{"ip":"44.220.185.182","total_events":171,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,047 bytes sent","bytes_sent":6047,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-02T01:47:57","last_seen":"2026-08-15T01:52:44","events_24h":25,"events_7d":28,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-44-220-185-182.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":38},{"port":8044,"proto":"tcp","label":"","count":22},{"port":9871,"proto":"tcp","label":"","count":22},{"port":2086,"proto":"tcp","label":"","count":21},{"port":8010,"proto":"tcp","label":"","count":21},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":13},{"port":5601,"proto":"tcp","label":"Kibana","count":12},{"port":27017,"proto":"tcp","label":"MongoDB","count":6},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":8200,"proto":"tcp","label":"","count":3},{"port":8883,"proto":"tcp","label":"","count":3},{"port":24442,"proto":"tcp","label":"","count":2},{"port":8081,"proto":"tcp","label":"","count":1},{"port":2266,"proto":"tcp","label":"","count":1},{"port":9002,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13i3612h1_bcee18a5b459_8537cf56674e","t13i181000_85036bcba153_d41ae481755e","t13d041000_16476d049b0b_78f1d400d464"],"tls_ja3":["d18b223ce817c861b7829130500395c2","8a9d5d0f12f7d43ee3af1c51d2998d99","a66e498c488aa0523759691248cdfb01"],"ja4h":["ge11nn0600_9710a781d8b2","ge11nn12en_c43c88922017","ge11nn0500_2d30dc89d981"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":325,"t13i4311h1_c7886603b240_b26ce05bbdd6":9,"t13d041000_16476d049b0b_78f1d400d464":128,"t13i181000_85036bcba153_d41ae481755e":37,"ge11nn0500_2d30dc89d981":1345,"ge11nn0600_9710a781d8b2":53,"ge11nn12en_c43c88922017":2},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3060.79 Safari/537.32","elasticsearch-py/7.13.4 (Python 3.10.20)","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3026.99 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3012.93 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3028.82 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3003.77 Safari/537.32"],"timeline":[{"date":"2026-06-04","count":1},{"date":"2026-06-13","count":3},{"date":"2026-06-14","count":1},{"date":"2026-06-20","count":1},{"date":"2026-07-04","count":3},{"date":"2026-07-08","count":1},{"date":"2026-07-18","count":4},{"date":"2026-08-10","count":3},{"date":"2026-08-14","count":13},{"date":"2026-08-15","count":12}],"recent_events":[{"timestamp":"2026-08-15T01:52:44","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�\\;��mw�hh\u0000ܟ��)m","payload_hex":"801c0100020003000000100500805c3befff6d77e9686800dc9fd0f1296d","method":"","user_agent":"","ja3":"","session":"c6609714-e4f7-4b20-834a-324b80bfd12e","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:39","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@�����dE+�H4�����","payload_hex":"801c010002000300000010060040d3fc90ffdc64452bcf48349891a5b8ee","method":"","user_agent":"","ja3":"","session":"aa3e7a0d-e1eb-4aae-aab3-5bd118625469","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:39","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�Mt\t��q�m \u0010[�57��","payload_hex":"801c0100020003000000100200804d740984fc71c16d20105b923537f5c1","method":"","user_agent":"","ja3":"","session":"3969c825-05e5-4d3b-abf3-dcc7e72a8f31","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:34","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�4+),���ex�fC����","payload_hex":"801c0100020003000000100700c0342b292c8cd3c76578a36643a2eaecac","method":"","user_agent":"","ja3":"","session":"289783da-1c40-468a-81be-9ad1aa5b8abc","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"961231d25d0d0546","strings":["4+),"]}},{"timestamp":"2026-08-15T01:52:34","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000���\r:�N��F��AU�j\u000b","payload_hex":"801c010002000300000010040080bca30d3adf4e8bd146e7a54155eb6a0b","method":"","user_agent":"","ja3":"","session":"3152edcd-9a2e-49c8-80de-6073b81c3978","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:28","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000�5E�9�?6���q\r��hv","payload_hex":"801c0100020003000000100300803545de39f03f368ce3a8710d9eb26876","method":"","user_agent":"","ja3":"","session":"c7fc10a1-a150-42a3-acbc-b4f3b48d79f2","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:28","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�n���fR�K�N\u0003����=","payload_hex":"801c0100020003000000100100806e9487fa6652e34b8c4e03f3d2d7ef3d","method":"","user_agent":"","ja3":"","session":"ef6affe2-10a4-41be-b67c-5ab1ad63247f","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-15T01:52:22","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"c88a41d8-e037-4460-a882-86300d2120ea","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-08-15T01:52:20","port":5601,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"785a7a73-fc0f-41df-804e-692833ab191c","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-08-15T01:52:19","port":5601,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"A","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"82f8ac4f-c6f3-4f51-9251-3790beb74da0","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14}],"http_methods":[{"method":"GET","count":23}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":20,"ports":13},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1},{"path":"/containers/json?all=1","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":11}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T11:40:28.747196+00:00"}