{"ip":"20.84.91.28","total_events":28,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"922 bytes sent","bytes_sent":922,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T16:58:54","last_seen":"2026-10-05T18:02:25","events_24h":1,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":["strechoid"],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":1400,"events":1},{"port":8009,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T15:48:33","last_seen":"2026-10-05T16:58:13","recent":[{"timestamp":"2026-10-05T16:58:13","port":8009,"src_port":58579,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8009\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030390a","sni":"","session":"e58f7f68-1b5b-4dc5-896a-1707f1fd43fa","bytes_in":25,"source_verified":false,"enriched":{"digest":"ef2490a9ba5284a0","strings":["MGLNDD_<HONEYPOT>_8009"]}},{"timestamp":"2026-10-05T15:48:33","port":1400,"src_port":44314,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_1400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313430300a","sni":"","session":"58ff8347-9080-420e-b98c-c61445eaba4f","bytes_in":25,"source_verified":false,"enriched":{"digest":"6c961e28437e9eaf","strings":["MGLNDD_<HONEYPOT>_1400"]}}]},"top_ports":[{"port":2304,"proto":"tcp","label":"","count":2},{"port":555,"proto":"tcp","label":"","count":2},{"port":8983,"proto":"tcp","label":"Solr","count":2},{"port":8009,"proto":"tcp","label":"","count":2},{"port":995,"proto":"tcp","label":"POP3S","count":1},{"port":6443,"proto":"tcp","label":"k8s API","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":11211,"proto":"tcp","label":"Memcached","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":992,"proto":"tcp","label":"","count":1},{"port":4545,"proto":"tcp","label":"","count":1},{"port":2375,"proto":"tcp","label":"Docker","count":1},{"port":137,"proto":"tcp","label":"NetBIOS","count":1},{"port":25,"proto":"tcp","label":"SMTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3133,"b11cun040_00040016_aa48e2c8":6048},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-25","count":1},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":2},{"date":"2026-08-30","count":3},{"date":"2026-09-03","count":2},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-09","count":1},{"date":"2026-09-10","count":1},{"date":"2026-09-11","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-16","count":1},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-29","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-02","count":1},{"date":"2026-10-03","count":2},{"date":"2026-10-04","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T18:02:25","port":4545,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4545\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343534350a","method":"","user_agent":"","ja3":"","session":"3300c617-2483-4028-aeda-5a825b2c6aa1","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"f90297cb12896aa2","strings":["MGLNDD_<HONEYPOT>_4545"]}},{"timestamp":"2026-10-04T02:03:05","port":8983,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8983\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383938330a","method":"","user_agent":"","ja3":"","session":"17aa833a-83e4-4878-a5b6-e77ef455c0b5","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"a3295f60b8374e52","strings":["MGLNDD_<HONEYPOT>_8983"]}},{"timestamp":"2026-10-03T20:46:36","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"0dd2ea35-f9b4-48f7-8a15-3766b9ed48df","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-10-03T12:41:39","port":137,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_137\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133370a","method":"","user_agent":"","ja3":"","session":"3723a08b-b41f-4597-a053-da8bae50ba82","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"67c6c25f21993d93","strings":["MGLNDD_<HONEYPOT>_137"]}},{"timestamp":"2026-10-02T21:04:27","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","ja3":"","session":"00e95585-cb1d-4e9e-ac14-b301ebd4ab80","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-10-01T20:38:29","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"78aa86f4-6d1c-45e5-8d29-8055f8131f76","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-09-29T01:26:54","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"47976716-3648-4970-a601-1656be0a634b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-26T04:56:16","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323138310a","method":"","user_agent":"","ja3":"","session":"0fc9d33a-8a69-449f-bf93-75a88db46302","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"a40f382094844108","strings":["MGLNDD_<HONEYPOT>_2181"]}},{"timestamp":"2026-09-21T00:48:29","port":8983,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8983\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383938330a","method":"","user_agent":"","ja3":"","session":"67b71d41-1828-46d3-9e11-c18bedfd2b32","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"a3295f60b8374e52","strings":["MGLNDD_<HONEYPOT>_8983"]}},{"timestamp":"2026-09-20T12:52:26","port":18245,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18245\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234350a","method":"","user_agent":"","ja3":"","session":"6416dcac-acb8-4092-b3d6-217abcb65833","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"3f43707931f767b4","strings":["MGLNDD_<HONEYPOT>_18245"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":24,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/version","count":1,"ports":1},{"path":"/info","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T18:51:35.404946+00:00"}