{"ip":"40.124.186.154","total_events":135,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-18T07:24:35","last_seen":"2026-07-07T08:43:49","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgg0jltg.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":15},{"port":102,"proto":"tcp","label":"","count":7},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":6},{"port":3389,"proto":"tcp","label":"RDP","count":4},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":4},{"port":18245,"proto":"tcp","label":"","count":4},{"port":8099,"proto":"tcp","label":"","count":4},{"port":9160,"proto":"tcp","label":"","count":4},{"port":2086,"proto":"tcp","label":"","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":1911,"proto":"tcp","label":"","count":4},{"port":27017,"proto":"tcp","label":"MongoDB","count":4},{"port":8889,"proto":"tcp","label":"","count":4},{"port":4444,"proto":"tcp","label":"","count":3},{"port":9200,"proto":"tcp","label":"Elastic","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2325,"ge11nn0400_88d30a62b7ad":7349},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-04-10","count":2},{"date":"2026-04-11","count":2},{"date":"2026-04-12","count":2},{"date":"2026-04-13","count":6},{"date":"2026-04-15","count":2},{"date":"2026-04-16","count":6},{"date":"2026-04-22","count":4},{"date":"2026-04-24","count":2},{"date":"2026-04-25","count":2},{"date":"2026-04-30","count":2},{"date":"2026-05-04","count":3},{"date":"2026-05-09","count":1},{"date":"2026-05-11","count":1},{"date":"2026-05-15","count":2},{"date":"2026-05-18","count":1},{"date":"2026-05-19","count":1},{"date":"2026-05-23","count":1},{"date":"2026-05-24","count":1},{"date":"2026-05-25","count":5},{"date":"2026-05-26","count":3},{"date":"2026-05-28","count":1},{"date":"2026-06-04","count":1},{"date":"2026-06-11","count":1},{"date":"2026-06-12","count":1},{"date":"2026-06-15","count":1},{"date":"2026-06-16","count":2},{"date":"2026-06-18","count":1},{"date":"2026-06-22","count":2},{"date":"2026-06-23","count":1},{"date":"2026-06-28","count":1},{"date":"2026-06-30","count":2},{"date":"2026-07-06","count":2},{"date":"2026-07-07","count":3}],"recent_events":[{"timestamp":"2026-07-07T08:43:49","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8080\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038300a","method":"","user_agent":"","community_id":"1:T4akCw3hipbQKrLygRKyiDk5jW8=","ja3":"","session":"6584a2f8-883e-4b70-8ed8-9f7b3862203b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"771a62c3980bb829","strings":["MGLNDD_<HONEYPOT>_8080"]}},{"timestamp":"2026-07-07T08:43:44","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:ENCGt/MwnjV8GWPsOG5+/i58UxA=","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"b49db6b6-e8f2-4bde-8f0e-ab2d49241d30","seq":1,"duration_ms":170,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-07-07T03:29:59","port":9200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/_cluster/health?level=indices","summary":"","payload_hex":"474554202f5f636c75737465722f6865616c74683f6c6576656c3d696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:j9aViveTE1flSYJ/ScNivdFYxEs=","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"1b77172e-2872-4747-9be8-e8ef3e596a65","seq":1,"duration_ms":229,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-07-06T00:15:24","port":8445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8445\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383434350a","method":"","user_agent":"","community_id":"1:pAddze8TOfhx315dv9iUm82z4MI=","ja3":"","session":"e3e0982d-4c4e-41cf-9c0d-d8c0471c5e3c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"a56c1441f05f1551","strings":["MGLNDD_<HONEYPOT>_8445"]}},{"timestamp":"2026-07-06T00:15:19","port":8445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8445\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","community_id":"1:HX4465vH4pAthm7UpAlHZaFdKqY=","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"d77fa5fb-5eb0-4255-ad4d-168474f17029","seq":1,"duration_ms":134,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-06-30T03:16:30","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25565\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32353536350a","method":"","user_agent":"","community_id":"1:9hARWJr3ta1wLW4L/Uo8AuNjpdU=","ja3":"","session":"b719f7c9-3d65-48ee-bae0-d3f66132aefc","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"f914b6aacef342dc","strings":["MGLNDD_<HONEYPOT>_25565"]}},{"timestamp":"2026-06-30T03:16:29","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n\u0000�\u0005\u0003aaac�\u0001\u0001\u0000","payload_hex":"0a00f8050361616163dd010100","method":"","user_agent":"","community_id":"1:p69ii8feMeNdSQcP16EYqUsCWok=","ja3":"","session":"860eec26-76dd-4e61-bc4a-f782458bbfe8","seq":1,"duration_ms":100,"bytes_in":13,"bytes_out":14,"enriched":{"digest":"86608c232b2ac40c","strings":["aaac"]}},{"timestamp":"2026-06-28T14:21:10","port":4848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4848\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343834380a","method":"","user_agent":"","community_id":"1:z4PlrYSL7uNnm/Kh6aQSi4Xe7xY=","ja3":"","session":"69251f62-6bda-4ebd-85e7-6fa1037028f2","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"878e9ce5cb116538","strings":["MGLNDD_<HONEYPOT>_4848"]}},{"timestamp":"2026-06-23T05:59:11","port":7474,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7474\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373437340a","method":"","user_agent":"","community_id":"1:d9aTBrmkaXNn35GDc8ba6jOKRLg=","ja3":"","session":"3497c811-51b3-4a00-a3fd-276773c44852","seq":1,"duration_ms":0,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"858fa20a69f4ac63","strings":["MGLNDD_<HONEYPOT>_7474"]}},{"timestamp":"2026-06-22T13:13:37","port":102,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_102\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3130320a","method":"","user_agent":"","community_id":"1:R2Ri1pYL4rD7+LpWKKYIZ9Cbrs8=","ja3":"","session":"b8e47d55-8d5f-4cb2-be6f-67f8554dd264","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"8fbbf270736a6700","strings":["MGLNDD_<HONEYPOT>_102"]}}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":51,"top_paths":[{"path":"/","count":8,"ports":8},{"path":"/ClientWebService/Client.asmx?singleWsdl","count":1,"ports":1},{"path":"/_cluster/health?level=indices","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-07-09T03:09:15.078305+00:00"}