{"ip":"20.38.35.78","data_as_of":"2026-10-25T12:02:26+00:00","observed":true,"total_events":28,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,410 bytes sent","bytes_sent":2410,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-09-26T20:29:30","last_seen":"2026-10-23T06:38:10","events_24h":0,"events_7d":5,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"cassandra","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdwsn2n9x1.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-23T06:38:10","last_seen":"2026-10-23T06:38:10","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"cassandra@3.11.10","sessions":1}],"services":[{"protocol":"cassandra","port":9042,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":139,"proto":"tcp","label":"SMB","count":3,"sessions":0},{"port":30001,"proto":"tcp","label":"","count":2,"sessions":0},{"port":515,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":2,"sessions":0},{"port":50070,"proto":"tcp","label":"Hadoop","count":2,"sessions":0},{"port":7222,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2,"sessions":0},{"port":995,"proto":"tcp","label":"POP3S","count":1,"sessions":0},{"port":8087,"proto":"tcp","label":"","count":1,"sessions":0},{"port":118,"proto":"tcp","label":"","count":1,"sessions":0},{"port":9001,"proto":"tcp","label":"Tor","count":1,"sessions":0},{"port":587,"proto":"tcp","label":"SMTP","count":1,"sessions":0},{"port":110,"proto":"tcp","label":"POP3","count":1,"sessions":0},{"port":8022,"proto":"tcp","label":"","count":1,"sessions":0},{"port":427,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303f0e5c57b0926241b42bc5e9d4b3ac1c14bf3a2e6e91559e13b26f8ae7ca57be020682b9befaf40b0e4bf2c44299b68e57ee21d48c3cc9da37dab264ec12e4d45ec0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020b3357539eab87c5d68fe1882d3f4fa9c04a1c9e206fe088f6d55dc73","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3281,"e54ef3ec27fe1fea7ab64d3fa05359fd":644,"b11cun040_00040016_aa48e2c8":5553},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-26","count":1,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-09-28","count":2,"sessions":0},{"date":"2026-09-29","count":4,"sessions":0},{"date":"2026-09-30","count":1,"sessions":0},{"date":"2026-10-03","count":1,"sessions":0},{"date":"2026-10-05","count":2,"sessions":0},{"date":"2026-10-07","count":1,"sessions":0},{"date":"2026-10-09","count":3,"sessions":0},{"date":"2026-10-10","count":2,"sessions":0},{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-14","count":1,"sessions":0},{"date":"2026-10-16","count":3,"sessions":0},{"date":"2026-10-20","count":2,"sessions":0},{"date":"2026-10-21","count":2,"sessions":0},{"date":"2026-10-22","count":1,"sessions":0},{"date":"2026-10-23","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-23T06:38:10","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0001\u0000\u0001login\u0000\u0000\u0000\u0001\f\u0000\u0001\r\u0000\u0001\u000b\u000b\u0000\u0000\u0000\u0002usernameupasswordp\u0000\u0000","payload_hex":"800100016c6f67696e000000010c00010d00010b0b00000002757365726e616d657570617373776f7264700000","method":"","user_agent":"","ja3":"","session":"360f3fea-7ade-4387-a0c4-4d0afe6b6de6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2a993597b4d7c45e","strings":["login","usernameupasswordp"]},"interactive":true},{"timestamp":"2026-10-22T05:41:28","port":515,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_515\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3531350a","method":"","user_agent":"","ja3":"","session":"8cceb259-98f1-4cf3-a667-49dd729018d5","seq":1,"duration_ms":48,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"4b4824210f28c201","strings":["MGLNDD_<HONEYPOT>_515"]}},{"timestamp":"2026-10-21T09:18:19","port":7222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373232320a","method":"","user_agent":"","ja3":"","session":"05ecae50-788c-4ded-8b23-238bdcb45f6f","seq":1,"duration_ms":53,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"d906b376ef58066f","strings":["MGLNDD_<HONEYPOT>_7222"]}},{"timestamp":"2026-10-21T09:18:19","port":7222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"221a30e7-d639-4f8f-a190-d66181c930c7","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-10-20T16:32:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"61b5b4df-6a66-4c53-b585-c75c734f5377","seq":1,"duration_ms":202,"bytes_in":118,"bytes_out":76},{"timestamp":"2026-10-20T07:58:42","port":9001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393030310a","method":"","user_agent":"","ja3":"","session":"2c572783-be3c-4f21-9dff-618e8a657e21","seq":1,"duration_ms":52,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"a2d160dae56ecaa7","strings":["MGLNDD_<HONEYPOT>_9001"]}},{"timestamp":"2026-10-16T21:51:49","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_139\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133390a","method":"","user_agent":"","ja3":"","session":"d1b17b03-4478-4dbe-9dc8-c06eb94075fc","seq":1,"duration_ms":46,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"c6b7de44939720a9","strings":["MGLNDD_<HONEYPOT>_139"]}},{"timestamp":"2026-10-16T21:51:48","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000001843c8000000000000000000000000fffffffe00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"269f5701-138a-4e2a-8e4b-18051d249b3e","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":11,"enriched":{"digest":"a119cd236d404812","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-10-16T21:51:48","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0002","payload_hex":"00000066fe534d424000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000000000000000000000000000000000000000000000000000001002","method":"","user_agent":"","ja3":"","session":"bbb73f03-5e17-49c5-9f3c-389f0dadf743","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":11,"enriched":{"digest":"042813e3ac56b4a4","strings":["SMB@"]}},{"timestamp":"2026-10-14T02:49:55","port":110,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_110\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131300a","method":"","user_agent":"","ja3":"","session":"b6f12eeb-9def-457d-956d-fb4d66ad0cde","seq":1,"duration_ms":49,"bytes_in":24,"bytes_out":5,"enriched":{"digest":"3481fe36d0358eaa","strings":["MGLNDD_<HONEYPOT>_110"]}}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":21,"top_paths":[{"path":"/","count":4,"ports":4},{"path":"/version","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}