{"ip":"44.220.188.107","total_events":159,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,616 bytes sent","bytes_sent":6616,"session_seconds":6,"persistent":false}},"first_seen":"2026-03-13T01:22:54","last_seen":"2026-09-06T03:25:44","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-44-220-188-107.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":32},{"port":2002,"proto":"tcp","label":"","count":15},{"port":222,"proto":"tcp","label":"","count":13},{"port":2375,"proto":"tcp","label":"Docker","count":13},{"port":888,"proto":"tcp","label":"","count":12},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":4443,"proto":"tcp","label":"","count":12},{"port":5001,"proto":"tcp","label":"","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":11},{"port":1024,"proto":"tcp","label":"","count":11},{"port":3001,"proto":"tcp","label":"","count":3},{"port":2222,"proto":"tcp","label":"SSH-alt","count":3},{"port":2525,"proto":"tcp","label":"","count":2},{"port":10000,"proto":"tcp","label":"Webmin","count":2},{"port":8042,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":["d6729b7f24428169e981ad4840063ca5"],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"","tls_ja3":["d18b223ce817c861b7829130500395c2","f80d3d09f61892c5846c854dd84ac403","a66e498c488aa0523759691248cdfb01"],"http_akin":[]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":21,"t13d041000_16476d049b0b_78f1d400d464":128,"t13i3612h1_bcee18a5b459_8537cf56674e":301,"d6729b7f24428169e981ad4840063ca5":148},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3002.90 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3107.107 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/51.0.3000.66 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3062.52 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3063.95 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/54.0.3007.70 Safari/537.32"],"timeline":[{"date":"2026-07-02","count":12},{"date":"2026-07-07","count":12},{"date":"2026-07-19","count":15},{"date":"2026-07-20","count":3},{"date":"2026-07-28","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-12","count":2},{"date":"2026-08-14","count":1},{"date":"2026-08-25","count":3},{"date":"2026-09-06","count":12}],"recent_events":[{"timestamp":"2026-09-06T03:25:44","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"097e840f-0519-492d-b9f7-f59286d6e9c6","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-09-06T03:25:42","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015\u0003\u0001\u0000\u0002\u0002P","payload_hex":"15030100020250","method":"","user_agent":"","ja3":"","session":"1f4ba4de-2257-497e-857b-ac58fdfb919f","seq":1,"duration_ms":0,"bytes_in":7,"bytes_out":14},{"timestamp":"2026-09-06T03:25:34","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000���bJ�\f�����\u0011�","payload_hex":"801c010002000300000010010080ef9c96b1a5624abd0cb697eec6c11195","method":"","user_agent":"","ja3":"","session":"5ed62547-dd24-4a0f-a57e-d1d2523e8b24","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:29","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000���m�|��\rw�x��\u001d��","payload_hex":"801c010002000300000010030080af846da27cc3f90d77a87885c41d81d2","method":"","user_agent":"","ja3":"","session":"b0cc39ef-35e2-4b9a-93bd-176c25144d6b","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:29","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@l\u0001�F�����Iw\n>�Ă","payload_hex":"801c0100020003000000100600406c018746c5c4fc98fa49770a3ee1c482","method":"","user_agent":"","ja3":"","session":"de434665-e9f7-40ad-9256-eec0f0d874ae","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:23","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�\n�2�R���\u0001J�6\u0004\f\u001d�","payload_hex":"801c0100020003000000100700c00ad832c3529aa6bf014ac836040c1d9c","method":"","user_agent":"","ja3":"","session":"233f5711-9f22-4039-b85c-cfd958075f16","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:23","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�i�\u0017\u001f�\r��e�_Ԅc}�","payload_hex":"801c01000200030000001005008069f2171f910d81bf659f5fd484637d8f","method":"","user_agent":"","ja3":"","session":"657b934c-ea92-44e0-9788-41fb9d403b4c","seq":1,"duration_ms":102,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:18","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"A","payload_hex":"41","method":"","user_agent":"","ja3":"a66e498c488aa0523759691248cdfb01","session":"7105546a-d0fe-414d-8e5b-692f1370fd96","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-06T03:25:18","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000�\rת�&%�#��\u000e\u0012\u001d��\u0006","payload_hex":"801c0100020003000000100400800dd7aaa62625e72393cd0e121dcac906","method":"","user_agent":"","ja3":"","session":"8bb8312b-c5dc-4cd5-9735-83de92d3530a","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":14},{"timestamp":"2026-09-06T03:25:18","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000�io\u0001\u0013��J/�S�\u0013Mد�","payload_hex":"801c010002000300000010020080696f01139cb94a2fb853a1134dd8afac","method":"","user_agent":"","ja3":"","session":"9e993ceb-1ff2-4ad0-bedd-6beab78090ce","seq":1,"duration_ms":102,"bytes_in":30,"bytes_out":14}],"http_methods":[{"method":"GET","count":31}],"distinct_ports_total":19,"top_paths":[{"path":"/","count":31,"ports":18}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"localhost","count":1}],"top_alpns":[{"value":"http/1.1","count":15}],"banners":[{"value":"SSH-2.0-paramiko_2.9.2","count":2}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T13:04:56.019109+00:00"}