{"ip":"20.51.239.38","data_as_of":"2026-10-25T12:03:04+00:00","observed":true,"total_events":46,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,470 bytes sent","bytes_sent":3470,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-09-19T06:20:00","last_seen":"2026-10-24T00:58:23","events_24h":0,"events_7d":10,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdesu6xydc.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-20T05:58:14","last_seen":"2026-10-20T05:58:14","verdicts":[{"verdict":"unknown","sessions":1}],"personas":[],"services":[{"protocol":"tcp","port":264,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":3,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":2,"sessions":0},{"port":44818,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2000,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7443,"proto":"tcp","label":"","count":2,"sessions":0},{"port":1400,"proto":"tcp","label":"","count":2,"sessions":0},{"port":69,"proto":"tcp","label":"","count":2,"sessions":0},{"port":18080,"proto":"tcp","label":"","count":2,"sessions":0},{"port":631,"proto":"tcp","label":"IPP","count":2,"sessions":0},{"port":5985,"proto":"tcp","label":"","count":2,"sessions":0},{"port":50070,"proto":"tcp","label":"Hadoop","count":2,"sessions":0},{"port":83,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2304,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8006,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303b46742358352173e075d9131ffdf1a69c6499907b124b067c2f6ed1b6358d63b20608d43069a7829d05800de07df21f9377f6ea03b89ffa2ae3bbc49db17c3cd0c0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00207e80a8a9903d9a4da6b97124a5d26aacde7581a06c531ba319fcd52c","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3281,"b11cuq060_00050816_84d4cebf":295,"b11cun040_00040016_aa48e2c8":5553},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":7,"ips":295}},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-19","count":3,"sessions":0},{"date":"2026-09-20","count":3,"sessions":0},{"date":"2026-09-24","count":1,"sessions":0},{"date":"2026-09-26","count":3,"sessions":0},{"date":"2026-09-27","count":2,"sessions":0},{"date":"2026-09-28","count":1,"sessions":0},{"date":"2026-09-30","count":2,"sessions":0},{"date":"2026-10-01","count":2,"sessions":0},{"date":"2026-10-04","count":2,"sessions":0},{"date":"2026-10-06","count":3,"sessions":0},{"date":"2026-10-07","count":2,"sessions":0},{"date":"2026-10-09","count":1,"sessions":0},{"date":"2026-10-12","count":3,"sessions":0},{"date":"2026-10-13","count":2,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-15","count":3,"sessions":0},{"date":"2026-10-17","count":1,"sessions":0},{"date":"2026-10-20","count":2,"sessions":1},{"date":"2026-10-21","count":3,"sessions":0},{"date":"2026-10-22","count":3,"sessions":0},{"date":"2026-10-23","count":1,"sessions":0},{"date":"2026-10-24","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-24T00:58:23","port":2095,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2095\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323039350a","method":"","user_agent":"","ja3":"","session":"21d0297a-36e9-4aa0-8ce9-0f96b18aa663","seq":1,"duration_ms":81,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"275305ca95d73ac5","strings":["MGLNDD_<HONEYPOT>_2095"]}},{"timestamp":"2026-10-23T21:03:38","port":143,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_143\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3134330a","method":"","user_agent":"","ja3":"","session":"3f1f385a-211f-4eb9-afc5-826a48772da2","seq":1,"duration_ms":0,"bytes_in":25,"bytes_out":20,"enriched":{"digest":"77bd6712eb1f9668","strings":["MGLNDD_<HONEYPOT>_143"]}},{"timestamp":"2026-10-22T12:56:43","port":7547,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7547\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373534370a","method":"","user_agent":"","ja3":"","session":"bb140cf3-e5a1-4731-b1cd-f1841eec7791","seq":1,"duration_ms":82,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"44e2aa4c8f8c7900","strings":["MGLNDD_<HONEYPOT>_7547"]}},{"timestamp":"2026-10-22T05:31:59","port":5985,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5985\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938350a","method":"","user_agent":"","ja3":"","session":"c1dec296-c79e-4406-9fbc-21521c43b7d9","seq":1,"duration_ms":81,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"8923a3fae2da3b40","strings":["MGLNDD_<HONEYPOT>_5985"]}},{"timestamp":"2026-10-22T05:31:59","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"39b4ef28-a215-4de0-910a-1ff0bf2822e1","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-10-21T22:31:19","port":44818,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_44818\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f34343831380a","method":"","user_agent":"","ja3":"","session":"82404c07-c22c-4e2f-b44b-8fb0ff6d5a92","seq":1,"duration_ms":84,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"2c9eaa8ef93cb833","strings":["MGLNDD_<HONEYPOT>_44818"]}},{"timestamp":"2026-10-21T10:51:02","port":83,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_83\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38330a","method":"","user_agent":"","ja3":"","session":"b35e03ef-5940-4237-b106-16d83f7b44b6","seq":1,"duration_ms":82,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"8ad9727fb727a49b","strings":["MGLNDD_<HONEYPOT>_83"]}},{"timestamp":"2026-10-21T10:51:01","port":83,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:83\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"bb8908d1-1743-454d-82f6-339eb58f3349","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":77},{"timestamp":"2026-10-20T08:11:16","port":9200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9200\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393230300a","method":"","user_agent":"","ja3":"","session":"e6f50034-2ae3-47cd-8127-619218248ff0","seq":1,"duration_ms":81,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"1082049adc72cf4b","strings":["MGLNDD_<HONEYPOT>_9200"]}},{"timestamp":"2026-10-20T08:11:16","port":9200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"46171f0f-8a30-4d81-9377-8b4d21794cbe","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77}],"http_methods":[{"method":"GET","count":11},{"method":"POST","count":1}],"distinct_ports_total":32,"top_paths":[{"path":"/","count":8,"ports":8},{"path":"/ipp","count":1,"ports":1},{"path":"/_status","count":1,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/manager/html","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5985","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[]}