{"ip":"20.40.215.252","total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"touch","label":"Touch only","detail":"50 bytes sent, no real exchange","bytes_sent":50,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T19:47:34","last_seen":"2026-09-18T15:00:08","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdcgqswfai.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":3351,"proto":"tcp","label":"","count":1},{"port":9000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":1}],"recent_events":[{"timestamp":"2026-09-18T15:00:08","port":3351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333335310a","method":"","user_agent":"","ja3":"","session":"79203a07-aab5-4f90-bfe9-e16a0bd3df8d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"aa5283422704de78","strings":["MGLNDD_<HONEYPOT>_3351"]}},{"timestamp":"2026-09-17T19:47:34","port":9000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393030300a","method":"","user_agent":"","ja3":"","session":"aaffc35e-6cad-4177-8c02-1cef461b66dc","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"3e376e3fadaa39a6","strings":["MGLNDD_<HONEYPOT>_9000"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T06:21:12.622718+00:00"}