{"ip":"44.220.188.22","total_events":51,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,992 bytes sent","bytes_sent":1992,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-06T08:07:27","last_seen":"2026-09-18T07:00:00","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-44-220-188-22.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":7548,"proto":"tcp","label":"","count":13},{"port":1723,"proto":"tcp","label":"PPTP","count":13},{"port":40000,"proto":"tcp","label":"","count":9},{"port":8883,"proto":"tcp","label":"","count":6},{"port":2002,"proto":"tcp","label":"","count":3},{"port":1194,"proto":"tcp","label":"OpenVPN","count":2},{"port":2095,"proto":"tcp","label":"","count":1},{"port":22,"proto":"tcp","label":"SSH","count":1},{"port":873,"proto":"tcp","label":"Rsync","count":1},{"port":179,"proto":"tcp","label":"BGP","count":1},{"port":51005,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["d6729b7f24428169e981ad4840063ca5"],"tls_ja4":["t13i171100_ab0a1bf427ad_ecd0401ec68b","t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":["1987606153939a4c0ccc1465ecf8e431"],"http_akin":[]},"fingerprint_peers":{"t13i171100_ab0a1bf427ad_ecd0401ec68b":69,"t13i4311h1_c7886603b240_b26ce05bbdd6":21,"d6729b7f24428169e981ad4840063ca5":148},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3070.111 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/59.0.3075.57 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3054.71 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3023.64 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3029.110 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3021.59 Safari/537.32"],"timeline":[{"date":"2026-07-11","count":1},{"date":"2026-07-26","count":3},{"date":"2026-07-30","count":3},{"date":"2026-08-12","count":1},{"date":"2026-08-13","count":1},{"date":"2026-09-18","count":3}],"recent_events":[{"timestamp":"2026-09-18T07:00:00","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010$\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000\u001625ZqRWQUd8e5ExVaB0hhxA","payload_hex":"102400064d51497364700302003c001632355a71525751556438653545785661423068687841","method":"","user_agent":"","ja3":"1987606153939a4c0ccc1465ecf8e431","session":"57a276c9-f44d-4655-a413-df9d0b4bc3d9","seq":1,"duration_ms":121,"bytes_in":38,"bytes_out":13,"enriched":{"digest":"7a52725df4274dd6","strings":["MQIsdp","25ZqRWQUd8e5ExVaB0hhxA"]}},{"timestamp":"2026-09-18T07:00:00","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u00100\u0000\u0004MQTT\u0004\u0002\u0000<\u0000$c3f523e2-5bb4-45da-a9d0-9ec4e9aed2cd","payload_hex":"103000044d5154540402003c002463336635323365322d356262342d343564612d613964302d396563346539616564326364","method":"","user_agent":"","ja3":"1987606153939a4c0ccc1465ecf8e431","session":"9a9f8133-7730-4940-9e46-e9a3bd493f32","seq":1,"duration_ms":121,"bytes_in":50,"bytes_out":13,"enriched":{"digest":"892642282e3392d4","label":"MQTT","strings":["MQTT","$c3f523e2-5bb4-45da-a9d0-9ec4e9aed2cd","<$c3f523e2-5bb4-45da-a9d0-9ec4e9aed2cd"]}},{"timestamp":"2026-09-18T07:00:00","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u00101\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000$c970b3e6-3676-4670-9878-e51775b5c712","payload_hex":"103100044d5154540502003c00002463393730623365362d333637362d343637302d393837382d653531373735623563373132","method":"","user_agent":"","ja3":"1987606153939a4c0ccc1465ecf8e431","session":"6c50d793-0296-4421-94da-f69b4a24bfe7","seq":1,"duration_ms":121,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"a20aa75151f171a7","label":"MQTT","strings":["MQTT","$c970b3e6-3676-4670-9878-e51775b5c712","<$c970b3e6-3676-4670-9878-e51775b5c712"]}},{"timestamp":"2026-08-13T15:45:13","port":873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 29\r\n\r\n","payload_hex":"405253594e43443a2032390d0a0d0a","method":"","user_agent":"","ja3":"","session":"2f712acf-af9b-4085-ba45-74b8947322dd","seq":1,"duration_ms":100,"bytes_in":15,"bytes_out":13,"enriched":{"digest":"811ff0e711f39b8c","strings":["@RSYNCD: 