{"ip":"172.203.251.162","data_as_of":"2026-10-26T12:35:21+00:00","observed":true,"total_events":38,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 11 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,638 bytes sent","bytes_sent":3638,"session_seconds":45,"persistent":false},"basis":"combined"},"first_seen":"2026-09-16T01:54:09","last_seen":"2026-10-25T14:49:39","events_24h":0,"events_7d":2,"interactive_sessions":11,"interactive_sessions_24h":1,"interactive_sessions_7d":9,"interactive_protocols":[{"protocol":"modbus","sessions":2},{"protocol":"dns","sessions":2},{"protocol":"minecraft","sessions":2},{"protocol":"vnc","sessions":2},{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":["strechoid"],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","kev_date_added":"2025-04-29"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5632,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-23T23:21:58","last_seen":"2026-10-23T23:21:58","recent":[{"timestamp":"2026-10-23T23:21:58","port":5632,"src_port":42156,"proto":"udp","app_proto":"","app_protocol":"","summary":"NQ\n","payload_hex":"4e510a","sni":"","session":"9e5c3b18-4922-4940-8fff-297cc43e7ccb","bytes_in":3,"source_verified":false}]},"interaction":{"window_days":90,"sessions":11,"first_seen":"2026-10-17T07:11:35","last_seen":"2026-10-25T14:49:39","verdicts":[{"verdict":"scan","sessions":6},{"verdict":"unknown","sessions":5}],"personas":[{"persona":"vnc@RealVNC Server 6.11.0","sessions":2},{"persona":"minecraft@Purpur 1.19.4","sessions":2},{"persona":"ics@Siemens S7-1200","sessions":2},{"persona":"dns@dnsmasq 2.80","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"dns","port":53,"sessions":2},{"protocol":"modbus","port":502,"sessions":2},{"protocol":"tcp","port":5007,"sessions":2},{"protocol":"minecraft","port":25565,"sessions":2},{"protocol":"vnc","port":5902,"sessions":2},{"protocol":"http","port":443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":6}]},"top_ports":[{"port":8445,"proto":"tcp","label":"","count":3,"sessions":0},{"port":989,"proto":"tcp","label":"","count":2,"sessions":0},{"port":60001,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9997,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9200,"proto":"tcp","label":"Elastic","count":2,"sessions":0},{"port":4911,"proto":"tcp","label":"","count":2,"sessions":0},{"port":17990,"proto":"tcp","label":"","count":2,"sessions":0},{"port":18480,"proto":"tcp","label":"","count":2,"sessions":0},{"port":69,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9001,"proto":"tcp","label":"Tor","count":2,"sessions":0},{"port":8022,"proto":"tcp","label":"","count":2,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":2,"sessions":0},{"port":5986,"proto":"tcp","label":"","count":2,"sessions":0},{"port":53,"proto":"tcp","label":"DNS","count":0,"sessions":2},{"port":502,"proto":"tcp","label":"MODBUS","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t10i080600_dafb69683c10_583ba773bd60"],"tls_client_hello":"16030100ee010000ea0303e0efe60ce22199db1887afaf0697c033c4238a20006f34cef2319d7ffc7ec0af209a5908d0cdb27a56a212db157b6fda81ec448f2f1d267c62ea1749817e582bad0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00204f57b410cf3d60ed6fb9f8a639bfbfac4c5b4d081b367fdeaebe4ea8","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab","8dace756ca50d2b376c065ba937de663"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t10i080600_dafb69683c10_583ba773bd60"],"tls_ja3":["8dace756ca50d2b376c065ba937de663"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3303,"t10i080600_dafb69683c10_583ba773bd60":0,"e54ef3ec27fe1fea7ab64d3fa05359fd":641,"b11cun040_00040016_aa48e2c8":5564},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-16","count":4,"sessions":0},{"date":"2026-09-17","count":1,"sessions":0},{"date":"2026-09-18","count":3,"sessions":0},{"date":"2026-09-19","count":2,"sessions":0},{"date":"2026-09-22","count":3,"sessions":0},{"date":"2026-09-23","count":2,"sessions":0},{"date":"2026-09-24","count":2,"sessions":0},{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-28","count":3,"sessions":0},{"date":"2026-10-03","count":4,"sessions":0},{"date":"2026-10-06","count":2,"sessions":0},{"date":"2026-10-08","count":2,"sessions":0},{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