{"ip":"40.124.186.155","total_events":130,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-18T08:01:38","last_seen":"2026-07-11T11:37:06","events_24h":2,"events_7d":12,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgzbnbso.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":7},{"port":3389,"proto":"tcp","label":"RDP","count":5},{"port":7474,"proto":"tcp","label":"","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":502,"proto":"tcp","label":"","count":4},{"port":7001,"proto":"tcp","label":"WebLogic","count":4},{"port":9042,"proto":"tcp","label":"Cassandra","count":4},{"port":631,"proto":"tcp","label":"IPP","count":4},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4},{"port":81,"proto":"tcp","label":"","count":4},{"port":9160,"proto":"tcp","label":"","count":3},{"port":4040,"proto":"tcp","label":"","count":3},{"port":139,"proto":"tcp","label":"SMB","count":3},{"port":2375,"proto":"tcp","label":"Docker","count":3},{"port":138,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":2188,"ge11nn0400_88d30a62b7ad":6897},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-04-15","count":2},{"date":"2026-04-16","count":2},{"date":"2026-04-17","count":5},{"date":"2026-04-18","count":2},{"date":"2026-04-22","count":6},{"date":"2026-04-24","count":2},{"date":"2026-04-26","count":4},{"date":"2026-04-29","count":2},{"date":"2026-05-04","count":2},{"date":"2026-05-05","count":5},{"date":"2026-05-08","count":2},{"date":"2026-05-10","count":2},{"date":"2026-05-12","count":2},{"date":"2026-05-13","count":1},{"date":"2026-05-14","count":5},{"date":"2026-05-15","count":1},{"date":"2026-05-17","count":1},{"date":"2026-05-18","count":1},{"date":"2026-05-20","count":2},{"date":"2026-05-28","count":1},{"date":"2026-05-30","count":1},{"date":"2026-05-31","count":3},{"date":"2026-06-06","count":1},{"date":"2026-06-09","count":1},{"date":"2026-06-10","count":2},{"date":"2026-06-11","count":1},{"date":"2026-06-15","count":1},{"date":"2026-06-22","count":2},{"date":"2026-06-23","count":3},{"date":"2026-06-24","count":3},{"date":"2026-06-25","count":1},{"date":"2026-06-26","count":1},{"date":"2026-07-03","count":1},{"date":"2026-07-05","count":2},{"date":"2026-07-07","count":2},{"date":"2026-07-08","count":3},{"date":"2026-07-09","count":2},{"date":"2026-07-10","count":1},{"date":"2026-07-11","count":2}],"recent_events":[{"timestamp":"2026-07-11T11:37:06","port":69,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_69\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f36390a","method":"","user_agent":"","community_id":"1:cVPN3vMWGR5rhZmcuEzJHNUDFbg=","ja3":"","session":"e4792461-9af8-4c8b-9699-494db9d4651d","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"dd453e2efce8c061","strings":["MGLNDD_<HONEYPOT>_69"]}},{"timestamp":"2026-07-11T11:37:06","port":69,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","community_id":"1:sOf8B2WHUSYHX7bnSMqL6oarqX0=","ja3":"","session":"f8b137a7-a409-47d9-b47d-b40b7734a5e1","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-07-10T16:57:42","port":2375,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2375\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323337350a","method":"","user_agent":"","community_id":"1:X0cugVX1cj3l4tct5BrromWoPYs=","ja3":"","session":"0f8ba610-e9d7-4f8d-8b39-3a75b06ab0b4","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"26b4401efba6dd21","strings":["MGLNDD_<HONEYPOT>_2375"]}},{"timestamp":"2026-07-09T22:27:23","port":1389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","community_id":"1:g+4BeLQqBcFBi4rMq1b0JCcYE4M=","ja3":"","session":"e93dccd5-1339-465f-82a3-197d96261335","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-07-09T16:06:26","port":465,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_465\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3436350a","method":"","user_agent":"","community_id":"1:Kjx2GBAwH/6AkzM3Vm5xohd9Q48=","ja3":"","session":"37ddac9c-060d-40a5-bf98-534df80eb8b4","seq":1,"duration_ms":42,"bytes_in":24,"bytes_out":40,"enriched":{"digest":"a8b54e921428b684","strings":["MGLNDD_<HONEYPOT>_465"]}},{"timestamp":"2026-07-08T23:43:24","port":4369,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4369\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343336390a","method":"","user_agent":"","community_id":"1:WLf2zD1RRixDqwj/cy5Mh6gAmrU=","ja3":"","session":"c5f17768-82cb-4d0d-8162-7f1027544af4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"e13ac51bd819a55e","strings":["MGLNDD_<HONEYPOT>_4369"]}},{"timestamp":"2026-07-08T08:08:46","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8032\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383033320a","method":"","user_agent":"","community_id":"1:gBGxEc1GLxMppacJRZtrZWMeVTU=","ja3":"","session":"b20f7546-ea3c-4dbf-9f59-d721489f1626","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"827ff4d1ff8b19bd","strings":["MGLNDD_<HONEYPOT>_8032"]}},{"timestamp":"2026-07-08T08:08:46","port":8032,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","community_id":"1:O0pFl6AeDeEHMADhOeItEDrWA8I=","ja3":"","session":"c16b0cdd-b03f-402f-8d76-f5869fa37914","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-07-07T15:14:10","port":4369,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4369\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343336390a","method":"","user_agent":"","community_id":"1:sif50mA5kY53eKfrty2fjktYSaY=","ja3":"","session":"70eba617-e31e-47b0-a5fd-e913657cdcb3","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"e13ac51bd819a55e","strings":["MGLNDD_<HONEYPOT>_4369"]}},{"timestamp":"2026-07-07T06:44:23","port":3479,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3479\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333437390a","method":"","user_agent":"","community_id":"1:buvLsZNc9/X2uedFx9rDrWr6Mig=","ja3":"","session":"3909415c-baf2-4f1a-ba97-f313c79bc3ac","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"e3d670ae36823e3d","strings":["MGLNDD_<HONEYPOT>_3479"]}}],"http_methods":[{"method":"GET","count":15}],"distinct_ports_total":61,"top_paths":[{"path":"/","count":10,"ports":10},{"path":"/_stats/indices","count":2,"ports":1},{"path":"/_search","count":1,"ports":1},{"path":"/versions","count":1,"ports":1},{"path":"/_all_dbs","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-12T04:14:29.786645+00:00"}