{"ip":"44.220.185.196","total_events":113,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,693 bytes sent","bytes_sent":2693,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-28T09:17:25","last_seen":"2026-08-29T07:13:23","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-44-220-185-196.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8044,"proto":"tcp","label":"","count":14},{"port":1801,"proto":"tcp","label":"","count":13},{"port":3389,"proto":"tcp","label":"RDP","count":13},{"port":6000,"proto":"tcp","label":"X11","count":13},{"port":50075,"proto":"tcp","label":"","count":12},{"port":4443,"proto":"tcp","label":"","count":12},{"port":2079,"proto":"tcp","label":"","count":12},{"port":40000,"proto":"tcp","label":"","count":11},{"port":9998,"proto":"tcp","label":"","count":8},{"port":8200,"proto":"tcp","label":"","count":3},{"port":2052,"proto":"tcp","label":"","count":1},{"port":2266,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":[]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":21,"t13d041000_16476d049b0b_78f1d400d464":128,"t13i3612h1_bcee18a5b459_8537cf56674e":301},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3044.63 Safari/537.32","elasticsearch-py/7.13.4 (Python 3.10.20)","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3099.80 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3051.112 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/60.0.3099.57 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3103.112 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-07-24","count":2},{"date":"2026-08-08","count":3},{"date":"2026-08-29","count":12}],"recent_events":[{"timestamp":"2026-08-29T07:13:23","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"7727b5f9-6036-4389-a9a8-a6bdfd7fdbf8","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-08-29T07:13:19","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"8e1e190a-384d-417f-889e-e7733888e4d7","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-08-29T07:12:47","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000��1v=���$9+em\\���","payload_hex":"801c0100020003000000100500808331763d9f888e24392b656d5cd1c0cb","method":"","user_agent":"","ja3":"","session":"5416c970-fc17-4420-b865-1f5469d84f70","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"e041f60eda8bb66a","strings":["$9+em\\"]}},{"timestamp":"2026-08-29T07:12:42","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000�\r\u0018�p\u0002-���W\u001f#3��S","payload_hex":"801c0100020003000000100100800d18f670022de4ebd9571f2333b9a953","method":"","user_agent":"","ja3":"","session":"0652d7bb-fadf-4a82-b58b-924e69f8327f","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-29T07:12:42","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000��-ږ\u0000�>��\n\u0016.��̷","payload_hex":"801c010002000300000010030080db2dda9600b93e9be70a162ea08eccb7","method":"","user_agent":"","ja3":"","session":"42523d63-1075-4237-a2ba-e054c92dd921","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-29T07:12:37","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000��\"ig�#��-vng�\\��","payload_hex":"801c010002000300000010040080cf226967a723a0b62d766e67825ce0ca","method":"","user_agent":"","ja3":"","session":"2d1946d7-88c0-4ab2-a3ba-2d5f4f0092e8","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"5569ad4f0c3f4c2a","strings":["-vng"]}},{"timestamp":"2026-08-29T07:12:37","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000���5;��oy}gvK\u0014=\u001a�","payload_hex":"801c010002000300000010020080ad98353ba4996f797d67764b143d1a8e","method":"","user_agent":"","ja3":"","session":"2c1f1dc4-8745-49bf-961e-43c036107786","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14,"enriched":{"digest":"bfbdae91ec749fc4","strings":["oy}gvK"]}},{"timestamp":"2026-08-29T07:12:32","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@\u000fw�\u0015�\u001e\b�\u0017j���G��","payload_hex":"801c0100020003000000100600400f77bd15fc1e08d7176ad6f5ef47f589","method":"","user_agent":"","ja3":"","session":"a9b64c4c-0133-4a09-a07d-3fa6925d44cd","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-29T07:12:32","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000���gT��N��YRW�o�r","payload_hex":"801c0100020003000000100700c0c8ec6754edab4efb95595257926fea72","method":"","user_agent":"","ja3":"","session":"2b43de67-d5ae-4687-b1e9-81d2bcee1de3","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-08-29T07:12:19","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"A","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"e718c24e-ce67-4da0-9880-0429bd0bed7c","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":18,"ports":11},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"localhost","count":1}],"top_alpns":[{"value":"http/1.1","count":15}],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T12:55:10.407925+00:00"}