{"ip":"20.64.105.221","total_events":165,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,892 bytes sent","bytes_sent":3892,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-17T02:13:25","last_seen":"2026-07-29T09:14:00","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgf8qwj7.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":2082,"proto":"tcp","label":"","count":8},{"port":443,"proto":"tcp","label":"HTTPS","count":5},{"port":8192,"proto":"tcp","label":"","count":5},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":8123,"proto":"tcp","label":"","count":4},{"port":9000,"proto":"tcp","label":"Web-alt","count":4},{"port":1270,"proto":"tcp","label":"","count":4},{"port":9200,"proto":"tcp","label":"Elastic","count":4},{"port":81,"proto":"tcp","label":"","count":4},{"port":8098,"proto":"tcp","label":"","count":4},{"port":2000,"proto":"tcp","label":"","count":4},{"port":4118,"proto":"tcp","label":"","count":4},{"port":7443,"proto":"tcp","label":"","count":4},{"port":4911,"proto":"tcp","label":"","count":4},{"port":990,"proto":"tcp","label":"FTPS","count":3}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2165,"ge11nn0400_88d30a62b7ad":4710,"084386fa7ae5039bcf6f07298a05a227":646},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-03","count":2},{"date":"2026-05-04","count":8},{"date":"2026-05-05","count":1},{"date":"2026-05-08","count":1},{"date":"2026-05-10","count":2},{"date":"2026-05-13","count":2},{"date":"2026-05-17","count":1},{"date":"2026-05-19","count":1},{"date":"2026-05-21","count":2},{"date":"2026-05-22","count":1},{"date":"2026-05-23","count":2},{"date":"2026-05-26","count":1},{"date":"2026-05-28","count":1},{"date":"2026-06-03","count":1},{"date":"2026-06-05","count":1},{"date":"2026-06-06","count":2},{"date":"2026-06-07","count":2},{"date":"2026-06-11","count":1},{"date":"2026-06-15","count":1},{"date":"2026-06-16","count":1},{"date":"2026-06-19","count":2},{"date":"2026-06-20","count":1},{"date":"2026-06-22","count":2},{"date":"2026-06-23","count":2},{"date":"2026-06-26","count":1},{"date":"2026-06-29","count":1},{"date":"2026-06-30","count":2},{"date":"2026-07-01","count":1},{"date":"2026-07-02","count":1},{"date":"2026-07-03","count":1},{"date":"2026-07-04","count":2},{"date":"2026-07-05","count":3},{"date":"2026-07-08","count":2},{"date":"2026-07-10","count":1},{"date":"2026-07-13","count":1},{"date":"2026-07-14","count":2},{"date":"2026-07-15","count":2},{"date":"2026-07-16","count":7},{"date":"2026-07-17","count":2},{"date":"2026-07-18","count":1},{"date":"2026-07-20","count":5},{"date":"2026-07-21","count":3},{"date":"2026-07-22","count":3},{"date":"2026-07-23","count":1},{"date":"2026-07-25","count":2},{"date":"2026-07-27","count":2},{"date":"2026-07-29","count":1}],"recent_events":[{"timestamp":"2026-07-29T09:14:00","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1521\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313532310a","method":"","user_agent":"","ja3":"","session":"b314e0aa-ea6f-42b3-9d9e-8b05de330a65","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"7df169f8f64e78c9","strings":["MGLNDD_<HONEYPOT>_1521"]}},{"timestamp":"2026-07-27T05:10:45","port":8090,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8090\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383039300a","method":"","user_agent":"","ja3":"","session":"5ec5f616-40b8-4381-98f1-255d98b93370","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"bc4f8eb86b566c7c","strings":["MGLNDD_<HONEYPOT>_8090"]}},{"timestamp":"2026-07-27T04:28:58","port":3479,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3479\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333437390a","method":"","user_agent":"","ja3":"","session":"d1eacb27-d105-4b7a-ba07-1b7b7da1a513","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"e3d670ae36823e3d","strings":["MGLNDD_<HONEYPOT>_3479"]}},{"timestamp":"2026-07-25T08:37:44","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5555\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353535350a","method":"","user_agent":"","ja3":"","session":"5b68125e-45cc-4fa1-8c1d-8cdcc4c1f0cf","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"cfa591d042d3c407","strings":["MGLNDD_<HONEYPOT>_5555"]}},{"timestamp":"2026-07-25T08:37:39","port":5555,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"eaf52b24-9a51-4dc7-b40e-ac36b35f1dfe","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-07-23T05:48:58","port":119,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_119\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131390a","method":"","user_agent":"","ja3":"","session":"d692f1a2-cbfa-457a-9524-d1e4dd1db89b","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"449b5c4089089cfa","strings":["MGLNDD_<HONEYPOT>_119"]}},{"timestamp":"2026-07-22T18:13:45","port":6066,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6066\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/submissions","summary":"","payload_hex":"474554202f76312f7375626d697373696f6e7320485454502f312e310d0a486f73743a20<HONEYPOT>3a363036360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"06d9d2bc-429b-4e87-8502-944fad4d5663","seq":1,"duration_ms":100,"bytes_in":128,"bytes_out":78},{"timestamp":"2026-07-22T18:09:58","port":6667,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6667\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363636370a","method":"","user_agent":"","ja3":"","session":"b723cdf5-38c6-424b-932f-2cef88756625","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"8d5ff080cb602e8b","strings":["MGLNDD_<HONEYPOT>_6667"]}},{"timestamp":"2026-07-22T18:09:53","port":6667,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6667\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363636370d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"d4c841aa-cd5a-46f8-ba1b-50b981b6e4bb","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-07-21T23:33:03","port":4848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4848\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343834380a","method":"","user_agent":"","ja3":"","session":"d9c6fdf1-4759-471f-9ecc-f63868d2e27d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"878e9ce5cb116538","strings":["MGLNDD_<HONEYPOT>_4848"]}}],"http_methods":[{"method":"GET","count":21}],"distinct_ports_total":79,"top_paths":[{"path":"/","count":15,"ports":13},{"path":"/version","count":2,"ports":2},{"path":"/ui","count":1,"ports":1},{"path":"/_status","count":1,"ports":1},{"path":"/info","count":1,"ports":1},{"path":"/v1/submissions","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5555","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-07-30T21:05:58.975775+00:00"}