{"ip":"172.174.225.60","total_events":167,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-19T14:16:52","last_seen":"2026-07-26T14:47:30","events_24h":1,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Washington","lat":38.7095,"lon":-78.1539,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdesd3qmsa.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":7},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":5},{"port":5001,"proto":"tcp","label":"","count":5},{"port":45000,"proto":"tcp","label":"","count":5},{"port":80,"proto":"tcp","label":"HTTP","count":5},{"port":6066,"proto":"tcp","label":"","count":5},{"port":9200,"proto":"tcp","label":"Elastic","count":4},{"port":6666,"proto":"tcp","label":"","count":4},{"port":8118,"proto":"tcp","label":"","count":4},{"port":162,"proto":"tcp","label":"SNMP","count":4},{"port":8104,"proto":"tcp","label":"","count":4},{"port":5660,"proto":"tcp","label":"","count":3},{"port":7474,"proto":"tcp","label":"","count":3},{"port":7002,"proto":"tcp","label":"","count":3},{"port":4332,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2149,"ge11nn0400_88d30a62b7ad":5179},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-02","count":2},{"date":"2026-05-03","count":2},{"date":"2026-05-04","count":3},{"date":"2026-05-05","count":2},{"date":"2026-05-06","count":1},{"date":"2026-05-07","count":1},{"date":"2026-05-08","count":1},{"date":"2026-05-09","count":1},{"date":"2026-05-10","count":2},{"date":"2026-05-11","count":2},{"date":"2026-05-15","count":1},{"date":"2026-05-16","count":4},{"date":"2026-05-17","count":1},{"date":"2026-05-18","count":2},{"date":"2026-05-19","count":1},{"date":"2026-05-20","count":1},{"date":"2026-05-25","count":2},{"date":"2026-05-26","count":4},{"date":"2026-05-28","count":1},{"date":"2026-05-29","count":1},{"date":"2026-05-31","count":1},{"date":"2026-06-04","count":1},{"date":"2026-06-05","count":2},{"date":"2026-06-10","count":1},{"date":"2026-06-11","count":2},{"date":"2026-06-17","count":1},{"date":"2026-06-18","count":1},{"date":"2026-06-19","count":1},{"date":"2026-06-22","count":2},{"date":"2026-06-23","count":1},{"date":"2026-06-24","count":4},{"date":"2026-06-26","count":2},{"date":"2026-06-28","count":2},{"date":"2026-07-01","count":2},{"date":"2026-07-02","count":2},{"date":"2026-07-07","count":1},{"date":"2026-07-12","count":4},{"date":"2026-07-14","count":2},{"date":"2026-07-21","count":1},{"date":"2026-07-22","count":3},{"date":"2026-07-23","count":4},{"date":"2026-07-26","count":1}],"recent_events":[{"timestamp":"2026-07-26T14:47:30","port":138,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_138\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133380a","method":"","user_agent":"","community_id":"1:nWNXjt1xJquIaPsk7Y0Zpggi0r0=","ja3":"","session":"631958dc-9579-4dd3-9a2c-d1cdaffa1afd","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"a1c09950ee3ba102","strings":["MGLNDD_<HONEYPOT>_138"]}},{"timestamp":"2026-07-23T16:20:49","port":162,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_162\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136320a","method":"","user_agent":"","community_id":"1:LxtWAIgpMgVpxjbN5zdx942yf3w=","ja3":"","session":"faa9f43e-bba6-486e-b132-080ee85c54e8","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"bc661b870a67c30a","strings":["MGLNDD_<HONEYPOT>_162"]}},{"timestamp":"2026-07-23T16:20:49","port":162,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","community_id":"1:wKIe3qRBp7LwKDqBrEU8ZwCBRDY=","ja3":"","session":"35867915-2258-4916-8657-0b62b547775c","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-07-23T08:05:27","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","community_id":"1:t5pjhzUHlhekWkGqgGTvXwUmuQA=","ja3":"","session":"e9567ed2-c9bf-467a-9552-c46d98d64d78","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-07-23T08:05:21","port":9999,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9999\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:mPApGv4L2+Lhg7JpkIiw03Falew=","ja3":"","session":"08083ac0-c221-4ecf-9fce-7d1398fb9d8e","seq":1,"duration_ms":102,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-07-22T22:05:19","port":7210,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7210\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373231300a","method":"","user_agent":"","community_id":"1:JsM19Dhp8oddMBF9QWoZVbqaUQU=","ja3":"","session":"6583d90c-9091-4d02-9519-f0f90e7ecc40","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"3286feda50ff9651","strings":["MGLNDD_<HONEYPOT>_7210"]}},{"timestamp":"2026-07-22T15:30:16","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","community_id":"1:mS5b/mhwG8Fnt02uZ7aSguMV3nA=","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"838e5dbd-d82f-459e-922d-5c039201d9d8","seq":1,"duration_ms":928,"bytes_in":1,"bytes_out":20},{"timestamp":"2026-07-22T15:30:16","port":993,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_993\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3939330a","method":"","user_agent":"","community_id":"1:DiCScZmYEytDlF09/f/qVTHn+zU=","ja3":"","session":"3cd7d92c-fd44-496f-833e-7b16ece2031b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":20,"enriched":{"digest":"3b6760fc2c2a8752","strings":["MGLNDD_<HONEYPOT>_993"]}},{"timestamp":"2026-07-21T06:15:05","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cluster/health?level=indices","summary":"","payload_hex":"474554202f5f636c75737465722f6865616c74683f6c6576656c3d696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:D5PYqFStUD18VTzwop/xAY6wKHY=","ja3":"","session":"d7a10710-2c7b-4b33-a8b9-dae998a80ffc","seq":1,"duration_ms":100,"bytes_in":143,"bytes_out":79},{"timestamp":"2026-07-14T18:40:45","port":4433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4433\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343433330a","method":"","user_agent":"","community_id":"1:8GVZL9253Keh2cxWnnJANDDcUHM=","ja3":"","session":"7a2547b0-84d4-48a9-8bcd-18e54c141406","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"8ab7ea0d36373e06","strings":["MGLNDD_<HONEYPOT>_4433"]}}],"http_methods":[{"method":"GET","count":23}],"distinct_ports_total":78,"top_paths":[{"path":"/","count":15,"ports":13},{"path":"/version","count":1,"ports":1},{"path":"/v2/","count":1,"ports":1},{"path":"/actuator/health","count":1,"ports":1},{"path":"/v1/submissions","count":1,"ports":1},{"path":"/_stats/indices","count":1,"ports":1},{"path":"/db/manage/","count":1,"ports":1},{"path":"/druid/index.html","count":1,"ports":1},{"path":"/_cluster/health?level=indices","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9999","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-07-27T00:42:59.212964+00:00"}