{"ip":"20.168.121.140","total_events":89,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,091 bytes sent","bytes_sent":1091,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-21T14:46:05","last_seen":"2026-10-06T15:32:38","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":["strechoid"],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":7473,"events":1},{"port":8088,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T04:35:54","last_seen":"2026-10-06T09:44:24","recent":[{"timestamp":"2026-10-06T09:44:24","port":7473,"src_port":37953,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_7473\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373437330a","sni":"","session":"9975692e-80d2-4bed-9cc1-cc43231cc5bd","bytes_in":27,"source_verified":false,"enriched":{"digest":"dbe4ccd23bcad7c6","strings":["MGLNDD_<HONEYPOT>_7473"]}},{"timestamp":"2026-10-06T04:35:54","port":8088,"src_port":38204,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","sni":"","session":"948e451b-44ff-402e-9b46-46f817873bae","bytes_in":25,"source_verified":false,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}}]},"top_ports":[{"port":8998,"proto":"tcp","label":"","count":5},{"port":9990,"proto":"tcp","label":"","count":4},{"port":8333,"proto":"tcp","label":"Bitcoin","count":3},{"port":3391,"proto":"tcp","label":"","count":3},{"port":8086,"proto":"tcp","label":"InfluxDB","count":3},{"port":4332,"proto":"tcp","label":"","count":3},{"port":981,"proto":"tcp","label":"","count":2},{"port":1723,"proto":"tcp","label":"PPTP","count":2},{"port":1414,"proto":"tcp","label":"","count":2},{"port":8005,"proto":"tcp","label":"","count":2},{"port":9002,"proto":"tcp","label":"","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":2},{"port":2304,"proto":"tcp","label":"","count":2},{"port":8181,"proto":"tcp","label":"","count":2},{"port":9443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-14","count":3},{"date":"2026-07-17","count":1},{"date":"2026-07-19","count":1},{"date":"2026-07-24","count":1},{"date":"2026-07-27","count":1},{"date":"2026-07-28","count":1},{"date":"2026-08-04","count":2},{"date":"2026-08-07","count":1},{"date":"2026-08-11","count":2},{"date":"2026-08-13","count":1},{"date":"2026-08-16","count":1},{"date":"2026-08-17","count":1},{"date":"2026-08-25","count":1},{"date":"2026-08-26","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":2},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-02","count":1},{"date":"2026-10-04","count":1},{"date":"2026-10-05","count":2},{"date":"2026-10-06","count":1}],"recent_events":[{"timestamp":"2026-10-06T15:32:38","port":981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_981\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938310a","method":"","user_agent":"","ja3":"","session":"3b32f88c-2373-496e-992b-c7e942978b51","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"7db9c1ef4ae692a8","strings":["MGLNDD_<HONEYPOT>_981"]}},{"timestamp":"2026-10-05T06:13:49","port":3391,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3391\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333339310a","method":"","user_agent":"","ja3":"","session":"af34090f-0a59-4d35-a97e-53dc77e67876","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"953a681d6807fcf2","strings":["MGLNDD_<HONEYPOT>_3391"]}},{"timestamp":"2026-10-05T00:39:45","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"67d496cb-b30f-4122-a9b8-7f4a0ff6f0d4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-10-04T17:48:28","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"dc091202-aa24-488e-b513-fe10387d3e1d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-10-02T16:43:24","port":8880,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8880\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838300a","method":"","user_agent":"","ja3":"","session":"545a73c3-7354-40d3-976e-27201f900201","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"1c9a37bd34cce390","strings":["MGLNDD_<HONEYPOT>_8880"]}},{"timestamp":"2026-09-30T11:31:56","port":1414,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1414\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313431340a","method":"","user_agent":"","ja3":"","session":"15852d6e-a55d-4f83-9cc4-cfa18d052c2e","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"be2331fdf69dff81","strings":["MGLNDD_<HONEYPOT>_1414"]}},{"timestamp":"2026-09-29T01:04:57","port":8086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8086\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038360a","method":"","user_agent":"","ja3":"","session":"869ba5cc-52f5-4847-a9e3-3a30d0964ee0","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"d593dd6d23410c6f","strings":["MGLNDD_<HONEYPOT>_8086"]}},{"timestamp":"2026-09-27T22:55:45","port":3790,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3790\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333739300a","method":"","user_agent":"","ja3":"","session":"7ecc8a97-4128-4792-aa6b-218dcc003aca","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"63555966e1b6b47f","strings":["MGLNDD_<HONEYPOT>_3790"]}},{"timestamp":"2026-09-27T12:37:17","port":4332,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4332\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333320a","method":"","user_agent":"","ja3":"","session":"c0dd2320-bc79-4716-aa65-b25f84341844","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"a8ab4453ccf276bf","strings":["MGLNDD_<HONEYPOT>_4332"]}},{"timestamp":"2026-09-26T16:12:23","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_111\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131310a","method":"","user_agent":"","ja3":"","session":"720853ac-3161-4844-9fab-2cdb9c849940","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"29242794e9bce34e","strings":["MGLNDD_<HONEYPOT>_111"]}}],"http_methods":[],"distinct_ports_total":58,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-07T02:48:08.774183+00:00"}