{"ip":"172.184.149.225","total_events":1,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"208 bytes sent","bytes_sent":208,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-12T21:58:20","last_seen":"2026-09-12T21:58:20","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"San Jose","lat":37.3388,"lon":-121.8916,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"aztswsazzzdv.t.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"http_akin":["b11cuq060_00050816_8092f713"]},"fingerprint_peers":{"b11cuq060_00050816_8092f713":4,"t13i1909h2_9dc949149365_97f8aa674fd9":631},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-12","count":1}],"recent_events":[{"timestamp":"2026-09-12T21:58:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"{\"query\":\"{ __typename }\"}","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/graphql","summary":"","payload_hex":"504f5354202f6772617068716c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a436f6e74656e742d4c656e6774683a2032360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b227175657279223a227b205f5f747970656e616d65207d227d","method":"POST","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"0ba4c119-1bb3-4999-844f-1b7e9be09e05","seq":1,"duration_ms":268,"bytes_in":208,"bytes_out":80}],"http_methods":[{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/graphql","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"26","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T16:30:42.783189+00:00"}