{"ip":"40.124.186.145","total_events":16,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Stretchoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (Stretchoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"770 bytes sent","bytes_sent":770,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T05:35:46","last_seen":"2026-09-29T05:02:19","events_24h":0,"events_7d":10,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdssjijx6v.stretchoid.com","known_scanners":["Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":8032,"proto":"tcp","label":"","count":2},{"port":631,"proto":"tcp","label":"IPP","count":2},{"port":5692,"proto":"tcp","label":"","count":2},{"port":555,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":8581,"proto":"tcp","label":"","count":2},{"port":28017,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":7547,"proto":"tcp","label":"TR-069","count":1},{"port":179,"proto":"tcp","label":"BGP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303a82696b9230501b5a399483da891b689f8ab5409455dd4a3af829bb0d83b68772082c884bc239eeb2ceb2186962450b931732ea8aae2bc5058d03c165f5dda569d0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00200ec09f82cd924bd1d9378feec73cae1382e874168c9d197bb9209d7f","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3154,"b11cuq060_00050816_84d4cebf":324,"b11cun040_00040016_aa48e2c8":6198},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":3,"ips":324},"b11cun040_00040016_aa48e2c8":{"head":"b11cun040_00040016_aa48e2c8","shapes":5,"ips":6197}},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-16","count":4},{"date":"2026-09-20","count":2},{"date":"2026-09-25","count":4},{"date":"2026-09-26","count":2},{"date":"2026-09-27","count":3},{"date":"2026-09-29","count":1}],"recent_events":[{"timestamp":"2026-09-29T05:02:19","port":7547,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7547\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373534370a","method":"","user_agent":"","ja3":"","session":"b1d9aa42-aa2f-4cd5-b3e2-b361a1fa0f65","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"44e2aa4c8f8c7900","strings":["MGLNDD_<HONEYPOT>_7547"]}},{"timestamp":"2026-09-27T11:36:47","port":28017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_28017\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32383031370a","method":"","user_agent":"","ja3":"","session":"6bc6ac37-939a-4543-8f1b-0d21254b376d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"f9a3cfe97126b696","strings":["MGLNDD_<HONEYPOT>_28017"]}},{"timestamp":"2026-09-27T04:33:02","port":8581,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8581\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383538310a","method":"","user_agent":"","ja3":"","session":"b2db4663-db46-4fc9-a033-a757513f8415","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"2112ce3acfeadf11","strings":["MGLNDD_<HONEYPOT>_8581"]}},{"timestamp":"2026-09-27T04:33:01","port":8581,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"a02b721c-a11b-421a-804e-77b9b999cf66","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-26T10:04:05","port":555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_555\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3535350a","method":"","user_agent":"","ja3":"","session":"5e4d324b-aafa-4b3d-8088-a2f8aa9d4d24","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"9770e09633499dd4","strings":["MGLNDD_<HONEYPOT>_555"]}},{"timestamp":"2026-09-26T10:04:04","port":555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"76eda2e9-b78a-4de4-a950-dea363f5d6c7","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-25T08:40:10","port":4444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4444\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434340d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"974dbece-08b6-4aa7-bd51-de748ae629ca","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-25T08:40:10","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4444\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343434340a","method":"","user_agent":"","ja3":"","session":"4dbb8066-74c2-4986-85b4-464af087ee20","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"84f5da9f994555ac","strings":["MGLNDD_<HONEYPOT>_4444"]}},{"timestamp":"2026-09-25T02:09:33","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9ff2a5bd-0736-464f-bb32-4b65c63a145f","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-25T02:09:33","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8032\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383033320a","method":"","user_agent":"","ja3":"","session":"a1721afd-9cf9-45e6-bd9e-e2a2c93a019d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"827ff4d1ff8b19bd","strings":["MGLNDD_<HONEYPOT>_8032"]}}],"http_methods":[{"method":"GET","count":2},{"method":"POST","count":1}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/ipp","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:4444","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T14:00:54.346573+00:00"}