{"ip":"98.80.4.64","total_events":112,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"crowdstrikefalconsurface","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (crowdstrikefalconsurface).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,273 bytes sent","bytes_sent":5273,"session_seconds":10,"persistent":false}},"first_seen":"2026-03-11T21:31:29","last_seen":"2026-09-15T08:26:09","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"scanner-98-80-4-64.reposify.net","known_scanners":["crowdstrikefalconsurface","Reposify (CrowdStrike)"],"scanner_tag":{"key":"reposify","label":"Reposify (CrowdStrike)","category":"commercial","url":"https://www.crowdstrike.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":19200,"proto":"tcp","label":"","count":16},{"port":389,"proto":"tcp","label":"LDAP","count":13},{"port":4443,"proto":"tcp","label":"","count":12},{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":502,"proto":"tcp","label":"","count":11},{"port":58000,"proto":"tcp","label":"","count":11},{"port":10443,"proto":"tcp","label":"","count":10},{"port":6667,"proto":"tcp","label":"IRC","count":5},{"port":8889,"proto":"tcp","label":"","count":4},{"port":102,"proto":"tcp","label":"","count":4},{"port":20000,"proto":"tcp","label":"","count":3},{"port":9200,"proto":"tcp","label":"Elastic","count":3},{"port":9191,"proto":"tcp","label":"","count":2},{"port":33060,"proto":"tcp","label":"","count":2},{"port":8081,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6","t13d041000_16476d049b0b_78f1d400d464","t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"","tls_ja3":["d18b223ce817c861b7829130500395c2","a66e498c488aa0523759691248cdfb01"],"http_akin":[]},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":21,"t13d041000_16476d049b0b_78f1d400d464":128,"t13i3612h1_bcee18a5b459_8537cf56674e":301},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3033.113 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3093.92 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/52.0.3059.89 Safari/537.32","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/53.0.3040.106 Safari/537.32","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/58.0.3001.50 Safari/537.32","elasticsearch-py/7.13.4 (Python 3.10.21)"],"timeline":[{"date":"2026-07-05","count":1},{"date":"2026-07-21","count":1},{"date":"2026-07-23","count":18},{"date":"2026-08-02","count":1},{"date":"2026-08-13","count":3},{"date":"2026-08-28","count":1},{"date":"2026-09-02","count":4},{"date":"2026-09-10","count":12},{"date":"2026-09-15","count":3}],"recent_events":[{"timestamp":"2026-09-15T08:26:09","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.21)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.21,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3231290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32312c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.21)","ja3":"","session":"30597a3f-9cf4-4e9e-87ed-4c5a1c96302c","seq":1,"duration_ms":100,"bytes_in":246,"bytes_out":75},{"timestamp":"2026-09-15T08:26:09","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.21)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.21,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_alias","summary":"","payload_hex":"474554202f5f616c69617320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3231290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32312c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.21)","ja3":"","session":"30597a3f-9cf4-4e9e-87ed-4c5a1c96302c","seq":2,"duration_ms":296,"bytes_in":498,"bytes_out":150},{"timestamp":"2026-09-15T08:26:09","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"elasticsearch-py/7.13.4 (Python 3.10.21)\",\"x-elastic-client-meta\":\"es=7.13.4,py=3.10.21,t=7.13.4,ur=1.26.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/*","summary":"","payload_hex":"474554202f2a20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a4163636570742d456e636f64696e673a206964656e746974790d0a636f6e6e656374696f6e3a206b6565702d616c6976650d0a636f6e74656e742d747970653a206170706c69636174696f6e2f6a736f6e0d0a757365722d6167656e743a20656c61737469637365617263682d70792f372e31332e342028507974686f6e20332e31302e3231290d0a782d656c61737469632d636c69656e742d6d6574613a2065733d372e31332e342c70793d332e31302e32312c743d372e31332e342c75723d312e32362e31310d0a0d0a","method":"GET","user_agent":"elasticsearch-py/7.13.4 (Python 3.10.21)","ja3":"","session":"30597a3f-9cf4-4e9e-87ed-4c5a1c96302c","seq":3,"duration_ms":491,"bytes_in":745,"bytes_out":225},{"timestamp":"2026-09-10T18:11:25","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0005\u0000�->\n�U��-��+�\"��q","payload_hex":"801c0100020003000000100500802d3e0ad355bdae2d8cca2b8f22fe9071","method":"","user_agent":"","ja3":"","session":"66f13c6e-fac3-4450-b64a-1a71a9743ab4","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:20","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0002\u0000��\u001a�\u0011����`Ԧ��Z�5","payload_hex":"801c0100020003000000100200808e1a981193ffbd9460d4a6d0d85abd35","method":"","user_agent":"","ja3":"","session":"9bb3e06a-c537-44e6-8b7d-687df0b7255d","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:20","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0001\u0000��\u0004{\ns�\u0007��]�5/��","payload_hex":"801c010002000300000010010080d0047b0a738f07e1a25da6352fb07fd5","method":"","user_agent":"","ja3":"","session":"f97723ea-6c4c-43f6-9d7a-fce05b5bec50","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:15","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0006\u0000@\u0004˜����^\u0001\b��=�1J","payload_hex":"801c01000200030000001006004004cb9caef9bafb5e0108f7f73dd7314a","method":"","user_agent":"","ja3":"","session":"8da1bc15-0b5d-40af-8a2d-7ec969f9af71","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:14","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0003\u0000�x��n$�(c�ۓY}\n�;","payload_hex":"801c010002000300000010030080789db46e24e42863f6db93597d0ac03b","method":"","user_agent":"","ja3":"","session":"b6ea5e6e-fec1-4f99-894f-0fa124a03a48","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:09","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0004\u0000�rl\n3g�Vεsj\u000bv�kT","payload_hex":"801c010002000300000010040080726c0a3367e356ceb5736a0b769f6b54","method":"","user_agent":"","ja3":"","session":"0d957c86-bd0f-4638-a278-0625423b1b23","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10},{"timestamp":"2026-09-10T18:11:09","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001c\u0001\u0000\u0002\u0000\u0003\u0000\u0000\u0000\u0010\u0007\u0000�7\u0014\tY��@��\n��\u0006*96","payload_hex":"801c0100020003000000100700c037140959bcb640b7e90aa9f0062a3936","method":"","user_agent":"","ja3":"","session":"c5137bfb-615d-419a-bc51-9a17020054ef","seq":1,"duration_ms":100,"bytes_in":30,"bytes_out":10}],"http_methods":[{"method":"GET","count":26}],"distinct_ports_total":18,"top_paths":[{"path":"/","count":24,"ports":17},{"path":"/_alias","count":1,"ports":1},{"path":"/*","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":9}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Type","Host","User-Agent","X-Elastic-Client-Meta"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:9200","notable":false},{"name":"User-Agent","value":"elasticsearch-py/7.13.4 (Python 3.10.21)","notable":false},{"name":"X-Elastic-Client-Meta","value":"es=7.13.4,py=3.10.21,t=7.13.4,ur=1.26.11","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-24T12:54:55.104564+00:00"}