{"ip":"40.124.175.16","total_events":86,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"3,918 bytes sent","bytes_sent":3918,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-25T02:41:16","last_seen":"2026-08-07T11:27:19","events_24h":2,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsg56zpoo.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2025-59287","title":"Windows Server Update Service - Insecure Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ClientWebService/Client.asmx"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":7474,"proto":"tcp","label":"","count":4},{"port":953,"proto":"tcp","label":"","count":4},{"port":1080,"proto":"tcp","label":"SOCKS","count":4},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":3},{"port":5901,"proto":"tcp","label":"","count":3},{"port":9200,"proto":"tcp","label":"Elastic","count":3},{"port":5631,"proto":"tcp","label":"","count":3},{"port":555,"proto":"tcp","label":"","count":2},{"port":6667,"proto":"tcp","label":"IRC","count":2},{"port":8222,"proto":"tcp","label":"","count":2},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":2},{"port":55554,"proto":"tcp","label":"","count":2},{"port":10024,"proto":"tcp","label":"","count":2},{"port":636,"proto":"tcp","label":"LDAPS","count":2}],"fingerprints":{"ssh_hassh":["084386fa7ae5039bcf6f07298a05a227"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2143,"ge11nn0400_88d30a62b7ad":4660,"084386fa7ae5039bcf6f07298a05a227":630},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-05-11","count":1},{"date":"2026-05-17","count":2},{"date":"2026-05-19","count":1},{"date":"2026-05-22","count":1},{"date":"2026-05-23","count":1},{"date":"2026-05-25","count":4},{"date":"2026-05-26","count":1},{"date":"2026-05-28","count":2},{"date":"2026-05-31","count":1},{"date":"2026-06-02","count":2},{"date":"2026-06-09","count":1},{"date":"2026-06-11","count":2},{"date":"2026-06-13","count":2},{"date":"2026-06-15","count":1},{"date":"2026-06-17","count":2},{"date":"2026-06-18","count":2},{"date":"2026-06-22","count":1},{"date":"2026-06-24","count":2},{"date":"2026-06-26","count":2},{"date":"2026-06-27","count":2},{"date":"2026-06-30","count":1},{"date":"2026-07-02","count":1},{"date":"2026-07-05","count":1},{"date":"2026-07-06","count":1},{"date":"2026-07-08","count":3},{"date":"2026-07-15","count":1},{"date":"2026-07-17","count":1},{"date":"2026-07-20","count":2},{"date":"2026-07-21","count":3},{"date":"2026-07-25","count":3},{"date":"2026-07-27","count":1},{"date":"2026-07-28","count":1},{"date":"2026-07-29","count":3},{"date":"2026-07-30","count":2},{"date":"2026-08-02","count":1},{"date":"2026-08-05","count":3},{"date":"2026-08-07","count":2}],"recent_events":[{"timestamp":"2026-08-07T11:27:19","port":9200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9200\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393230300a","method":"","user_agent":"","ja3":"","session":"76c0547a-12fd-4ab6-8853-5c728576ea09","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"1082049adc72cf4b","strings":["MGLNDD_<HONEYPOT>_9200"]}},{"timestamp":"2026-08-07T11:27:13","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"e42a2094-28e8-4fa4-9c33-94b08a9e0c8f","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":78},{"timestamp":"2026-08-05T17:26:37","port":5984,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5984\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938340a","method":"","user_agent":"","ja3":"","session":"f6521788-b0d6-45c3-bd3b-a68556654e36","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"7e9d73aeeaff343d","strings":["MGLNDD_<HONEYPOT>_5984"]}},{"timestamp":"2026-08-05T04:34:03","port":1911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1911\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313931310a","method":"","user_agent":"","ja3":"","session":"d6e00ec8-b718-4c2b-a1b3-c67e2dffc4ec","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"815ed27faad50116","strings":["MGLNDD_<HONEYPOT>_1911"]}},{"timestamp":"2026-08-05T04:34:02","port":1911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"e7cbb712-3e18-42be-97d3-a9a50bfa0811","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":13,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-08-02T21:32:07","port":7474,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7474\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373437340a","method":"","user_agent":"","ja3":"","session":"e093a347-3db6-46a9-b713-eb0afd1735ed","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"858fa20a69f4ac63","strings":["MGLNDD_<HONEYPOT>_7474"]}},{"timestamp":"2026-07-30T07:10:07","port":801,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_801\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3830310a","method":"","user_agent":"","ja3":"","session":"92020dc5-ef43-4bcb-8340-d9986dfcbe0d","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"7ffeff0080f9f387","strings":["MGLNDD_<HONEYPOT>_801"]}},{"timestamp":"2026-07-30T07:10:02","port":801,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:801\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3830310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"a5b28232-1a25-430f-b91c-72a85ad3a8f6","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":78},{"timestamp":"2026-07-29T13:45:40","port":81,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:81\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/manager/text/list","summary":"","payload_hex":"474554202f6d616e616765722f746578742f6c69737420485454502f312e310d0a486f73743a20<HONEYPOT>3a38310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"a9b35461-5e64-4597-81ec-8bc8494f9d98","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":78},{"timestamp":"2026-07-29T11:41:08","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_23\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32330a","method":"","user_agent":"","ja3":"","session":"5953cb6b-afb8-4814-acd5-7306ed012baf","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"1515f0e7b77b4728","strings":["MGLNDD_<HONEYPOT>_23"]}}],"http_methods":[{"method":"GET","count":15}],"distinct_ports_total":47,"top_paths":[{"path":"/","count":9,"ports":9},{"path":"/ui","count":1,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/_search","count":1,"ports":1},{"path":"/setup/eureka_info","count":1,"ports":1},{"path":"/manager/text/list","count":1,"ports":1},{"path":"/ClientWebService/Client.asmx?singleWsdl","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9200","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2025-59287","tag_type":"cve","title":"Windows Server Update Service - Insecure Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ClientWebService/Client.asmx","reference_urls":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287","https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability","https://hawktrace.com/blog/CVE-2025-59287","https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287","https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/"]}],"data_as_of":"2026-08-08T03:08:44.027190+00:00"}