{"ip":"40.124.179.170","total_events":10,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"680 bytes sent","bytes_sent":680,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-02T17:44:37","last_seen":"2026-09-10T12:14:26","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdss5fzx6o.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2019-9621","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":32400,"proto":"tcp","label":"","count":2},{"port":2083,"proto":"tcp","label":"","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":1},{"port":50000,"proto":"tcp","label":"SAP","count":1},{"port":138,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2386,"ge11nn0400_88d30a62b7ad":5861},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-02","count":1},{"date":"2026-09-03","count":4},{"date":"2026-09-07","count":1},{"date":"2026-09-08","count":2},{"date":"2026-09-10","count":2}],"recent_events":[{"timestamp":"2026-09-10T12:14:26","port":32400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_32400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f33323430300a","method":"","user_agent":"","ja3":"","session":"7191e940-8391-4c46-a09b-0d42af829b33","seq":1,"duration_ms":10,"bytes_in":28,"bytes_out":14,"enriched":{"digest":"69b665d12e12de8d","strings":["MGLNDD_<HONEYPOT>_32400"]}},{"timestamp":"2026-09-10T12:14:26","port":32400,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"2c9859cf-3419-41a7-b74d-54563ebf93ad","seq":1,"duration_ms":101,"bytes_in":117,"bytes_out":79},{"timestamp":"2026-09-08T06:28:06","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3434330a","method":"","user_agent":"","ja3":"","session":"c2238de2-f13b-4ac4-af59-6ec072065c2d","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"95059311514a6ef0","strings":["MGLNDD_<HONEYPOT>_443"]}},{"timestamp":"2026-09-08T06:28:06","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"2e83609d-ceef-4929-af09-b877addde400","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-07T06:59:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/autodiscover/autodiscover.json?@zdi/Powershell","summary":"","payload_hex":"474554202f6175746f646973636f7665722f6175746f646973636f7665722e6a736f6e3f407a64692f506f7765727368656c6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"65c41230-2e4b-4734-99a2-59e07a02dfd6","seq":1,"duration_ms":123,"bytes_in":155,"bytes_out":79},{"timestamp":"2026-09-03T06:37:00","port":2083,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2083\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323038330a","method":"","user_agent":"","ja3":"","session":"978c4787-427e-486e-a15b-1b93b5042d14","seq":1,"duration_ms":13,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"29a0dd3ee23258b0","strings":["MGLNDD_<HONEYPOT>_2083"]}},{"timestamp":"2026-09-03T06:37:00","port":2083,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2083\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"63a9d381-6e82-4de5-a6ba-44e8b74f7fa8","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-09-03T03:05:55","port":138,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_138\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133380a","method":"","user_agent":"","ja3":"","session":"e4494cf3-faab-4603-9d03-3b565992c197","seq":1,"duration_ms":10,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"a1c09950ee3ba102","strings":["MGLNDD_<HONEYPOT>_138"]}},{"timestamp":"2026-09-03T00:46:23","port":50000,"proto":"tcp","app_proto":"","app_protocol":"drda","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u00002�\u0001\u0000\u0001\u0000,\u0010A\u0000\u0004\u0011^\u0000\u0004\u0011m\u0000\u0004\u0011Z\u0000\u0018\u0014\u0004\u0014\u0003\u0000\u0007$\u0007\u0000\b$\u000f\u0000\b\u0014@\u0000\b\u0014t\u0000\b\u0000\u0004\u0011G","payload_hex":"0032d0010001002c10410004115e0004116d0004115a001814041403000724070008240f0008144000081474000800041147","method":"","user_agent":"","ja3":"","session":"a69f9a41-0e51-41e1-b713-73e049da0b4c","seq":1,"duration_ms":100,"bytes_in":50,"bytes_out":14},{"timestamp":"2026-09-02T17:44:37","port":27017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27017\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031370a","method":"","user_agent":"","ja3":"","session":"ea16a636-3ceb-4955-9c9e-1e39d5ad7760","seq":1,"duration_ms":10,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"0ff2162d222a4d53","strings":["MGLNDD_<HONEYPOT>_27017"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/autodiscover/autodiscover.json?@zdi/Powershell","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:32400","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"CVE-2019-9621","tag_type":"cve","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover","reference_urls":["https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","https://nvd.nist.gov/vuln/detail/cve-2019-9621","http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","https://bugzilla.zimbra.com/show_bug.cgi?id=109127"]}],"data_as_of":"2026-09-11T20:53:02.857074+00:00"}