{"ip":"54.77.111.234","data_as_of":"2026-10-24T00:40:57+00:00","observed":true,"total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"apcosys","confidence":"high","network_type":"enterprise","why":["The address is in a published scanner range (apcosys).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 5 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,381 bytes sent","bytes_sent":2381,"session_seconds":25,"persistent":false},"basis":"combined"},"first_seen":"2026-10-17T17:35:01","last_seen":"2026-10-22T01:46:09","events_24h":0,"events_7d":2,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"smb","sessions":2},{"protocol":"elasticsearch-transport","sessions":2},{"protocol":"cassandra","sessions":1}],"geo":{"country_code":"IE","country_name":"Ireland","region":"Leinster","city":"Dublin","lat":53.3354,"lon":-6.252,"asn":16509,"org":"Amazon.com, Inc."},"source_domain":"scan.apcosys.cc","known_scanners":["apcosys"],"scanner_tag":{"key":"peeringdb:as16509","label":"Amazon.com","category":"enterprise","url":"https://www.peeringdb.com/asn/16509"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":6,"first_seen":"2026-10-17T17:35:01","last_seen":"2026-10-20T10:16:32","verdicts":[{"verdict":"scan","sessions":4},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"smb@Windows Server 2019","sessions":2},{"persona":"elasticsearch@8.11.1","sessions":2},{"persona":"cassandra@3.11.10","sessions":1},{"persona":"dns@dnsmasq 2.80","sessions":1}],"services":[{"protocol":"smb","port":139,"sessions":2},{"protocol":"elasticsearch-transport","port":9300,"sessions":2},{"protocol":"cassandra","port":9042,"sessions":1},{"protocol":"dns","port":8082,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4}]},"top_ports":[{"port":27017,"proto":"tcp","label":"MongoDB","count":2,"sessions":0},{"port":139,"proto":"tcp","label":"SMB","count":0,"sessions":2},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":0,"sessions":2},{"port":9042,"proto":"tcp","label":"Cassandra","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["b11cun050_0004001e_6f27235c"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":50,"b11cun050_0004001e_6f27235c":9},"akin_families":{},"user_agents":["ApcosysBot/1.0 (+https://apcosys.net)"],"timeline":[{"date":"2026-10-17","count":0,"sessions":3},{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-20","count":0,"sessions":1},{"date":"2026-10-22","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-22T01:46:09","port":27017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"d836f4c2-ddad-4617-881f-b0d3a15df39e","seq":2,"duration_ms":241,"bytes_in":349,"bytes_out":156},{"timestamp":"2026-10-22T01:46:09","port":27017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"d836f4c2-ddad-4617-881f-b0d3a15df39e","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":78},{"timestamp":"2026-10-20T10:16:32","port":139,"proto":"tcp","app_proto":"smb","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"GET / HTTP/1.1\r\nHost: \r\nAccept: */*\r\nAccept-Encoding: identity\r\nAccept-Language: en-US;q=0.8,en;q=0.7\r\nUser-Agent: ApcosysBot/1.0 (+https://apcosys.net)\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"","user_agent":"","ja3":"","session":"4f03a1b8-cdfb-4e9b-80d3-7bea8950f22c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e6affdeb6921906d","label":"HTTP","strings":["GET / HTTP/1.1","Host: ","Accept: */*","Accept-Encoding: identity","Accept-Language: en-US;q=0.8,en;q=0.7","User-Agent: ApcosysBot/1.0 (+https://apcosys.net)"],"iocs":{"urls":["https://apcosys.net)"],"domains":["apcosys.net"]}},"interactive":true},{"timestamp":"2026-10-19T12:41:12","port":139,"proto":"tcp","app_proto":"smb","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0005�\u0001\u0000\u0005�\u0003\u0003�зf�\rc��09\r�\"\u0006L��U[�z��;+�\u001dsc\nC �-~v��\u0011Î(���\u000e���p\r+�\u0019�Ή�\u0005\u001d\u0000^n�\u00002�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0000�\u0000�\u0000/\u00005�\u0012\u0000\n�#�'\u0000<�\u0007�\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005o\u0000\u000b\u0000\u0002\u0001\u0000�\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011�\u0011�\u0011�\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001c\u0000\u001a\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000 \u0000\u001e\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004�\u0004�\u0011�\u0004�MU\u0002��|Vc4*6\u0013�1&�0k�:�X~?\u0002D�QM?\u001a\u0004�\bm��#� ���\u001a����f�,�\u000e_���C\u0003��=�34���(l\u0006�;]r��e�\u001f�yC3�w\u001c3�?�-��?\u001aP1\nw�>�Ia�s�,�\u0018�h����aRy���,@n\u001c���\bS�:M�`��aZ4��\u0011`.#��`\u0013��V����I\u000buؖWzYYS\ned�P�x�67�f=V�~̂lRU�JDf�,\\��%�p�GTTa���h�:�AWd_t�\u0015\n�s6�M�ۖʓu�#\r8|\n�6Z�|_y\u000bI{���u�#�\u001b�'��\u000b��@dB�7�\u0006*j�?ĩ��ɶ�\u0000ʞ\u0002�艳�Ԯ46662v�d�P��+\\��3i>�α7���u-�����ū+7QuNe\f�f��!����\u000b\u000b�\u001b8�����䜐\u0004]\u001a2.�B\u001bk��cRa}�}��;�p���8ٴ0\u00192>'�@k�\b\f\u0006��x�8s���`�AkP\u001c\u00133��[��6u`A�g����p*��\u000b-����2�j�\t�4C�h�qd\u00122�\u001e\u001a�2\u0002\u0017�30\u0018���G��*\u0016�[�u�4�\u0007\u00193���S6I���%�f�<_W�P\u001a�WI��D7y:R�!E4Jr\u0006g\f0�!#�!0\u0003�O�����絿�;a��\u0013��V�\\\u0017��N͵l�Ц���?��R��ph0\u0016p^[v>�U��j��\u0015Pɦ�:|))��z,�e�M2\u001b2!xgy�Q�\t\u0005�a���20���V�:�;-���A)�����RmÎ�`�\u000f�/v�e\u00047*���\n6�\rb�9��,�Ř�15�Ȼ!� \\��3{�\u001c�`�\u0011S�Q粼��ƽ�G��d�#*\u00153R\u001e\u0000�x\f\u0016����󸔑v�\u0010I�3���pg��ʱ\u0007��i�!V\u001b�'��4Tz�P����z�\u0019D\t\\Ru��r�Ud\u0002]e@ĂPa���q��P�2�b\u000eS�ل\u001e�[\u001f\"����\u000bD��$\u0011\u0016�47M*\u0002{�\u001b?�9�hR)�H=ӑoq,k\b�4�eBy\u000b�ơS�&DeZ��_0\u001cC�\u0005o[&Si�� !!\u00026o\u001a�V�\u0004\u0017\u0007Y_�\u0001\r\nAccept: */*\r\nAccept-Encoding: identity\r\nAccept-Language: en-US;q=0.8,en;q=0.7\r\nUser-Agent: ApcosysBot/1.0 (+https://apcosys.net)\r\n\r\n","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"","user_agent":"","ja3":"","session":"fb5c9b84-b8d1-4ab8-b5b5-4f830d10ca98-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e6affdeb6921906d","label":"HTTP","strings":["GET / HTTP/1.1","Host: ","Accept: */*","Accept-Encoding: identity","Accept-Language: en-US;q=0.8,en;q=0.7","User-Agent: ApcosysBot/1.0 (+https://apcosys.net)"],"iocs":{"urls":["https://apcosys.net)"],"domains":["apcosys.net"]}},"interactive":true}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US;q=0.8,en;q=0.7","notable":false},{"name":"Host","value":"","notable":false},{"name":"User-Agent","value":"ApcosysBot/1.0 (+https://apcosys.net)","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[]}