{"ip":"40.119.43.103","total_events":135,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-20T05:41:29","last_seen":"2026-07-11T04:36:49","events_24h":1,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdssmfgap7.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2021-34473","title":"Exchange Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover/autodiscover.json"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":9},{"port":3389,"proto":"tcp","label":"RDP","count":6},{"port":139,"proto":"tcp","label":"SMB","count":6},{"port":3306,"proto":"tcp","label":"MySQL","count":4},{"port":9999,"proto":"tcp","label":"","count":4},{"port":18245,"proto":"tcp","label":"","count":4},{"port":7001,"proto":"tcp","label":"WebLogic","count":4},{"port":102,"proto":"tcp","label":"","count":4},{"port":2000,"proto":"tcp","label":"","count":4},{"port":8192,"proto":"tcp","label":"","count":3},{"port":4444,"proto":"tcp","label":"","count":3},{"port":79,"proto":"tcp","label":"","count":3},{"port":587,"proto":"tcp","label":"SMTP","count":3},{"port":541,"proto":"tcp","label":"","count":3},{"port":69,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2188,"ge11nn0400_88d30a62b7ad":6911},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-04-14","count":2},{"date":"2026-04-15","count":4},{"date":"2026-04-18","count":4},{"date":"2026-04-19","count":4},{"date":"2026-04-21","count":1},{"date":"2026-04-22","count":2},{"date":"2026-04-24","count":3},{"date":"2026-05-02","count":3},{"date":"2026-05-05","count":1},{"date":"2026-05-06","count":1},{"date":"2026-05-08","count":2},{"date":"2026-05-09","count":2},{"date":"2026-05-12","count":2},{"date":"2026-05-15","count":1},{"date":"2026-05-16","count":4},{"date":"2026-05-18","count":1},{"date":"2026-05-20","count":1},{"date":"2026-05-22","count":1},{"date":"2026-05-24","count":1},{"date":"2026-05-27","count":1},{"date":"2026-05-28","count":1},{"date":"2026-05-30","count":1},{"date":"2026-05-31","count":1},{"date":"2026-06-01","count":1},{"date":"2026-06-02","count":2},{"date":"2026-06-03","count":1},{"date":"2026-06-04","count":2},{"date":"2026-06-07","count":1},{"date":"2026-06-08","count":1},{"date":"2026-06-09","count":1},{"date":"2026-06-13","count":1},{"date":"2026-06-19","count":1},{"date":"2026-06-21","count":1},{"date":"2026-06-23","count":1},{"date":"2026-06-28","count":4},{"date":"2026-07-04","count":2},{"date":"2026-07-05","count":1},{"date":"2026-07-07","count":3},{"date":"2026-07-10","count":2},{"date":"2026-07-11","count":1}],"recent_events":[{"timestamp":"2026-07-11T04:36:49","port":5223,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5223\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353232330a","method":"","user_agent":"","community_id":"1:wLurRvie0rCG/GbmbMiPqFoi7bo=","ja3":"","session":"c44d64c8-9887-414e-9db5-258b55a9c4b4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"a6fae3dc29586b55","strings":["MGLNDD_<HONEYPOT>_5223"]}},{"timestamp":"2026-07-10T10:27:47","port":115,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_115\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131350a","method":"","user_agent":"","community_id":"1:wKd2YaQtEy0RFzfGOSn/rPWFYxc=","ja3":"","session":"a484e20e-d96b-4e25-8e7f-24b8b469786c","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"7f5ab1dee1c728d8","strings":["MGLNDD_<HONEYPOT>_115"]}},{"timestamp":"2026-07-10T05:56:17","port":2077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2077\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323037370a","method":"","user_agent":"","community_id":"1:GSRqkJwSe5YH8Oz9UmdOr6Gy4uM=","ja3":"","session":"0e6fa502-ad76-497b-8cf4-f02ee2caa696","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"28bfb3549162e1a4","strings":["MGLNDD_<HONEYPOT>_2077"]}},{"timestamp":"2026-07-07T09:36:55","port":28015,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_28015\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32383031350a","method":"","user_agent":"","community_id":"1:jVJlZfaJ+4MesK44P6QqvqBKYZU=","ja3":"","session":"d73724c6-f8f3-41c6-af85-cf27abad1b7f","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":13,"enriched":{"digest":"e11e225c62936189","strings":["MGLNDD_<HONEYPOT>_28015"]}},{"timestamp":"2026-07-07T08:42:11","port":2222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323232320a","method":"","user_agent":"","community_id":"1:SQP2RE09zJlkddUhS6Q8NXg0UgQ=","ja3":"","session":"cfa8251f-4c00-4c6c-8856-960d3f8f5099","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"c33d3688bfbfd8f0","strings":["MGLNDD_<HONEYPOT>_2222"]}},{"timestamp":"2026-07-07T08:42:06","port":2222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2222\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323232320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:psEdJ34IkqyzYrP8Mp3yASNo4/g=","ja3":"","session":"54290cb6-8e36-4e97-ac7f-7e0d036d6603","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-07-05T14:29:58","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/autodiscover/autodiscover.json?@zdi/Powershell","summary":"","payload_hex":"474554202f6175746f646973636f7665722f6175746f646973636f7665722e6a736f6e3f407a64692f506f7765727368656c6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:UfX4oi7eD2gnlafmI4NRvPWtQYQ=","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"0522076e-f8ea-4eff-9b54-c3992b31e72a","seq":1,"duration_ms":231,"bytes_in":156,"bytes_out":78},{"timestamp":"2026-07-04T21:36:59","port":5006,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5006\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353030360a","method":"","user_agent":"","community_id":"1:I44xQM4kJ/P4aovbv4LaU3C+jtg=","ja3":"","session":"cb8afebd-d4aa-4702-876f-5a6b71f8ed4d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"6c8dc9e0ae2ab558","strings":["MGLNDD_<HONEYPOT>_5006"]}},{"timestamp":"2026-07-04T00:03:11","port":7000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373030300a","method":"","user_agent":"","community_id":"1:1wofOC3tdivwQm4+IBP4+RalqMg=","ja3":"","session":"d4799a02-ed99-48e4-9e92-c960cd6da88d","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"4436f2b00c3184f4","strings":["MGLNDD_<HONEYPOT>_7000"]}},{"timestamp":"2026-06-28T12:56:18","port":18480,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18480\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383438300a","method":"","user_agent":"","community_id":"1:WddoH1Hw0Qe6TUwUVknZoM+vRbQ=","ja3":"","session":"5a321968-6c09-45f6-975d-445a9097617c","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"59b975ee503725d6","strings":["MGLNDD_<HONEYPOT>_18480"]}}],"http_methods":[{"method":"GET","count":17}],"distinct_ports_total":63,"top_paths":[{"path":"/","count":8,"ports":8},{"path":"/version","count":1,"ports":1},{"path":"/_search","count":1,"ports":1},{"path":"/versions","count":1,"ports":1},{"path":"/browser/","count":1,"ports":1},{"path":"/_stats/indices","count":1,"ports":1},{"path":"/druid/index.html","count":1,"ports":1},{"path":"/manager/text/list","count":1,"ports":1},{"path":"/ClientWebService/Client.asmx?singleWsdl","count":1,"ports":1},{"path":"/autodiscover/autodiscover.json?@zdi/Powershell","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:2222","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[{"tag_id":"CVE-2021-34473","tag_type":"cve","title":"Exchange Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover/autodiscover.json","reference_urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473","https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html","https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1","https://nvd.nist.gov/vuln/detail/CVE-2021-34473","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473"]}],"data_as_of":"2026-07-12T02:32:30.406371+00:00"}