{"ip":"44.220.185.141","data_as_of":"2026-10-24T03:19:28+00:00","observed":true,"total_events":101,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["The address is in a published scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 578 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"8,017 bytes sent","bytes_sent":8017,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-03-01T09:26:46","last_seen":"2026-10-23T08:28:05","events_24h":0,"events_7d":12,"interactive_sessions":578,"interactive_sessions_24h":576,"interactive_sessions_7d":578,"interactive_protocols":[{"protocol":"http","sessions":578}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-44-220-185-141.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":578,"first_seen":"2026-10-18T23:28:14","last_seen":"2026-10-23T08:28:05","verdicts":[{"verdict":"unknown","sessions":564},{"verdict":"scan","sessions":14}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":576},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":2}],"services":[{"protocol":"http","port":8443,"sessions":576},{"protocol":"http","port":8001,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":14}]},"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":0,"sessions":576},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":13,"sessions":0},{"port":5601,"proto":"tcp","label":"Kibana","count":12,"sessions":0},{"port":4443,"proto":"tcp","label":"","count":12,"sessions":0},{"port":10801,"proto":"tcp","label":"","count":11,"sessions":0},{"port":8012,"proto":"tcp","label":"","count":11,"sessions":0},{"port":8011,"proto":"tcp","label":"","count":11,"sessions":0},{"port":7001,"proto":"tcp","label":"WebLogic","count":10,"sessions":0},{"port":20000,"proto":"tcp","label":"","count":3,"sessions":0},{"port":3001,"proto":"tcp","label":"","count":3,"sessions":0},{"port":1337,"proto":"tcp","label":"","count":3,"sessions":0},{"port":5901,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8001,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":1900,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8083,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["d6729b7f24428169e981ad4840063ca5"],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e","t12d3411h9_a634f799a498_52c4d8bb91c9","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102"],"tls_client_hello":"16030100e8010000e403038b92f901bab6d183cba5b36efc578271af93db21f00cdc719fa29535cfdca849200ef1e7068544a7b694172d11cb50be0d76d0f33118220a4dea5d07ed87d34d2c000813021303130100ff0100009300000012001000000d3139322e332e3131382e313436000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d001e001c040305030603080708080809080a080b080408050806040105010601002b0003020304002d00020101003300260024001d0020a89cfd173d5318439e23e7e9d913e4267627f33fcbb370ca90fda198c93a9f6f","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01","013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","a96dc3876784813c57d302241e620acd","db8d4ad49cb378fa370b43a61a9b06b6"],"http_akin":["b11cun050_00040017_345c845b","b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12d3411h9_a634f799a498_52c4d8bb91c9","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_ja3":["013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","a96dc3876784813c57d302241e620acd","d18b223ce817c861b7829130500395c2","db8d4ad49cb378fa370b43a61a9b06b6"]}},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":24,"t13i3612h1_bcee18a5b459_8537cf56674e":307,"t12d3411h9_a634f799a498_52c4d8bb91c9":0,"t12d3511h9_66c735deec94_52c4d8bb91c9":0,"t12d6912h9_ea0618708e31_1da015a32102":0,"t12d6912hq_ea0618708e31_1da015a32102":0,"t13d041000_16476d049b0b_78f1d400d464":133,"d6729b7f24428169e981ad4840063ca5":139,"b11cun050_00040017_345c845b":493,"b11cun050_00040017_976354f0":1245},"akin_families":{"b11cun050_00040017_345c845b":{"head":"b11cun050_00040017_345c845b","shapes":2,"ips":493}},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3072.81 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3090.106 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3019.113 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3019.64 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/57.0.3059.89 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3061.100 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3056.99 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/55.0.3059.111 Safari/537.32"],"timeline":[{"date":"2026-08-03","count":2,"sessions":0},{"date":"2026-08-10","count":1,"sessions":0},{"date":"2026-08-26","count":1,"sessions":0},{"date":"2026-09-09","count":1,"sessions":0},{"date":"2026-09-16","count":3,"sessions":0},{"date":"2026-09-21","count":13,"sessions":0},{"date":"2026-09-30","count":12,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-18","count":0,"sessions":2},{"date":"2026-10-19","count":12,"sessions":0},{"date":"2026-10-23","count":0,"sessions":576}],"recent_events":[{"timestamp":"2026-10-23T08:27:55","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"cc727bfb-f1f6-48e7-983d-554140a219af-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:49","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c010002000300000010030080a213e30cae356d5aab6b9cac16999720","method":"","user_agent":"","ja3":"","session":"88e994be-47ae-4e87-8b20-ed07cd58d366-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:49","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c010002000300000010040080818b602ccc677eca64eac6216048794a","method":"","user_agent":"","ja3":"","session":"ec9438df-7dc1-4052-9c7f-4aabda6aef9b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:49","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c0100020003000000100700c0be8873431adbfd34e05f99a1ee047ca3","method":"","user_agent":"","ja3":"","session":"baeb0021-34db-4166-9dab-a7dac81b0f68-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:48","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c0100020003000000100100803d60ae647b2ec64268a991b893363a61","method":"","user_agent":"","ja3":"","session":"1a475060-da9b-4c54-8f79-bc3f4d4f48f6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:48","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c0100020003000000100500801fb2267c6f30f2ef1e3064439a75ba32","method":"","user_agent":"","ja3":"","session":"da309467-67e2-4588-896f-80f181455dc2-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:48","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c01000200030000001002008068f55dc73a385cd2dacb04b3884c244d","method":"","user_agent":"","ja3":"","session":"f822fe1a-4c50-44ad-bc07-edb92006fe66-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:48","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"801c0100020003000000100600402a1f44bd199c3c8174347c0978e222aa","method":"","user_agent":"","ja3":"","session":"62de55b2-51f7-4e9c-bdcb-455b1ae7383a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:12","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"b84dcce1-9606-472e-8d56-2dd8259e1698-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T08:27:02","port":8443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"5cb6e67d-70f4-40cb-9b82-25a9c3c9adfb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":27}],"distinct_ports_total":22,"top_paths":[{"path":"/","count":35,"ports":19},{"path":"/containers/json?all=1","count":1,"ports":1},{"path":"/wp-content/uploads/2024/03/cropped-favicon-32x32.png","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":8}],"banners":[{"value":"SSH-2.0-paramiko_2.9.2","count":2}],"credentials":[],"header_profile":null,"tags":[]}