{"ip":"20.55.3.53","total_events":6,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"156 bytes sent","bytes_sent":156,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T16:05:39","last_seen":"2026-09-24T11:07:26","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdegu93br8.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":27019,"proto":"tcp","label":"","count":1},{"port":1414,"proto":"tcp","label":"","count":1},{"port":1270,"proto":"tcp","label":"","count":1},{"port":5351,"proto":"tcp","label":"","count":1},{"port":111,"proto":"tcp","label":"RPC","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":2},{"date":"2026-09-24","count":1}],"recent_events":[{"timestamp":"2026-09-24T11:07:26","port":1414,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_192.3.118.146_1414\n","payload_hex":"4d474c4e44445f3139322e332e3131382e3134365f313431340a","method":"","user_agent":"","ja3":"","session":"7181378a-f64e-4505-8afd-da5f69cb5e6d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":10,"enriched":{"digest":"dd840995bb4d17b2","strings":["MGLNDD_192.3.118.146_1414"],"iocs":{"ips":["192.3.118.146"]}}},{"timestamp":"2026-09-23T10:27:31","port":27019,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_185.228.81.201_27019\n","payload_hex":"4d474c4e44445f3138352e3232382e38312e3230315f32373031390a","method":"","user_agent":"","ja3":"","session":"bccd1c67-f69e-490d-a147-cc598c8a24ad","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":10,"enriched":{"digest":"9582b2d5a9528357","strings":["MGLNDD_185.228.81.201_27019"],"iocs":{"ips":["185.228.81.201"]}}},{"timestamp":"2026-09-23T02:01:04","port":5351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335310a","method":"","user_agent":"","ja3":"","session":"dd07a75f-a033-4f9e-a080-10a1a6612ac8","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":10,"enriched":{"digest":"e158939d534ced87","strings":["MGLNDD_<HONEYPOT>_5351"]}},{"timestamp":"2026-09-22T08:16:45","port":1270,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_185.228.81.201_1270\n","payload_hex":"4d474c4e44445f3138352e3232382e38312e3230315f313237300a","method":"","user_agent":"","ja3":"","session":"ae777292-7641-474a-a1cc-9281d7f6c585","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":10,"enriched":{"digest":"342f81ce321180b9","strings":["MGLNDD_185.228.81.201_1270"],"iocs":{"ips":["185.228.81.201"]}}},{"timestamp":"2026-09-21T10:20:13","port":8088,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","method":"","user_agent":"","ja3":"","session":"c3c4dbba-abae-4f8a-9e58-ae44b821257b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":10,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}},{"timestamp":"2026-09-19T16:05:39","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_111\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131310a","method":"","user_agent":"","ja3":"","session":"41359e33-3b5a-400f-afcb-abb983de2d51","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":10,"enriched":{"digest":"29242794e9bce34e","strings":["MGLNDD_<HONEYPOT>_111"]}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T21:17:43.587114+00:00"}