{"ip":"20.168.11.148","data_as_of":"2026-10-26T12:34:27+00:00","observed":true,"total_events":30,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 5 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"1,622 bytes sent","bytes_sent":1622,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-09-17T01:05:32","last_seen":"2026-10-25T13:09:25","events_24h":0,"events_7d":7,"interactive_sessions":5,"interactive_sessions_24h":2,"interactive_sessions_7d":4,"interactive_protocols":[{"protocol":"tls","sessions":1},{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdwsaiu9vx.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","kev_date_added":"2025-04-29"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":3,"protocols":[{"protocol":"udp","events":3}],"ports":[{"port":1434,"events":2},{"port":500,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-09T17:55:01","last_seen":"2026-10-17T06:24:56","recent":[{"timestamp":"2026-10-17T06:24:56","port":500,"src_port":37419,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\b3߂m�C\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001h\u0004\u0000\u0000�\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000�\u0001\u0001\u0000\u0004\u0003\u0000\u0000$\u0001\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0002\u0001\u0000\u0000�\u0001\u0000\u0005�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0003\u0000\u0000$\u0003\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0002�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\u0000\u0000\u0000$\u0004\u0001\u0000\u0000�\u0001\u0000\u0001�\u0002\u0000\u0001�\u0003\u0000\u0001�\u0004\u0000\u0002�\u000b\u0000\u0001\u0000\f\u0000\u0004\u0000\u0000p�\n\u0000\u0000�~\u001d3���UHɸ���2\u0005T\u0006�Dۛ:�����B�\f����V��\u0004\fx\u001eI=:7��m#�ؼ���ܮ��p��\u001d���>!��pk9�|qhҷ3�x���䗺\u000fF3�۝f\u0010��̓�_�\u001c,�Lu�΁�vD\t��Z�7�~/H�\f/K\u0005\u0000\u0000\u0018R��1%����R\u0004���Z�zB,\u0000\u0000\u0000\f\u0003\u0011\u0001�test","payload_hex":"8a0833df826d90430000000000000000011004000000000000000168040000a400000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c0004000070800a0000847e1d3396809e5548c9b8f4f1bb32055406d244db9b3ae0aeffe0e242ee0cbcfa8bd356eaed040c781e493d3a379ad96d23ded8bcc3cbc1dcaeae8270e5c61dcdd0d63e21b4bc706b39a27c7168d2b7338d78a2afeae497ba0f4633afdb9d6610a7eecc93f15fea1c2cce4c7591ce818a76440984a65ace37f57e2f48e70c2f4b0500001852ebf331259ae67f969e5204c9d8d65abb7a422c0000000c031101f474657374","sni":"","session":"a195de85-f8f4-4b1a-9da2-8ac6c8d11bd5","bytes_in":360,"source_verified":false,"enriched":{"digest":"7f140b43301cd47f","strings":["I=:7","test"]}},{"timestamp":"2026-10-16T22:36:58","port":1434,"src_port":40350,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0002","payload_hex":"02","sni":"","session":"baeafabf-cdc1-487b-98e9-e98352723e14","bytes_in":1,"source_verified":false},{"timestamp":"2026-10-09T17:55:01","port":1434,"src_port":54393,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0002","payload_hex":"02","sni":"","session":"06d47934-b09d-48c3-bfca-d36be1cfe30c","bytes_in":1,"source_verified":false}]},"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-17T13:31:04","last_seen":"2026-10-25T13:09:25","verdicts":[{"verdict":"scan","sessions":3},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"tls","port":17990,"sessions":1},{"protocol":"tcp","port":79,"sessions":1},{"protocol":"http","port":9160,"sessions":1},{"protocol":"tcp","port":9160,"sessions":1},{"protocol":"tcp","port":17990,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":3}]},"top_ports":[{"port":2525,"proto":"tcp","label":"","count":2,"sessions":0},{"port":18480,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4118,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7199,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9160,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":17990,"proto":"tcp","label":"TLS","count":0,"sessions":2},{"port":7443,"proto":"tcp","label":"","count":1,"sessions":0},{"port":5357,"proto":"tcp","label":"","count":1,"sessions":0},{"port":7210,"proto":"tcp","label":"","count":1,"sessions":0},{"port":21,"proto":"tcp","label":"FTP","count":1,"sessions":0},{"port":9999,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1337,"proto":"tcp","label":"","count":1,"sessions":0},{"port":135,"proto":"tcp","label":"MSRPC","count":1,"sessions":0},{"port":5431,"proto":"tcp","label":"","count":1,"sessions":0},{"port":5001,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea03035cb6f5a3a03d4209561ea420662447799a160ab897718b472dd3da3fe247c0a92096a3f5d89f58b38d81a7abef6bba85456bf93036965c42446be2618c3b13a6ee0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d002081f41f9699a00b2b4e850f15dee1c4648fa16a0e5