{"ip":"52.14.197.136","data_as_of":"2026-10-24T00:39:09+00:00","observed":true,"total_events":4,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"apcosys","confidence":"high","network_type":"enterprise","why":["The address is in a published scanner range (apcosys).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 4 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,598 bytes sent","bytes_sent":2598,"session_seconds":26,"persistent":false},"basis":"combined"},"first_seen":"2026-10-17T06:52:09","last_seen":"2026-10-20T11:38:39","events_24h":0,"events_7d":4,"interactive_sessions":4,"interactive_sessions_24h":0,"interactive_sessions_7d":4,"interactive_protocols":[{"protocol":"elasticsearch-transport","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"Ohio","city":"Columbus","lat":39.9587,"lon":-82.9987,"asn":16509,"org":"Amazon.com, Inc."},"source_domain":"scan.apcosys.cc","known_scanners":["apcosys"],"scanner_tag":{"key":"peeringdb:as16509","label":"Amazon.com","category":"enterprise","url":"https://www.peeringdb.com/asn/16509"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":4,"first_seen":"2026-10-17T20:33:38","last_seen":"2026-10-20T11:38:39","verdicts":[{"verdict":"scan","sessions":2},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"elasticsearch@8.11.1","sessions":3}],"services":[{"protocol":"elasticsearch-transport","port":9300,"sessions":3},{"protocol":"tcp","port":7547,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2}]},"top_ports":[{"port":9300,"proto":"tcp","label":"Elastic-tr","count":0,"sessions":3},{"port":5985,"proto":"tcp","label":"","count":2,"sessions":0},{"port":6443,"proto":"tcp","label":"k8s API","count":2,"sessions":0},{"port":7547,"proto":"tcp","label":"TR-069","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["b11cun050_0004001e_6f27235c"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":50,"b11cun050_0004001e_6f27235c":9},"akin_families":{},"user_agents":["ApcosysBot/1.0 (+https://apcosys.net)"],"timeline":[{"date":"2026-10-17","count":4,"sessions":3},{"date":"2026-10-20","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-17T20:36:10","port":9300,"proto":"tcp","app_proto":"elasticsearch-transport","app_protocol":"elasticsearch-transport","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":" \u0000\u0000\u0001\u0000\b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"200000010008000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"c9d39728-89cf-4348-94ff-7ea4aad3193e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-17T20:33:23","port":9300,"proto":"tcp","app_proto":"elasticsearch-transport","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0005�\u0001\u0000\u0005�\u0003\u0003s�\u0014,��q��\u0016�'�[�A9*\u0007�\nh\u000e��^N�9~�7 J\u000f,d�͝�W\u0002�\u0014t6�њ�o��\u0003�F���\u000b[N��\u00002�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0000�\u0000�\u0000/\u00005�\u0012\u0000\n�#�'\u0000<�\u0007�\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005o\u0000\u000b\u0000\u0002\u0001\u0000�\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011�\u0011�\u0011�\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001c\u0000\u001a\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000 \u0000\u001e\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004�\u0004�\u0011�\u0004���0�Ъ=�c\r:\n��'��u\u0005�2��K�\fl^`�i\u0003k�c\u0011:��uU�2tX\u00046�,�\u0010��\b\fQ���P�r}�3zTG�W��O�E����H�nr\r����|�iܶі��X<>�NPr\nx�w�\u001a\u0019�L7\u000ew;\u0014�k�\u0014�4�K�ya��=w��m��j�* �.��7O7~����&{�\u0007�!{/\u0012�\u0006�\u00041�In�y=\u000b\u0017\u00168���WY'�Zc�\u0002i�.��J�H���\u0011\u001e���V?��X\nƜJ���V�NE\u0007�\u0016b��#���\u0013[c�d\"�[\u0001iB\u0015�6>IW��D|?�J�\t���^w׻x�|�8s\u001e\u000bz\u001b%���\b� A�\u0017ekh\u0000y4\u0005\n�\u0012Œh�\u0007��x2�C��`iT�\u000b���\u0018�\u0007x�z\u0016�\u0011�5�\u001f�QF$E軣�����;�\u001a�f7R�\u0005\u0005##\u0015�\u0012��Þ�iWzǑ&��:�|���t��y�\rrà��\u001e\u0007$PSI���1��\u00175)Z�h\f�\u0006J���?