{"ip":"20.163.34.47","total_events":163,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,589 bytes sent","bytes_sent":5589,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T16:35:04","last_seen":"2026-08-14T12:22:07","events_24h":1,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdwsxtclji.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader"},{"cve_id":"CVE-2019-9621","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover"}],"malware":[],"top_ports":[{"port":502,"proto":"tcp","label":"","count":8},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":7},{"port":443,"proto":"tcp","label":"HTTPS","count":5},{"port":5984,"proto":"tcp","label":"CouchDB","count":5},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":8088,"proto":"tcp","label":"Hadoop","count":4},{"port":1521,"proto":"tcp","label":"Oracle","count":4},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":9200,"proto":"tcp","label":"Elastic","count":4},{"port":11443,"proto":"tcp","label":"","count":4},{"port":8181,"proto":"tcp","label":"","count":3},{"port":7474,"proto":"tcp","label":"","count":3},{"port":541,"proto":"tcp","label":"","count":3},{"port":8445,"proto":"tcp","label":"","count":3},{"port":9030,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_ed383ed8462e"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2152,"po11nn0600_ed383ed8462e":328,"ge11nn0400_88d30a62b7ad":4816,"084386fa7ae5039bcf6f07298a05a227":648},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-20","count":2},{"date":"2026-05-22","count":1},{"date":"2026-05-26","count":2},{"date":"2026-05-28","count":1},{"date":"2026-06-01","count":1},{"date":"2026-06-03","count":2},{"date":"2026-06-04","count":1},{"date":"2026-06-05","count":1},{"date":"2026-06-08","count":2},{"date":"2026-06-09","count":1},{"date":"2026-06-10","count":2},{"date":"2026-06-11","count":1},{"date":"2026-06-15","count":1},{"date":"2026-06-17","count":3},{"date":"2026-06-18","count":2},{"date":"2026-06-20","count":2},{"date":"2026-06-21","count":2},{"date":"2026-06-22","count":2},{"date":"2026-06-26","count":1},{"date":"2026-06-30","count":2},{"date":"2026-07-02","count":2},{"date":"2026-07-05","count":1},{"date":"2026-07-06","count":3},{"date":"2026-07-07","count":2},{"date":"2026-07-10","count":2},{"date":"2026-07-12","count":2},{"date":"2026-07-15","count":6},{"date":"2026-07-16","count":3},{"date":"2026-07-17","count":1},{"date":"2026-07-18","count":2},{"date":"2026-07-19","count":3},{"date":"2026-07-22","count":1},{"date":"2026-07-23","count":2},{"date":"2026-07-24","count":2},{"date":"2026-07-26","count":2},{"date":"2026-07-28","count":1},{"date":"2026-07-29","count":3},{"date":"2026-07-31","count":1},{"date":"2026-08-01","count":2},{"date":"2026-08-06","count":2},{"date":"2026-08-07","count":1},{"date":"2026-08-09","count":1},{"date":"2026-08-11","count":4},{"date":"2026-08-12","count":2},{"date":"2026-08-14","count":1}],"recent_events":[{"timestamp":"2026-08-14T12:22:07","port":31337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_31337\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f33313333370a","method":"","user_agent":"","ja3":"","session":"b4e36427-442c-4acc-8f4e-4d293d8d74a2","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"416ea8e37b0748b2","strings":["MGLNDD_<HONEYPOT>_31337"]}},{"timestamp":"2026-08-12T13:49:42","port":29015,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_29015\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32393031350a","method":"","user_agent":"","ja3":"","session":"90099783-5052-404a-93c0-88928e8cac1e","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"6b4bdd69fbd2cabd","strings":["MGLNDD_<HONEYPOT>_29015"]}},{"timestamp":"2026-08-12T09:42:58","port":5984,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5984\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938340a","method":"","user_agent":"","ja3":"","session":"e9e5bd43-af6c-4a20-9775-cdc390a69ecf","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"7e9d73aeeaff343d","strings":["MGLNDD_<HONEYPOT>_5984"]}},{"timestamp":"2026-08-11T15:15:05","port":5269,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5269\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353236390a","method":"","user_agent":"","ja3":"","session":"01f64f79-9adb-4d9e-8a06-1bf07ba5aec6","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"680f85abd1c8c06b","strings":["MGLNDD_<HONEYPOT>_5269"]}},{"timestamp":"2026-08-11T03:34:22","port":9030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9030\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393033300a","method":"","user_agent":"","ja3":"","session":"7650a10c-8fd7-460b-8fb8-e9551b805fa8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"4739aa2c1d3651c1","strings":["MGLNDD_<HONEYPOT>_9030"]}},{"timestamp":"2026-08-11T03:34:22","port":9030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9030\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393033300a","method":"","user_agent":"","ja3":"","session":"7650a10c-8fd7-460b-8fb8-e9551b805fa8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"4739aa2c1d3651c1","strings":["MGLNDD_<HONEYPOT>_9030"]}},{"timestamp":"2026-08-11T03:34:22","port":9030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9030\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393033300a","method":"","user_agent":"","ja3":"","session":"7650a10c-8fd7-460b-8fb8-e9551b805fa8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"4739aa2c1d3651c1","strings":["MGLNDD_<HONEYPOT>_9030"]}},{"timestamp":"2026-08-09T21:44:52","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3389\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333338390a","method":"","user_agent":"","ja3":"","session":"9db0ae99-2760-47d3-aaf0-4a4c0359e915","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"1c66e2c5305ca0c9","strings":["MGLNDD_<HONEYPOT>_3389"]}},{"timestamp":"2026-08-07T23:47:20","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"info\n","payload_hex":"696e666f0a","method":"","user_agent":"","ja3":"","session":"ab50fa9c-ff87-44cc-915d-2c404cb52050","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":5,"enriched":{"digest":"886ead46232ac934","strings":["info"]}},{"timestamp":"2026-08-06T12:27:49","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8032\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383033320a","method":"","user_agent":"","ja3":"","session":"d871a065-be4e-446f-bf83-de3b13a93207","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"827ff4d1ff8b19bd","strings":["MGLNDD_<HONEYPOT>_8032"]}}],"http_methods":[{"method":"GET","count":26},{"method":"POST","count":1}],"distinct_ports_total":74,"top_paths":[{"path":"/","count":18,"ports":15},{"path":"/ipp","count":1,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/_aliases","count":1,"ports":1},{"path":"/manager/html","count":1,"ports":1},{"path":"/versions","count":1,"ports":1},{"path":"/setup/eureka_info","count":1,"ports":1},{"path":"/autodiscover/autodiscover.json?@zdi/Powershell","count":1,"ports":1},{"path":"/developmentserver/metadatauploader","count":1,"ports":1},{"path":"/_cluster/health?level=indices","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"]},{"tag_id":"CVE-2019-9621","tag_type":"cve","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover","reference_urls":["https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","https://nvd.nist.gov/vuln/detail/cve-2019-9621","http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","https://bugzilla.zimbra.com/show_bug.cgi?id=109127"]}],"data_as_of":"2026-08-15T07:05:24.541763+00:00"}