{"ip":"40.124.174.133","total_events":197,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,950 bytes sent","bytes_sent":4950,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-16T19:01:27","last_seen":"2026-08-16T09:08:50","events_24h":0,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgcecxgl.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":8},{"port":8181,"proto":"tcp","label":"","count":6},{"port":18245,"proto":"tcp","label":"","count":6},{"port":445,"proto":"tcp","label":"SMB","count":6},{"port":631,"proto":"tcp","label":"IPP","count":6},{"port":4433,"proto":"tcp","label":"","count":6},{"port":443,"proto":"tcp","label":"HTTPS","count":5},{"port":118,"proto":"tcp","label":"","count":4},{"port":6666,"proto":"tcp","label":"","count":4},{"port":139,"proto":"tcp","label":"SMB","count":4},{"port":7443,"proto":"tcp","label":"","count":4},{"port":5000,"proto":"tcp","label":"Web-alt","count":4},{"port":11740,"proto":"tcp","label":"","count":4},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4},{"port":9080,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_ed383ed8462e"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2120,"po11nn0600_ed383ed8462e":331,"ge11nn0400_88d30a62b7ad":4889,"084386fa7ae5039bcf6f07298a05a227":682},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-22","count":1},{"date":"2026-05-26","count":3},{"date":"2026-05-29","count":3},{"date":"2026-05-31","count":4},{"date":"2026-06-01","count":1},{"date":"2026-06-04","count":1},{"date":"2026-06-06","count":1},{"date":"2026-06-07","count":1},{"date":"2026-06-08","count":1},{"date":"2026-06-10","count":1},{"date":"2026-06-11","count":2},{"date":"2026-06-13","count":2},{"date":"2026-06-15","count":1},{"date":"2026-06-18","count":2},{"date":"2026-06-19","count":2},{"date":"2026-06-21","count":2},{"date":"2026-06-22","count":1},{"date":"2026-06-24","count":1},{"date":"2026-06-26","count":6},{"date":"2026-06-27","count":1},{"date":"2026-06-28","count":3},{"date":"2026-06-29","count":1},{"date":"2026-07-03","count":1},{"date":"2026-07-04","count":2},{"date":"2026-07-06","count":2},{"date":"2026-07-09","count":1},{"date":"2026-07-11","count":1},{"date":"2026-07-12","count":2},{"date":"2026-07-13","count":1},{"date":"2026-07-15","count":2},{"date":"2026-07-16","count":4},{"date":"2026-07-19","count":3},{"date":"2026-07-21","count":3},{"date":"2026-07-22","count":2},{"date":"2026-07-23","count":1},{"date":"2026-07-26","count":3},{"date":"2026-07-28","count":2},{"date":"2026-07-29","count":1},{"date":"2026-07-31","count":1},{"date":"2026-08-02","count":1},{"date":"2026-08-03","count":1},{"date":"2026-08-05","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-12","count":2},{"date":"2026-08-14","count":2},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":4}],"recent_events":[{"timestamp":"2026-08-16T09:08:50","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"6c6986e4-d320-4000-8f31-1baa5b018000","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-08-16T09:08:45","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"2b8ce335-0d24-427d-917f-2717f6651b8f","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-08-16T03:07:41","port":8082,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8082\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038320a","method":"","user_agent":"","ja3":"","session":"4b8b4197-d4ef-4e42-9b23-80b8c92a1f32","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"68e0a8da33fcef03","strings":["MGLNDD_<HONEYPOT>_8082"]}},{"timestamp":"2026-08-16T03:07:36","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"e902cdc2-0b4b-4425-83df-1dc25f418f3f","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-08-15T19:06:20","port":102,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_102\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3130320a","method":"","user_agent":"","ja3":"","session":"a554f555-46ce-41cf-9067-2656c4875e24","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"8fbbf270736a6700","strings":["MGLNDD_<HONEYPOT>_102"]}},{"timestamp":"2026-08-15T19:06:19","port":102,"proto":"tcp","app_proto":"","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0016\u0011�\u0000\u0000\u0000\u0004\u0000�\u0002\u0001\u0000�\u0002\u0001\u0002�\u0001\n","payload_hex":"0300001611e00000000400c1020100c2020102c0010a","method":"","user_agent":"","ja3":"","session":"84c4f15d-55f9-4880-abc2-9494cc25c3e5","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":14,"enriched":{"digest":"1a42acaf9034e519","label":"S7comm / COTP (ISO-TSAP)"}},{"timestamp":"2026-08-14T22:45:49","port":9160,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9160\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393136300a","method":"","user_agent":"","ja3":"","session":"57f444f1-6fe7-48e8-8eb3-001a9d90d0be","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"428edf2ea6cd80d1","strings":["MGLNDD_<HONEYPOT>_9160"]}},{"timestamp":"2026-08-14T22:45:44","port":9160,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9160\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393136300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"054f2f32-77a6-468c-8cbf-6fcbbbdf8fcc","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-08-12T07:37:13","port":8086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8086\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038360a","method":"","user_agent":"","ja3":"","session":"8dfaea6e-6c69-4771-9fe6-75eb3a944e39","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"d593dd6d23410c6f","strings":["MGLNDD_<HONEYPOT>_8086"]}},{"timestamp":"2026-08-12T07:37:08","port":8086,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8086\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"8630c68c-4560-40ad-9df0-7d7284358c9e","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":79}],"http_methods":[{"method":"GET","count":24},{"method":"POST","count":3}],"distinct_ports_total":87,"top_paths":[{"path":"/","count":18,"ports":14},{"path":"/ipp","count":3,"ports":1},{"path":"/version","count":1,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/_search","count":1,"ports":1},{"path":"/ReportServer","count":1,"ports":1},{"path":"/db/manage/","count":1,"ports":1},{"path":"/_cluster/health?level=indices","count":1,"ports":1}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-08-20T19:30:07.960029+00:00"}