{"ip":"172.180.64.96","data_as_of":"2026-10-24T13:04:57+00:00","observed":true,"total_events":44,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,997 bytes sent","bytes_sent":4997,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-08-27T02:23:20","last_seen":"2026-10-22T13:24:19","events_24h":0,"events_7d":8,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdwsteli7x.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T04:50:22","last_seen":"2026-10-15T04:50:22","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":7474,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":4,"sessions":0},{"port":9160,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7337,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4443,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5692,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8009,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8222,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2,"sessions":0},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":2,"sessions":0},{"port":6066,"proto":"tcp","label":"","count":1,"sessions":0},{"port":771,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8983,"proto":"tcp","label":"Solr","count":1,"sessions":0},{"port":4331,"proto":"tcp","label":"","count":1,"sessions":0},{"port":4911,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8333,"proto":"tcp","label":"Bitcoin","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303edf03449d0d0d7c52bc013ed6179cede858abf5b85e954087ba89d78a74e738a20f0552ab80ead2fe40f3975915d2bc3105cf6fb24903ee7c6bc03b5d28681e5e50026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020038d5686f781f04c41f956c85898a294da460d31accceb0f3c4bfe78","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3247,"e54ef3ec27fe1fea7ab64d3fa05359fd":651,"b11cun040_00040016_aa48e2c8":5481},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-27","count":1,"sessions":0},{"date":"2026-08-28","count":1,"sessions":0},{"date":"2026-08-30","count":1,"sessions":0},{"date":"2026-09-01","count":2,"sessions":0},{"date":"2026-09-03","count":1,"sessions":0},{"date":"2026-09-04","count":2,"sessions":0},{"date":"2026-09-06","count":2,"sessions":0},{"date":"2026-09-07","count":1,"sessions":0},{"date":"2026-09-08","count":2,"sessions":0},{"date":"2026-09-14","count":1,"sessions":0},{"date":"2026-09-15","count":1,"sessions":0},{"date":"2026-09-22","count":1,"sessions":0},{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-28","count":3,"sessions":0},{"date":"2026-09-29","count":1,"sessions":0},{"date":"2026-09-30","count":2,"sessions":0},{"date":"2026-10-01","count":1,"sessions":0},{"date":"2026-10-02","count":1,"sessions":0},{"date":"2026-10-04","count":2,"sessions":0},{"date":"2026-10-06","count":2,"sessions":0},{"date":"2026-10-09","count":1,"sessions":0},{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-13","count":2,"sessions":0},{"date":"2026-10-15","count":0,"sessions":1},{"date":"2026-10-16","count":1,"sessions":0},{"date":"2026-10-19","count":1,"sessions":0},{"date":"2026-10-21","count":2,"sessions":0},{"date":"2026-10-22","count":5,"sessions":0}],"recent_events":[{"timestamp":"2026-10-22T13:24:19","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014be�hȢa23)�[A٨U\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007��Xr","payload_hex":"5353482d322e302d476f0d0a0000049c061462658968c8a261323329d35b41d9a85500000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000cc0785945872","method":"","user_agent":"","ja3":"","session":"6ef28abf-a12d-44b6-ae1a-0dadd27b79fe","seq":1,"duration_ms":239,"bytes_in":1196,"bytes_out":13,"enriched":{"digest":"3f4d8d2a26fb0f64","label":"SSH","strings":["SSH-2.0-Go","a23)","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-22T10:10:30","port":9160,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9160\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393136300a","method":"","user_agent":"","ja3":"","session":"08c6295e-41fc-4aa2-b778-b428865e61cf","seq":1,"duration_ms":49,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"428edf2ea6cd80d1","strings":["MGLNDD_<HONEYPOT>_9160"]}},{"timestamp":"2026-10-22T10:10:30","port":9160,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9160\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393136300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"610dfc74-599b-48cf-936a-b5e23afaaf40","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-22T04:00:33","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3434330a","method":"","user_agent":"","ja3":"","session":"bdd8a4d8-5a4f-4514-bbe0-a9aee19efbd9","seq":1,"duration_ms":47,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"95059311514a6ef0","strings":["MGLNDD_<HONEYPOT>_443"]}},{"timestamp":"2026-10-22T04:00:33","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"fad2ebbb-2687-4076-afb8-3c049db7b54a","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-10-21T11:19:23","port":69,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"7632dff0-9de6-4072-b3cf-202887adfc3f","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-21T10:41:49","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"80d19e25-3570-4948-874b-ff14d0335d9e","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":13,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-10-19T06:19:00","port":8222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8222\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383232320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"04e6205a-c744-46f2-8fdf-42147afe7a28","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-16T08:54:46","port":8200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8200\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383230300a","method":"","user_agent":"","ja3":"","session":"99df4bd1-9735-478c-9fab-8ac3bdade869","seq":1,"duration_ms":48,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"d0f593efe0fa9e89","strings":["MGLNDD_<HONEYPOT>_8200"]}},{"timestamp":"2026-10-15T04:50:21","port":7474,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7474\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/db/manage/","summary":"","payload_hex":"474554202f64622f6d616e6167652f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373437340d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"9565636d-c221-4d10-aca5-a48e2e82c5b0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":12}],"distinct_ports_total":34,"top_paths":[{"path":"/","count":9,"ports":9},{"path":"/v2/","count":1,"ports":1},{"path":"/actuator/health","count":1,"ports":1},{"path":"/db/manage/","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9160","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[]}