a75802175e1a2cf","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3303,"b11cun040_00040016_aa48e2c8":5564},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":2,"sessions":0},{"date":"2026-09-18","count":2,"sessions":0},{"date":"2026-09-21","count":1,"sessions":0},{"date":"2026-09-23","count":1,"sessions":0},{"date":"2026-09-24","count":3,"sessions":0},{"date":"2026-09-29","count":4,"sessions":0},{"date":"2026-10-02","count":1,"sessions":0},{"date":"2026-10-04","count":1,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-07","count":1,"sessions":0},{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-15","count":1,"sessions":0},{"date":"2026-10-17","count":1,"sessions":1},{"date":"2026-10-18","count":1,"sessions":0},{"date":"2026-10-20","count":1,"sessions":0},{"date":"2026-10-21","count":1,"sessions":0},{"date":"2026-10-22","count":3,"sessions":0},{"date":"2026-10-23","count":1,"sessions":0},{"date":"2026-10-24","count":1,"sessions":0},{"date":"2026-10-25","count":0,"sessions":4}],"recent_events":[{"timestamp":"2026-10-25T13:09:25","port":9160,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9160\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f393136300a","method":"","user_agent":"","ja3":"","session":"f8d2bc7b-34ec-492b-a414-89380eef1222-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"428edf2ea6cd80d1","strings":["MGLNDD_<HONEYPOT>_9160"]},"interactive":true},{"timestamp":"2026-10-25T13:09:25","port":9160,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9160\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393136300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"bf204d4e-d4d6-417e-9538-3fb72ddbfebd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T01:58:58","port":17990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_17990\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f31373939300a","method":"","user_agent":"","ja3":"","session":"82c0a87a-a431-46fe-9d83-96c9a8b6816d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"69a7980084b38b31","strings":["MGLNDD_<HONEYPOT>_17990"]},"interactive":true},{"timestamp":"2026-10-24T02:04:53","port":8084,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8084\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038340d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"f4825620-c1e6-40fd-940c-b9dc54bbcdf6","seq":1,"duration_ms":101,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-23T16:56:36","port":520,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_520\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3532300a","method":"","user_agent":"","ja3":"","session":"37fc6a49-5ccc-4939-a2ba-6674e62bff17","seq":1,"duration_ms":40,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"83084d3add49c508","strings":["MGLNDD_<HONEYPOT>_520"]}},{"timestamp":"2026-10-22T14:30:41","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4118\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343131380a","method":"","user_agent":"","ja3":"","session":"072d01ef-16cd-47de-96cb-b133191ba37e","seq":1,"duration_ms":36,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"3298a42592e8be0d","strings":["MGLNDD_<HONEYPOT>_4118"]}},{"timestamp":"2026-10-22T14:30:41","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"a8173835-c418-40e2-81fa-795048d7ffa0","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-22T06:27:48","port":8098,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8098\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/stats","summary":"","payload_hex":"474554202f737461747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383039380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"cef0bb36-f3d4-4c08-b35b-b658ac417eb1","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-10-21T09:35:34","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1337\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313333370a","method":"","user_agent":"","ja3":"","session":"640cadfe-8c53-4fac-ae8d-97663979dcd3","seq":1,"duration_ms":41,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"67786f48dc1d63e4","strings":["MGLNDD_<HONEYPOT>_1337"]}},{"timestamp":"2026-10-20T07:52:30","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"4dde7de6-b930-4803-8a0c-bc97823e424b","seq":1,"duration_ms":101,"bytes_in":115,"bytes_out":78}],"http_methods":[{"method":"GET","count":9}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":5,"ports":4},{"path":"/v2/","count":1,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/_all_dbs","count":1,"ports":1},{"path":"/developmentserver/metadatauploader","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9160","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"],"kev_date_added":"2025-04-29"}]}