{"ip":"20.169.107.229","total_events":125,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"836 bytes sent","bytes_sent":836,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T19:39:42","last_seen":"2026-08-15T22:03:07","events_24h":1,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdwgos0erg.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":8181,"proto":"tcp","label":"","count":6},{"port":2362,"proto":"tcp","label":"","count":4},{"port":8981,"proto":"tcp","label":"","count":4},{"port":137,"proto":"tcp","label":"NetBIOS","count":4},{"port":111,"proto":"tcp","label":"RPC","count":4},{"port":161,"proto":"tcp","label":"SNMP","count":4},{"port":123,"proto":"tcp","label":"NTP","count":3},{"port":9443,"proto":"tcp","label":"","count":3},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":3},{"port":4443,"proto":"tcp","label":"","count":3},{"port":4330,"proto":"tcp","label":"","count":3},{"port":4332,"proto":"tcp","label":"","count":3},{"port":27018,"proto":"tcp","label":"MongoDB","count":3},{"port":88,"proto":"tcp","label":"","count":3},{"port":162,"proto":"tcp","label":"SNMP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-19","count":1},{"date":"2026-05-20","count":1},{"date":"2026-05-24","count":1},{"date":"2026-05-25","count":1},{"date":"2026-05-27","count":1},{"date":"2026-05-30","count":2},{"date":"2026-05-31","count":1},{"date":"2026-06-02","count":1},{"date":"2026-06-04","count":1},{"date":"2026-06-08","count":1},{"date":"2026-06-10","count":1},{"date":"2026-06-11","count":2},{"date":"2026-06-13","count":1},{"date":"2026-06-18","count":1},{"date":"2026-06-19","count":1},{"date":"2026-06-23","count":1},{"date":"2026-06-25","count":1},{"date":"2026-06-27","count":1},{"date":"2026-07-02","count":1},{"date":"2026-07-04","count":1},{"date":"2026-07-06","count":1},{"date":"2026-07-09","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-12","count":1},{"date":"2026-07-13","count":2},{"date":"2026-07-20","count":1},{"date":"2026-07-21","count":3},{"date":"2026-07-24","count":1},{"date":"2026-07-25","count":1},{"date":"2026-07-26","count":1},{"date":"2026-07-30","count":1},{"date":"2026-08-03","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-09","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":1},{"date":"2026-08-13","count":1},{"date":"2026-08-15","count":1}],"recent_events":[{"timestamp":"2026-08-15T22:03:07","port":4332,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4332\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333320a","method":"","user_agent":"","ja3":"","session":"987d7a67-583a-4271-a385-290af588dd47","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"a8ab4453ccf276bf","strings":["MGLNDD_<HONEYPOT>_4332"]}},{"timestamp":"2026-08-13T03:59:40","port":1194,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1194\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313139340a","method":"","user_agent":"","ja3":"","session":"a390b6e4-e2e8-4d58-992d-05628520757f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"0b7bb21eee00c809","strings":["MGLNDD_<HONEYPOT>_1194"]}},{"timestamp":"2026-08-12T16:54:42","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"09c18564-0b4a-48b7-9b84-b4525cd97952","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-08-11T16:21:27","port":8091,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8091\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383039310a","method":"","user_agent":"","ja3":"","session":"6a6d731e-6c77-43a4-b514-b02866caf327","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"6ddd0549b0ac091a","strings":["MGLNDD_<HONEYPOT>_8091"]}},{"timestamp":"2026-08-09T20:01:57","port":4330,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4330\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333300a","method":"","user_agent":"","ja3":"","session":"864cee99-8aae-4e63-a718-5c17152d0d4f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"2c82708bbcbee16d","strings":["MGLNDD_<HONEYPOT>_4330"]}},{"timestamp":"2026-08-07T07:33:57","port":8008,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8008\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030380a","method":"","user_agent":"","ja3":"","session":"b84f91a5-5680-432b-bd98-2e57f69dc268","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"c7734b2476b6d92a","strings":["MGLNDD_<HONEYPOT>_8008"]}},{"timestamp":"2026-08-03T22:14:23","port":2376,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2376\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323337360a","method":"","user_agent":"","ja3":"","session":"f036d5eb-1eff-4b9f-9b9e-64c6e857f8e3","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"ceb4568e08957cb0","strings":["MGLNDD_<HONEYPOT>_2376"]}},{"timestamp":"2026-07-30T08:33:14","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"a332c70d-7be7-4917-80de-5c53d733302a","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-07-26T06:34:42","port":4545,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4545\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343534350a","method":"","user_agent":"","ja3":"","session":"c40de495-b6b3-4c4c-b625-35d21cae826a","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"f90297cb12896aa2","strings":["MGLNDD_<HONEYPOT>_4545"]}},{"timestamp":"2026-07-25T21:54:23","port":5985,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5985\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938350a","method":"","user_agent":"","ja3":"","session":"439d734e-be16-4868-89eb-437bc53aa91b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"8923a3fae2da3b40","strings":["MGLNDD_<HONEYPOT>_5985"]}}],"http_methods":[],"distinct_ports_total":63,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-16T13:43:55.717148+00:00"}