�m�@�mB\r1ל�R+��]�\u0018���Q���-�\u0004��G�Z*�\tǺ�EąR�WX/c\u0010\u0015\u0018\u001a$8x�����{׼����\rh\u0001}��]z���\r�t�\u0014�u\u0016�T\u0003T�[&��6<�\u0006��jzO6Cta���\u000e\\�\t\u000e\u0013kN0���&���N��\u0019S�ϱ\u0004�\u0011.G��g��\u0003oC�d�/X���$\u0010��8q\u0000\u001d\u0000 ϱ\u0004�\u0011.G��g��\u0003oC�d�/X���$\u0010��8q","payload_hex":"16030105ee010005ea030373b4142ca8a671989516b827c25bfe41392a079a0a680e98e35e4e8c397ee737204a0f2c6499cd9d8a5702ac147436e0d19ae06fd6d103cf469cad910b5b4ef6d30032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0ddf93092d0aa3da6630d3a0afbc027c3f47505ba32b9b84b990c6c5e60c169036bac63113a95977555c93274580436982ca310b3bb080c5187a5e750cc727dbd337a5447be57a7a94fd94581f4a38948806e720d9baa96f47ca169dcb6d1969a8b583c3ee94e50720a78e377eb1a19f24c370e773b14f36bcf148434d74ba67961f0e73d77d1c26d9c926ae22a20b82eb0d1374f377e8290b7dc267bf207a9217b2f12e806b50431cf496ecc793d0b171638a688e1575927bc5a63f402698a2e85994ac848caf6b3111e889c8c563f8da9580ac69c4a878cef56c84e4507c91662b7c1238d898c135b63a26422925b01694215ad363e4957b084447c3f8a4ae30984a0915e77d7bb78a87c8238731e0b7a1b2592bd8b08972041ae17656b68007934050ad512c59268a20796d97832a3439083606954c60ba994b818c10778d17a168111fb35ac1ff451462445e8bba3c0b681bca13bb41a83663752f20505232315dd1286dbc39e8f69577ac79126bbbc3a937c8f998274dacc79d40d72c3a0889c1e0724505349b084c73187951735295af5680cef064a85f3c33ff76de740c36d420d31d79cd9522bdfdb5ddc188ed0e651faa59c2dba04b3b847df5a2aad09c7baa645c48552bf57582f631015181a243878bf9ba5f2b17bd7bca58d96960d68017deacc5d7aaee7c20df974b914b67516eb540354a35b2694de363cda068fc06a7a4f36437461b3a0ca0e5ca8090e136b4e30c83c4138f9ac7f3999383f45a1c0c4270fd347949c8a3af10567922f4ac1a47df9bf0d5675ff6744218006d6a4206a5b7ff6ca41d19a902e4667b8a62a1a79cd42d8c40bec63b1bac6ac32804bc54c0311bdf34200a26c828c1453cf0b9e32a52531c5b71a4774290915092073af182188aa5ae905bd89778322eab10d2a72891ca7984c08e927aecabb367204c508ca141f8846c416585fb9a74098bf9fbab90062bd31b664c9d30820c1683043afb4c0840b5820b3cc0530d96edc15038a29a6d775c9f5a972d0310c1cc8a48493b955a21ae9cc608f16c8af01a5ae8181182506aa30ade533065f9675a849c83f95b956633bfa7204b60b9740b89b48970ae16336a681739ed84b06084856a330a5a0bfdad90833e47c68a727fd7b0580a5449e6cb3b299967b00c576f591c1e825f463c379a044f15677a5d133ab8c237b8557be7b807922754812ccf9aab243309106e67e298a72d1c424b3a083d92b87a3e0afbb0258ca236b79e544e5477390039153a0a308a466f8680dd6d8cfe8f9269b7aacde3725f50b9c10c206ca0bc83d032455b22bbcf479ba1a4a320c901400ad75e3cb9cf97f40ec9f85296bd781840db119c75457285aace8e801e9cc8432a97182d4aa62e43f3afba25cb39eddaa7cd6c655a6181c62d82297746c1890acb0089199e80bce4017887136c4dc4e797c2904907430509f01e02a611a3843a7c9f239cf8ada3aac95c21c95c4a4e723d887b89e58c07c7360e8ec25505343afa2438e456a2e23236928451bf423bebb5177c27ce3e469e3018b452c4c729643fd756f1071c4ae19c675d27c9716239efa19e1a0c0193a93cc5ba691fb2ef2954a82f1a2df1925883b4e50bd428de97c1e605625b472ffe91fdbdf2f273e84df268cf3fa4ec8cd195392cfb104ee112e47ece967fe89ee839a036f43a164b52f58a599da241092e23871001d0020cfb104ee112e47ece967fe89ee839a036f43a164b52f58a599da241092e23871","method":"","user_agent":"","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"e07c92b0-e239-43fb-81ea-565f719f78f1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0da0a2bef7723be6","label":"TLS/SSL","strings":["3zTG","7O7~","6>IW","QF$E","$PSI","WX/c","jzO6Cta","y\"uH","TW(Z","Ny|)"]},"interactive":true},{"timestamp":"2026-10-17T09:49:21","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"32239338-a85a-4257-a30c-dc0c0976f7fc","seq":2,"duration_ms":396,"bytes_in":349,"bytes_out":156},{"timestamp":"2026-10-17T09:49:20","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"32239338-a85a-4257-a30c-dc0c0976f7fc","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":78},{"timestamp":"2026-10-17T06:52:11","port":6443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"0880e9a7-f051-43c9-9b78-136ed1b15c0f","seq":2,"duration_ms":1713,"bytes_in":351,"bytes_out":156},{"timestamp":"2026-10-17T06:52:09","port":6443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"0880e9a7-f051-43c9-9b78-136ed1b15c0f","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/favicon.ico","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US;q=0.8,en;q=0.7","notable":false},{"name":"Host","value":"","notable":false},{"name":"User-Agent","value":"ApcosysBot/1.0 (+https://apcosys.net)","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[]}