{"ip":"20.64.105.193","total_events":181,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,460 bytes sent","bytes_sent":4460,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T19:24:42","last_seen":"2026-08-13T23:59:55","events_24h":1,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgp8mms0.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2019-9621","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover"}],"malware":[],"top_ports":[{"port":9000,"proto":"tcp","label":"Web-alt","count":7},{"port":81,"proto":"tcp","label":"","count":6},{"port":3389,"proto":"tcp","label":"RDP","count":6},{"port":18245,"proto":"tcp","label":"","count":6},{"port":139,"proto":"tcp","label":"SMB","count":6},{"port":10000,"proto":"tcp","label":"Webmin","count":4},{"port":55554,"proto":"tcp","label":"","count":4},{"port":5985,"proto":"tcp","label":"","count":4},{"port":53,"proto":"tcp","label":"DNS","count":4},{"port":4040,"proto":"tcp","label":"","count":4},{"port":2052,"proto":"tcp","label":"","count":4},{"port":6666,"proto":"tcp","label":"","count":4},{"port":8047,"proto":"tcp","label":"","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":8081,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2151,"ge11nn0400_88d30a62b7ad":4816,"084386fa7ae5039bcf6f07298a05a227":646},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-19","count":5},{"date":"2026-05-23","count":1},{"date":"2026-05-27","count":1},{"date":"2026-05-29","count":2},{"date":"2026-05-31","count":1},{"date":"2026-06-01","count":2},{"date":"2026-06-02","count":2},{"date":"2026-06-05","count":1},{"date":"2026-06-11","count":1},{"date":"2026-06-14","count":2},{"date":"2026-06-15","count":2},{"date":"2026-06-16","count":2},{"date":"2026-06-18","count":1},{"date":"2026-06-20","count":1},{"date":"2026-06-21","count":4},{"date":"2026-06-28","count":1},{"date":"2026-06-29","count":1},{"date":"2026-06-30","count":1},{"date":"2026-07-02","count":2},{"date":"2026-07-03","count":1},{"date":"2026-07-05","count":1},{"date":"2026-07-14","count":1},{"date":"2026-07-18","count":1},{"date":"2026-07-19","count":2},{"date":"2026-07-20","count":3},{"date":"2026-07-21","count":3},{"date":"2026-07-23","count":4},{"date":"2026-07-28","count":1},{"date":"2026-07-30","count":3},{"date":"2026-07-31","count":1},{"date":"2026-08-02","count":2},{"date":"2026-08-04","count":1},{"date":"2026-08-06","count":2},{"date":"2026-08-09","count":1},{"date":"2026-08-11","count":3},{"date":"2026-08-13","count":1}],"recent_events":[{"timestamp":"2026-08-13T23:59:55","port":3011,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3011\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333031310a","method":"","user_agent":"","ja3":"","session":"c8295f88-ceeb-464b-af3f-3e913caf02e1","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"64922f3ed283557a","strings":["MGLNDD_<HONEYPOT>_3011"]}},{"timestamp":"2026-08-11T19:30:46","port":513,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_513\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3531330a","method":"","user_agent":"","ja3":"","session":"8cb3001b-7068-4491-b38b-142c388a04cd","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"95f9e8c8d55c0414","strings":["MGLNDD_<HONEYPOT>_513"]}},{"timestamp":"2026-08-11T19:30:46","port":513,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"f7943c42-b346-44aa-a55d-e0927cbd7bc5","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-08-11T04:12:45","port":138,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_138\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133380a","method":"","user_agent":"","ja3":"","session":"b978ce6a-af41-47cd-b56f-1259b77a05c4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"a1c09950ee3ba102","strings":["MGLNDD_<HONEYPOT>_138"]}},{"timestamp":"2026-08-09T00:05:18","port":2083,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2083\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323038330a","method":"","user_agent":"","ja3":"","session":"5f846ae0-1a48-497b-9bcc-16cc9396bc9c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"29a0dd3ee23258b0","strings":["MGLNDD_<HONEYPOT>_2083"]}},{"timestamp":"2026-08-06T00:04:29","port":9000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393030300a","method":"","user_agent":"","ja3":"","session":"e33ddd9c-aa5b-44fd-aa80-7fc646252586","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"3e376e3fadaa39a6","strings":["MGLNDD_<HONEYPOT>_9000"]}},{"timestamp":"2026-08-06T00:04:29","port":9000,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0005L\u0013\u0014bX�\u0013z�8\u0003'\u0013�':!�O\u0000\u0000\u0001\u0019curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0002[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u001c�H�R\u00137/�_�\u0001\u0019�U��K","payload_hex":"5353482d322e302d476f0d0a0000054c13146258a2137ae2380327138d273a21e14f00000119637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000025b7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531392c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531390000009b6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132380000009b6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f757231323800000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000dc1cd848c85213372fa75f860119e7558cfd4b","method":"","user_agent":"","ja3":"","session":"6e9f0fa8-c396-4cfa-b279-9e7f069fe6a2","seq":1,"duration_ms":154,"bytes_in":1372,"bytes_out":13,"enriched":{"digest":"513da7baa3de88f1","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,ae…","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-08-04T05:05:45","port":5006,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5006\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353030360a","method":"","user_agent":"","ja3":"","session":"94552439-3831-4b39-8cdb-480436a036d3","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"6c8dc9e0ae2ab558","strings":["MGLNDD_<HONEYPOT>_5006"]}},{"timestamp":"2026-08-02T05:31:33","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3128\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333132380a","method":"","user_agent":"","ja3":"","session":"904d21da-dfd5-47a9-a897-84014c822120","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"f2dd72b325ce9695","strings":["MGLNDD_<HONEYPOT>_3128"]}},{"timestamp":"2026-08-02T03:49:22","port":9030,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9030\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393033300a","method":"","user_agent":"","ja3":"","session":"3c5d8ae4-6417-40eb-a66f-2c82567dcc8c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"4739aa2c1d3651c1","strings":["MGLNDD_<HONEYPOT>_9030"]}}],"http_methods":[{"method":"GET","count":17}],"distinct_ports_total":74,"top_paths":[{"path":"/","count":14,"ports":13},{"path":"/hudson","count":1,"ports":1},{"path":"/druid/index.html","count":1,"ports":1},{"path":"/autodiscover/autodiscover.json?@zdi/Powershell","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2019-9621","tag_type":"cve","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover","reference_urls":["https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","https://nvd.nist.gov/vuln/detail/cve-2019-9621","http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","https://bugzilla.zimbra.com/show_bug.cgi?id=109127"]}],"data_as_of":"2026-08-14T22:10:18.393076+00:00"}