-17","count":1,"sessions":2},{"date":"2026-10-18","count":1,"sessions":0},{"date":"2026-10-19","count":2,"sessions":2},{"date":"2026-10-21","count":0,"sessions":2},{"date":"2026-10-23","count":0,"sessions":2},{"date":"2026-10-24","count":0,"sessions":2},{"date":"2026-10-25","count":2,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T11:05:50","port":5986,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5986\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938360a","method":"","user_agent":"","ja3":"","session":"e867b698-3e7c-478a-bb94-d2801da773e1","seq":1,"duration_ms":8,"bytes_in":27,"bytes_out":15,"enriched":{"digest":"45c8b82d7c68fec9","strings":["MGLNDD_<HONEYPOT>_5986"]}},{"timestamp":"2026-10-25T11:05:50","port":5986,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"0feff401-41cb-4b1a-80b3-087137154226","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-23T11:01:11","port":502,"proto":"tcp","app_proto":"modbus","app_protocol":"modbus","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_502\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f3530320a","method":"","user_agent":"","ja3":"","session":"cb587983-fc77-4c06-aaa5-fc5a141d61fb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a73ecca3188141c4","strings":["MGLNDD_<HONEYPOT>_502"]},"interactive":true},{"timestamp":"2026-10-23T11:01:11","port":502,"proto":"tcp","app_proto":"modbus","app_protocol":"modbus","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000","payload_hex":"5a4700000005002b0e0100","method":"","user_agent":"","ja3":"","session":"2d8b4e1b-78b4-4651-b7b4-b3f8710e4987-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T19:18:44","port":5902,"proto":"tcp","app_proto":"vnc","app_protocol":"vnc","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5902\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f353930320a","method":"","user_agent":"","ja3":"","session":"35d540c8-75ca-4838-80e6-4d6e558bdb60-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aca496cccb48c981","strings":["MGLNDD_<HONEYPOT>_5902"]},"interactive":true},{"timestamp":"2026-10-19T04:51:51","port":9997,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9997\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939370a","method":"","user_agent":"","ja3":"","session":"f73c891f-9f35-4b8e-96e2-1b9836d5248a","seq":1,"duration_ms":75,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"97d5359916660166","strings":["MGLNDD_<HONEYPOT>_9997"]}},{"timestamp":"2026-10-19T04:51:51","port":9997,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9997\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"0eb7549d-827a-42e1-9706-f3c9225ab2eb","seq":1,"duration_ms":102,"bytes_in":115,"bytes_out":80},{"timestamp":"2026-10-18T05:01:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/developmentserver/metadatauploader","summary":"","payload_hex":"474554202f646576656c6f706d656e747365727665722f6d6574616461746175706c6f6164657220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"76b15174-7e3f-4b60-8424-0c3582fdefe0","seq":1,"duration_ms":166,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-10-17T21:47:29","port":1583,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1583\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313538330a","method":"","user_agent":"","ja3":"","session":"a3e58a4f-1955-4aca-b502-34bd3a04162e","seq":1,"duration_ms":63,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"ab5b48b4f86bf6da","strings":["MGLNDD_<HONEYPOT>_1583"]}},{"timestamp":"2026-10-17T07:11:36","port":53,"proto":"tcp","app_proto":"dns","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_53\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f35330a","method":"","user_agent":"","ja3":"","session":"351950fa-1187-4cdb-9fa6-8b8e3930e9ef-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f683c0a3971ee755","strings":["MGLNDD_<HONEYPOT>_53"]},"interactive":true}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":28,"top_paths":[{"path":"/","count":7,"ports":6},{"path":"/hudson","count":1,"ports":1},{"path":"/_all_dbs","count":1,"ports":1},{"path":"/developmentserver/metadatauploader","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5986","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"],"kev_date_added":"2025-04-29"}]}