{"ip":"40.76.100.1","data_as_of":"2026-10-25T07:14:15+00:00","observed":true,"total_events":53,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 9 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"4,067 bytes sent","bytes_sent":4067,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-08-25T02:30:00","last_seen":"2026-10-25T06:15:45","events_24h":0,"events_7d":6,"interactive_sessions":9,"interactive_sessions_24h":4,"interactive_sessions_7d":7,"interactive_protocols":[{"protocol":"http","sessions":3},{"protocol":"imap","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdes2f01vu.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":1434,"events":1},{"port":5093,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-16T21:07:46","last_seen":"2026-10-24T08:24:50","recent":[{"timestamp":"2026-10-24T08:24:50","port":1434,"src_port":60074,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0002","payload_hex":"02","sni":"","session":"5c41181f-d00f-4fc0-82e7-33d1d6d2e29f","bytes_in":1,"source_verified":false},{"timestamp":"2026-10-16T21:07:46","port":5093,"src_port":46925,"proto":"udp","app_proto":"","app_protocol":"","summary":"DIGI\u0000\u0001\u0000\u0006������","payload_hex":"4449474900010006ffffffffffff","sni":"","session":"f9d610d4-fc16-44f2-82a2-71ebdd26cfb0","bytes_in":14,"source_verified":false,"enriched":{"digest":"02ef84d36fa01651","strings":["DIGI"]}}]},"interaction":{"window_days":90,"sessions":10,"first_seen":"2026-10-15T04:28:10","last_seen":"2026-10-25T06:15:45","verdicts":[{"verdict":"scan","sessions":5},{"verdict":"unknown","sessions":5}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":2},{"persona":"dovecot@2.3.7","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":9200,"sessions":2},{"protocol":"tcp","port":7199,"sessions":2},{"protocol":"imap","port":993,"sessions":2},{"protocol":"tcp","port":32400,"sessions":2},{"protocol":"tcp","port":8082,"sessions":1},{"protocol":"http","port":8080,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":5}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":5,"sessions":1},{"port":139,"proto":"tcp","label":"SMB","count":3,"sessions":0},{"port":801,"proto":"tcp","label":"","count":2,"sessions":0},{"port":25565,"proto":"tcp","label":"Minecraft","count":2,"sessions":0},{"port":7222,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5007,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4118,"proto":"tcp","label":"","count":2,"sessions":0},{"port":18245,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9000,"proto":"tcp","label":"Web-alt","count":2,"sessions":0},{"port":8880,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2000,"proto":"tcp","label":"","count":2,"sessions":0},{"port":993,"proto":"tcp","label":"IMAPS","count":0,"sessions":2},{"port":7199,"proto":"tcp","label":"","count":0,"sessions":2},{"port":9200,"proto":"tcp","label":"Elastic","count":0,"sessions":2},{"port":32400,"proto":"tcp","label":"","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3266,"e54ef3ec27fe1fea7ab64d3fa05359fd":637,"b11cun040_00040016_aa48e2c8":5539},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-25","count":1,"sessions":0},{"date":"2026-08-30","count":1,"sessions":0},{"date":"2026-09-01","count":1,"sessions":0},{"date":"2026-09-09","count":1,"sessions":0},{"date":"2026-09-10","count":1,"sessions":0},{"date":"2026-09-13","count":1,"sessions":0},{"date":"2026-09-15","count":2,"sessions":0},{"date":"2026-09-19","count":1,"sessions":0},{"date":"2026-09-20","count":2,"sessions":0},{"date":"2026-09-21","count":4,"sessions":0},{"date":"2026-09-22","count":1,"sessions":0},{"date":"2026-09-25","count":3,"sessions":0},{"date":"2026-09-26","count":3,"sessions":0},{"date":"2026-09-27","count":3,"sessions":0},{"date":"2026-09-30","count":2,"sessions":0},{"date":"2026-10-01","count":1,"sessions":0},{"date":"2026-10-02","count":1,"sessions":0},{"date":"2026-10-04","count":2,"sessions":0},{"date":"2026-10-05","count":1,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-07","count":1,"sessions":0},{"date":"2026-10-08","count":2,"sessions":0},{"date":"2026-10-09","count":1,"sessions":0},{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-12","count":2,"sessions":0},{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-14","count":3,"sessions":0},{"date":"2026-10-15","count":1,"sessions":2},{"date":"2026-10-16","count":2,"sessions":0},{"date":"2026-10-18","count":2,"sessions":0},{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-22","count":4,"sessions":2},{"date":"2026-10-24","count":0,"sessions":2},{"date":"2026-10-25","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-24T17:44:44","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7199\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f373139390a","method":"","user_agent":"","ja3":"","session":"1b8ca43b-0258-41f0-8fc7-cc5f2c9aa5d1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"89d34933f5b8c511","strings":["MGLNDD_<HONEYPOT>_7199"]},"interactive":true},{"timestamp":"2026-10-24T17:44:43","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"48b1958b-a5c3-4031-9d9b-4683eb652004-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T20:15:00","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_139\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133390a","method":"","user_agent":"","ja3":"","session":"9d88c742-7355-442c-8cc1-a8f5a3d08db4","seq":1,"duration_ms":0,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"c6b7de44939720a9","strings":["MGLNDD_<HONEYPOT>_139"]}},{"timestamp":"2026-10-22T20:15:00","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018C�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000","payload_hex":"0000002fff534d4272000000001843c8000000000000000000000000fffffffe00000000000c00024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"d4bc908a-65b6-41b7-935f-a67833d427d6","seq":1,"duration_ms":104,"bytes_in":51,"bytes_out":11,"enriched":{"digest":"a119cd236d404812","strings":["SMBr","NT LM 0.12"]}},{"timestamp":"2026-10-22T20:14:59","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0002","payload_hex":"00000066fe534d424000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000000000000000000000000000000000000000000000000000001002","method":"","user_agent":"","ja3":"","session":"19e6fc42-56b7-470b-b704-a6c1e904a53c","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":11,"enriched":{"digest":"042813e3ac56b4a4","strings":["SMB@"]}},{"timestamp":"2026-10-22T18:18:33","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5432\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353433320a","method":"","user_agent":"","ja3":"","session":"9dcff69f-bf93-44bf-8ee3-2071db336564","seq":1,"duration_ms":80,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"84739dda4933805b","strings":["MGLNDD_<HONEYPOT>_5432"]}},{"timestamp":"2026-10-22T10:02:51","port":993,"proto":"tcp","app_proto":"imap","app_protocol":"imap","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"0fe07ecf-a066-4652-97ce-45f675362980-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-18T20:24:12","port":5900,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5900\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353930300a","method":"","user_agent":"","ja3":"","session":"439797fb-a61d-42f5-9e81-ba54ef135add","seq":1,"duration_ms":9,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"0e91f429f205f16e","strings":["MGLNDD_<HONEYPOT>_5900"]}},{"timestamp":"2026-10-18T13:27:06","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8080\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038300a","method":"","user_agent":"","ja3":"","session":"ace7738d-4d7a-43d4-86f8-6f69539cf73a","seq":1,"duration_ms":82,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"771a62c3980bb829","strings":["MGLNDD_<HONEYPOT>_8080"]}},{"timestamp":"2026-10-16T08:07:32","port":25565,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25565\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32353536350a","method":"","user_agent":"","ja3":"","session":"5c89e271-a7d5-40c3-a37d-08ec5932aa04","seq":1,"duration_ms":17,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"f914b6aacef342dc","strings":["MGLNDD_<HONEYPOT>_25565"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":42,"top_paths":[{"path":"/","count":5,"ports":4},{"path":"/hudson","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":null,"tags":[]}