interactive_sessions_24h":0,"interactive_sessions_7d":7,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-18-97-5-91.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":7,"first_seen":"2026-10-21T07:23:11","last_seen":"2026-10-21T07:24:40","verdicts":[{"verdict":"unknown","sessions":6},{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"tcp","port":8089,"sessions":6},{"protocol":"http","port":9201,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":13,"sessions":0},{"port":5601,"proto":"tcp","label":"Kibana","count":12,"sessions":0},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":11,"sessions":0},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":11,"sessions":0},{"port":8089,"proto":"tcp","label":"Splunk","count":0,"sessions":6},{"port":554,"proto":"tcp","label":"","count":3,"sessions":0},{"port":10000,"proto":"tcp","label":"Webmin","count":2,"sessions":0},{"port":8081,"proto":"tcp","label":"","count":1,"sessions":0},{"port":4000,"proto":"tcp","label":"","count":1,"sessions":0},{"port":110,"proto":"tcp","label":"POP3","count":1,"sessions":0},{"port":10801,"proto":"tcp","label":"","count":1,"sessions":0},{"port":50805,"proto":"tcp","label":"","count":1,"sessions":0},{"port":5555,"proto":"tcp","label":"","count":1,"sessions":0},{"port":888,"proto":"tcp","label":"","count":1,"sessions":0},{"port":7170,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030100e8010000e403039a7f92e65439db162b3610d7da089a0fc2fa85a4901331bab7162d52dc976c7d20b06c96fb653c95a2a3cbd552f847aebc13816d5168eb782c0236db7d6a208ac3000813021303130100ff0100009300000012001000000d3139322e332e3131382e313436000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d001e001c040305030603080708080809080a080b080408050806040105010601002b0003020304002d00020101003300260024001d0020979d6f5630fd77b2806ec211fdcf460c48a014aab0c212e9118c58d06732885d","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":["b11cun050_00040017_345c845b","b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":24,"t13d041000_16476d049b0b_78f1d400d464":137,"t13i3612h1_bcee18a5b459_8537cf56674e":309,"b11cun050_00040017_345c845b":494,"b11cun050_00040017_976354f0":1239},"akin_families":{"b11cun050_00040017_345c845b":{"head":"b11cun050_00040017_345c845b","shapes":2,"ips":494},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1238}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3062.69 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3044.51 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3015.92 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/53.0.3058.76 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3066.55 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3100.67 Safari/537.32","elasticsearch-py/7.13.4 (Python 3.10.22)"],"timeline":[{"date":"2026-08-24","count":1,"sessions":0},{"date":"2026-09-12","count":1,"sessions":0},{"date":"2026-09-21","count":1,"sessions":0},{"date":"2026-10-11","count":12,"sessions":0},{"date":"2026-10-12","count":3,"sessions":0},{"date":"2026-10-21","count":1,"sessions":7}],"recent_events":[{"timestamp":"2026-10-21T07:24:36","port":9201,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9201\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.22)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.22,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/*","summary":"","payload_hex":"474554202f2a20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230310d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3232290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32322c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.22)","ja3":"","session":"ffa63c77-ee13-4eac-905c-5d6a90062e52-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T07:24:35","port":9201,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9201\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.22)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.22,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_alias","summary":"","payload_hex":"474554202f5f616c69617320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230310d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3232290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32322c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.22)","ja3":"","session":"ffa63c77-ee13-4eac-905c-5d6a90062e52-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T07:24:35","port":9201,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9201\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.22)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.22,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230310d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3232290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32322c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.22)","ja3":"","session":"ffa63c77-ee13-4eac-905c-5d6a90062e52-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T03:11:12","port":7170,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7170\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3044.51 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373137300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35342e302e333034342e3531205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3044.51 Safari/537.32","ja3":"","session":"4b98e14f-b185-45d8-9ced-26ef42d5c804","seq":1,"duration_ms":101,"bytes_in":237,"bytes_out":75},{"timestamp":"2026-10-12T10:19:21","port":554,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:554\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3535340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570742d656e636f64696e673a20677a69700d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"98e8c15f-1735-4e1c-a9d6-f443df2281e0","seq":1,"duration_ms":100,"bytes_in":235,"bytes_out":75},{"timestamp":"2026-10-12T10:19:21","port":554,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:554\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3062.69 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3535340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35322e302e333036322e3639205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3062.69 Safari/537.32","ja3":"","session":"1a8fa7b8-e30e-4f22-b147-89545a5f68b4","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":75},{"timestamp":"2026-10-12T10:19:16","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\nCSeq: 1\r\nAccept: application/sdp\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a435365713a20310d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"3d15a474-8d7b-4eb2-bee5-d70feb29d753","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":75,"enriched":{"digest":"761a613ced0b8a2e","label":"HTTP","strings":["OPTIONS / RTSP/1.0","CSeq: 1","Accept: application/sdp"]}},{"timestamp":"2026-10-11T13:13:22","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000��\u0016��4���&*\u0003�����","payload_hex":"801c010002000300000010050080ec1680dd34c5d1c9262a0391c183cbda","method":"","user_agent":"","ja3":"","session":"fad8046a-b5a7-4da6-8e06-e8cbf9867441","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-10-11T13:13:17","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�\u0012,�:�̕���?)=���","payload_hex":"801c010002000300000010020080122cd73af3cc9589a7c13f293ddbc3e4","method":"","user_agent":"","ja3":"","session":"37a0c2a5-c1b3-44dd-874e-06f262aacab2","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-10-11T13:13:17","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�s\u00162<�H\u0017n�͋R\u001d\u0012(~","payload_hex":"801c0100020003000000100700c07316323ccf48176eb3cd8b521d12287e","method":"","user_agent":"","ja3":"","session":"ed65c5dc-58c4-4776-bb3b-c0834e2a9716","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":17,"ports":13},{"path":"/containers/json?all=1","count":1,"ports":1},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":6}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Type","Host","User-Agent","X-Elastic-Client-Meta"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:9201","notable":false},{"name":"User-Agent","value":"elasticsearch-py/7.13.4 (Python 3.10.22)","notable":false},{"name":"X-Elastic-Client-Meta","value":"es=7.13.4,py=3.10.22,t=7.13.4,ur=1.26.11","notable":true}],"distinct_sets":2,"events_with_headers":6},"tags":[]}