{"ip":"57.152.36.12","total_events":17,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"623 bytes sent","bytes_sent":623,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T01:37:07","last_seen":"2026-09-17T08:33:53","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":["strechoid"],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":7199,"proto":"tcp","label":"","count":2},{"port":3389,"proto":"tcp","label":"RDP","count":2},{"port":1400,"proto":"tcp","label":"","count":2},{"port":18480,"proto":"tcp","label":"","count":2},{"port":5660,"proto":"tcp","label":"","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":110,"proto":"tcp","label":"POP3","count":1},{"port":3351,"proto":"tcp","label":"","count":1},{"port":5432,"proto":"tcp","label":"Postgres","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1},{"port":44818,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[]},"fingerprint_peers":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-25","count":2},{"date":"2026-09-05","count":1},{"date":"2026-09-07","count":3},{"date":"2026-09-11","count":2},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":2},{"date":"2026-09-14","count":1},{"date":"2026-09-15","count":4},{"date":"2026-09-17","count":1}],"recent_events":[{"timestamp":"2026-09-17T08:33:53","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","ja3":"","session":"7c6fc8ce-8511-43a7-baf3-1b1c67705e1f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-09-15T23:01:59","port":1723,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1723\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313732330a","method":"","user_agent":"","ja3":"","session":"e5bb0e32-c8e4-499b-8f3a-e9660655c0cc","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"354735d562fec1ee","strings":["MGLNDD_<HONEYPOT>_1723"]}},{"timestamp":"2026-09-15T22:10:12","port":3351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333335310a","method":"","user_agent":"","ja3":"","session":"35f44952-7677-420e-8be7-49fc62bc0ad6","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"aa5283422704de78","strings":["MGLNDD_<HONEYPOT>_3351"]}},{"timestamp":"2026-09-15T20:07:06","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3389\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333338390a","method":"","user_agent":"","ja3":"","session":"1a615cde-c104-4998-8c99-a3b909ea4eb8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"1c66e2c5305ca0c9","strings":["MGLNDD_<HONEYPOT>_3389"]}},{"timestamp":"2026-09-15T20:07:06","port":3389,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3389\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333338390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"1c0ca869-02e0-4004-9de3-3e2cecc630ac","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-14T03:15:51","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_110\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131300a","method":"","user_agent":"","ja3":"","session":"cab00a67-e8cd-43df-9e65-0ccfe2439154","seq":1,"duration_ms":28,"bytes_in":24,"bytes_out":5,"enriched":{"digest":"3481fe36d0358eaa","strings":["MGLNDD_<HONEYPOT>_110"]}},{"timestamp":"2026-09-13T00:40:11","port":1400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313430300a","method":"","user_agent":"","ja3":"","session":"8d0fdb60-956e-4ae0-8074-4458952a30c0","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"6c961e28437e9eaf","strings":["MGLNDD_<HONEYPOT>_1400"]}},{"timestamp":"2026-09-13T00:40:11","port":1400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1400\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"1fd4aacb-c730-434f-9118-32bde6077704","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":77},{"timestamp":"2026-09-12T06:04:05","port":44818,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_44818\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f34343831380a","method":"","user_agent":"","ja3":"","session":"cebf296b-cd2d-4557-8040-e617ae1e0feb","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"2c9eaa8ef93cb833","strings":["MGLNDD_<HONEYPOT>_44818"]}},{"timestamp":"2026-09-11T22:38:23","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7199\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373139390a","method":"","user_agent":"","ja3":"","session":"762ac9cd-0e39-470a-8b46-bbad693d4517","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"89d34933f5b8c511","strings":["MGLNDD_<HONEYPOT>_7199"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":12,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/actuator/health","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:3389","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-22T06:20:26.714962+00:00"}