{"ip":"48.217.82.56","total_events":26,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"676 bytes sent","bytes_sent":676,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-24T23:37:16","last_seen":"2026-10-05T03:25:30","events_24h":1,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":["strechoid"],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":8080,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T15:25:04","last_seen":"2026-10-05T15:25:04","recent":[{"timestamp":"2026-10-05T15:25:04","port":8080,"src_port":56601,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8080\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038300a","sni":"","session":"58c681e3-0ea6-4284-8cdc-1abc71d07239","bytes_in":25,"source_verified":false,"enriched":{"digest":"771a62c3980bb829","strings":["MGLNDD_<HONEYPOT>_8080"]}}]},"top_ports":[{"port":2181,"proto":"tcp","label":"","count":3},{"port":8081,"proto":"tcp","label":"","count":2},{"port":1900,"proto":"tcp","label":"","count":2},{"port":10000,"proto":"tcp","label":"Webmin","count":2},{"port":8834,"proto":"tcp","label":"","count":1},{"port":18091,"proto":"tcp","label":"","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1},{"port":55554,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":4330,"proto":"tcp","label":"","count":1},{"port":8998,"proto":"tcp","label":"","count":1},{"port":137,"proto":"tcp","label":"NetBIOS","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":161,"proto":"tcp","label":"SNMP","count":1},{"port":8086,"proto":"tcp","label":"InfluxDB","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-24","count":1},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":1},{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-14","count":1},{"date":"2026-09-15","count":1},{"date":"2026-09-16","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-02","count":2},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T03:25:30","port":8998,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8998\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383939380a","method":"","user_agent":"","ja3":"","session":"3029939b-16b5-4725-94ec-ff0f294f85b2","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"0f9a0d1ad2a6b0e9","strings":["MGLNDD_<HONEYPOT>_8998"]}},{"timestamp":"2026-10-02T16:13:02","port":4330,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4330\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333300a","method":"","user_agent":"","ja3":"","session":"439f6df5-889b-4e61-b46f-fd55443480ab","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"2c82708bbcbee16d","strings":["MGLNDD_<HONEYPOT>_4330"]}},{"timestamp":"2026-10-02T14:33:03","port":8091,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8091\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383039310a","method":"","user_agent":"","ja3":"","session":"c1826d0b-fa5e-4532-9699-aba207b7d6ef","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"6ddd0549b0ac091a","strings":["MGLNDD_<HONEYPOT>_8091"]}},{"timestamp":"2026-09-30T15:30:22","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"3b3f4152-cf3b-4f9c-9f90-1dcd282e8178","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-25T17:53:47","port":10000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303030300a","method":"","user_agent":"","ja3":"","session":"f195b9d7-942b-4bc9-9697-fed1c1eccadd","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"c9a733fcff9a40bb","strings":["MGLNDD_<HONEYPOT>_10000"]}},{"timestamp":"2026-09-20T19:45:12","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"f8a9733b-7fce-4920-8da8-18ffb9e1490e","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}},{"timestamp":"2026-09-18T17:10:04","port":10000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303030300a","method":"","user_agent":"","ja3":"","session":"83487195-875f-45c5-9149-301f58dbc8da","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"c9a733fcff9a40bb","strings":["MGLNDD_<HONEYPOT>_10000"]}},{"timestamp":"2026-09-16T22:10:19","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"54a96be8-5583-470d-8c83-cd383bfc1d66","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}},{"timestamp":"2026-09-15T06:28:21","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"ea84b048-64f8-4a17-bf1b-02f55c19c50f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-09-14T08:50:51","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323138310a","method":"","user_agent":"","ja3":"","session":"ee91f8bb-f9e1-47bd-9d78-9c7c421e44a1","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"a40f382094844108","strings":["MGLNDD_<HONEYPOT>_2181"]}}],"http_methods":[],"distinct_ports_total":21,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T18:51:38.280055+00:00"}