{"ip":"40.124.123.24","observed":true,"total_events":25,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,117 bytes sent","bytes_sent":1117,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-17T20:01:14","last_seen":"2026-10-14T13:00:03","events_24h":2,"events_7d":7,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdssa8lusx.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":11743,"proto":"tcp","label":"","count":4},{"port":8834,"proto":"tcp","label":"","count":2},{"port":8032,"proto":"tcp","label":"","count":2},{"port":989,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":1},{"port":26,"proto":"tcp","label":"","count":1},{"port":2082,"proto":"tcp","label":"","count":1},{"port":4899,"proto":"tcp","label":"","count":1},{"port":2375,"proto":"tcp","label":"Docker","count":1},{"port":49152,"proto":"tcp","label":"","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":5986,"proto":"tcp","label":"","count":1},{"port":1028,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea03036047a1c43557c313fa2e359147d51b0b3c2c67f11e8dd52b549db517aa38d3a520396b99d81ceaf0b4a55f560213e6f82934d0e2d63be6393de8badbc536415f780026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00205f495110dbd604da9f330d7237a0a911e028ef9149ef89463356b0f5","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2991,"b11cun040_00040016_aa48e2c8":5461},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-23","count":2},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":2},{"date":"2026-09-30","count":1},{"date":"2026-10-02","count":2},{"date":"2026-10-04","count":2},{"date":"2026-10-05","count":2},{"date":"2026-10-07","count":2},{"date":"2026-10-08","count":1},{"date":"2026-10-09","count":2},{"date":"2026-10-10","count":2},{"date":"2026-10-14","count":2}],"recent_events":[{"timestamp":"2026-10-14T13:00:03","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_989\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938390a","method":"","user_agent":"","ja3":"","session":"07ef4602-856a-4c92-a27e-c38ef6ce8d83","seq":1,"duration_ms":67,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"25b5023164b356a8","strings":["MGLNDD_<HONEYPOT>_989"]}},{"timestamp":"2026-10-14T13:00:02","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e9a78012-8747-44a9-9541-fc75574136f7","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-10T04:57:50","port":11743,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11743\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313734330a","method":"","user_agent":"","ja3":"","session":"3ca99c33-9003-4c61-87e8-f6afa9da86e4","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":13,"enriched":{"digest":"78770f0c27155e16","strings":["MGLNDD_<HONEYPOT>_11743"]}},{"timestamp":"2026-10-10T04:57:49","port":11743,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0017�$\u0000\u0000\u0000�|P\u0003\u00003����\n\u0004\u0000\u0011-߹�Q�\u0002�\u0000\u0004a�^\u001a","payload_hex":"000117e824000000c57c50030033ad97d4c20a0400112ddf<HONEYPOT>02c20004619d5e1a","method":"","user_agent":"","ja3":"","session":"d7339a57-e2ab-4cd2-a190-089ff20df5ef","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":13},{"timestamp":"2026-10-09T08:31:22","port":26,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_26\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32360a","method":"","user_agent":"","ja3":"","session":"55a92fcc-8fc4-4786-ada4-7bc112fd966e","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"948c2e75c4295036","strings":["MGLNDD_<HONEYPOT>_26"]}},{"timestamp":"2026-10-09T02:34:27","port":4786,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"000000010000000100000004000000080000000100000000","method":"","user_agent":"","ja3":"","session":"0b2c4ac5-68c4-4a37-85f9-dbf74a826f4d","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":13},{"timestamp":"2026-10-08T16:06:19","port":5269,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5269\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353236390a","method":"","user_agent":"","ja3":"","session":"14288c11-f07a-46b3-9c97-c573b3017ca8","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"680f85abd1c8c06b","strings":["MGLNDD_<HONEYPOT>_5269"]}},{"timestamp":"2026-10-07T17:58:23","port":49152,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_49152\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f34393135320a","method":"","user_agent":"","ja3":"","session":"2285434d-8de9-4e08-a1a1-17f6d00c40d8","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"c689c1d7048c4c3c","strings":["MGLNDD_<HONEYPOT>_49152"]}},{"timestamp":"2026-10-07T00:31:55","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0001\u0000local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ixia\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff01006c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000069786961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"c2bc710a-c4cf-4fcc-ae5c-2ee631675923","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"e6496ea510190464","strings":["local","ixia","localixia"]}},{"timestamp":"2026-10-05T17:01:13","port":2082,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2082\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323038320a","method":"","user_agent":"","ja3":"","session":"20e96fd1-ecb9-4ce4-b96d-52e2047d5bde","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"306172d8cbbe2d74","strings":["MGLNDD_<HONEYPOT>_2082"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":18,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/version","count":1,"ports":1},{"path":"/actuator/health","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T05:37:37.710357+00:00"}