{"ip":"20.84.49.73","total_events":5,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"90 bytes sent","bytes_sent":90,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-18T12:13:46","last_seen":"2026-09-23T09:52:42","events_24h":2,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdese5cb66.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":5660,"proto":"tcp","label":"","count":2},{"port":4000,"proto":"tcp","label":"","count":1},{"port":3011,"proto":"tcp","label":"","count":1},{"port":26,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-18","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T09:52:42","port":5660,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9cc1cdee-979e-409c-ac1a-5090636b0ea5","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-09-23T09:52:42","port":5660,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_185.228.81.201_5660\n","payload_hex":"4d474c4e44445f3138352e3232382e38312e3230315f353636300a","method":"","user_agent":"","ja3":"","session":"79b416ee-9014-4c00-b210-f2db472f3763","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"912c68c8e4d75f0f","strings":["MGLNDD_185.228.81.201_5660"],"iocs":{"ips":["185.228.81.201"]}}},{"timestamp":"2026-09-21T15:01:50","port":4000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"NXSH-5.6.7\\n\n","payload_hex":"4e5853482d352e362e375c6e0a","method":"","user_agent":"","ja3":"","session":"06bdd1a5-b979-4563-8d5c-5544dc25c9a8","seq":1,"duration_ms":100,"bytes_in":13,"bytes_out":11,"enriched":{"digest":"aff1bbd25d3ea3a2","strings":["NXSH-5.6.7\\n"]}},{"timestamp":"2026-09-19T01:12:58","port":3011,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3011\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333031310a","method":"","user_agent":"","ja3":"","session":"1eb29375-b14b-49d1-a9c1-1430fab982f2","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"64922f3ed283557a","strings":["MGLNDD_<HONEYPOT>_3011"]}},{"timestamp":"2026-09-18T12:13:46","port":26,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_26\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32360a","method":"","user_agent":"","ja3":"","session":"5b5717fc-10f7-4409-9fc1-8acc726bf1ec","seq":1,"duration_ms":101,"bytes_in":23,"bytes_out":11,"enriched":{"digest":"948c2e75c4295036","strings":["MGLNDD_<HONEYPOT>_26"]}}],"http_methods":[],"distinct_ports_total":4,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T14:18:45.919538+00:00"}