29"]}},{"timestamp":"2026-08-12T08:59:45","port":179,"proto":"tcp","app_proto":"","app_protocol":"bgp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����������������\u00009\u0001\u0004\u0000\u0001\u0000�\u0001\u0001\u0001\u0001\u001c\u0002\u0006\u0001\u0004\u0000\u0001\u0000\u0001\u0002\u0002�\u0000\u0002\u0002\u0002\u0000\u0002\u0002F\u0000\u0002\u0006A\u0004\u0000\u0000\u0000\u0001","payload_hex":"ffffffffffffffffffffffffffffffff00390104000100b4010101011c02060104000100010202800002020200020246000206410400000001","method":"","user_agent":"","ja3":"","session":"36488d00-8815-486d-9164-b8fef8122150","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":13},{"timestamp":"2026-07-30T23:09:27","port":2002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2002\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323030320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570742d656e636f64696e673a20677a69700d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"a44049bb-19cd-4a56-a5f6-ca03544af093","seq":1,"duration_ms":100,"bytes_in":234,"bytes_out":78},{"timestamp":"2026-07-30T23:09:27","port":2002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2002\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3021.59 Safari/537.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323030320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b656e2d555329204170706c655765624b69742f3533372e33322e333620284b48544d4c2c206c697665204765636b6f29204368726f6d652f35362e302e333032312e3539205361666172692f3533372e33320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/56.0.3021.59 Safari/537.32","ja3":"","session":"5f0d2253-9127-481d-95ed-ec052ea45242","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":78},{"timestamp":"2026-07-30T23:09:22","port":2002,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-paramiko_2.9.2\r\n\u0000\u0000\u0003�\u0005\u0014�ޥ\t��*���������\u0000\u0000\u0001\u001bcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c\u0000\u0000\u0000qssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss\u0000\u0000\u0000Waes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,3des-cbc\u0000\u0000\u0000Waes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"5353482d322e302d706172616d696b6f5f322e392e320d0a0000038c0514d0dea509f5be2afea5e3bbe0a7f5aaac0000011b637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6578742d696e666f2d63000000717373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3531322c7273612d736861322d3235362c7373682d7273612c7373682d647373000000576165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733139322d6362632c6165733235362d6362632c626c6f77666973682d6362632c336465732d636263000000576165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733139322d6362632c6165733235362d6362632c626c6f77666973682d6362632c336465732d63626300000083686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d6d64352c686d61632d736861312d39362c686d61632d6d64352d393600000083686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312c686d61632d6d64352c686d61632d736861312d39362c686d61632d6d64352d3936000000046e6f6e65000000046e6f6e65000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"3484eb72-62f7-4575-b45c-29af62b9de0b","seq":1,"duration_ms":124,"bytes_in":936,"bytes_out":13,"enriched":{"digest":"c05c44793c81d8ae","label":"SSH","strings":["SSH-2.0-paramiko_2.9.2","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","qssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha…","Waes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,…","hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@open…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-07-26T00:08:25","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u00101\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000$58ea3a13-c097-4e58-96aa-35b6bad18401","payload_hex":"103100044d5154540502003c00002435386561336131332d633039372d346535382d393661612d333562366261643138343031","method":"","user_agent":"","ja3":"1987606153939a4c0ccc1465ecf8e431","session":"680f0438-8353-481c-9252-13da659e2f40","seq":1,"duration_ms":202,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"a032bf31e30ce1ce","label":"MQTT","strings":["MQTT","$58ea3a13-c097-4e58-96aa-35b6bad18401","<$58ea3a13-c097-4e58-96aa-35b6bad18401"]}},{"timestamp":"2026-07-26T00:08:24","port":8883,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010$\u0000\u0006MQIsdp\u0003\u0002\u0000<\u0000\u00165jO0AXSei534PRpX2GQiG5","payload_hex":"102400064d51497364700302003c0016356a4f30415853656935333450527058324751694735","method":"","user_agent":"","ja3":"1987606153939a4c0ccc1465ecf8e431","session":"c6122ec5-9125-4edf-83df-dc1d1ddd9008","seq":1,"duration_ms":202,"bytes_in":38,"bytes_out":13,"enriched":{"digest":"ceeb3fb805996bc9","strings":["MQIsdp","5jO0AXSei534PRpX2GQiG5"]}}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":10,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":6}],"banners":[{"value":"SSH-2.0-paramiko_2.9.2","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:2002","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-24T13:38:56.886735+00:00"}