{"ip":"48.217.83.57","data_as_of":"2026-10-24T12:04:53+00:00","observed":true,"total_events":44,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (strechoid).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 4 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,367 bytes sent","bytes_sent":2367,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-09-18T11:26:32","last_seen":"2026-10-23T19:32:11","events_24h":1,"events_7d":7,"interactive_sessions":4,"interactive_sessions_24h":0,"interactive_sessions_7d":4,"interactive_protocols":[{"protocol":"sip","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdessz4yhw.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":4,"first_seen":"2026-10-21T07:42:37","last_seen":"2026-10-21T11:55:56","verdicts":[{"verdict":"unknown","sessions":4}],"personas":[{"persona":"sip@FPBX-16.0.40(18.20.0)","sessions":2}],"services":[{"protocol":"sip","port":5061,"sessions":2},{"protocol":"tcp","port":7001,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":1443,"proto":"tcp","label":"","count":4,"sessions":0},{"port":53,"proto":"tcp","label":"DNS","count":4,"sessions":0},{"port":445,"proto":"tcp","label":"SMB","count":3,"sessions":0},{"port":8980,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7077,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9997,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9200,"proto":"tcp","label":"Elastic","count":2,"sessions":0},{"port":32400,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8009,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3389,"proto":"tcp","label":"RDP","count":2,"sessions":0},{"port":9160,"proto":"tcp","label":"","count":2,"sessions":0},{"port":20,"proto":"tcp","label":"","count":2,"sessions":0},{"port":18080,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5061,"proto":"tcp","label":"SIPS","count":0,"sessions":2},{"port":7001,"proto":"tcp","label":"WebLogic","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea03032fa58f66beaae3e3d1349b5adc00ef9bb8561d12f70b4ca498c2cf967da2721b20a119bb26cd06a9d3514e35b99cb6ea2400d6cca2c85c2048aff2200a4984c0cb0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d002057c4fd2ece7b9cfb0e32a33878760b20fada7b0f4f3d7cb481b4769e","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3248,"b11cun040_00040016_aa48e2c8":5478},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-18","count":1,"sessions":0},{"date":"2026-09-21","count":1,"sessions":0},{"date":"2026-09-24","count":4,"sessions":0},{"date":"2026-09-25","count":1,"sessions":0},{"date":"2026-09-26","count":1,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-09-29","count":1,"sessions":0},{"date":"2026-09-30","count":1,"sessions":0},{"date":"2026-10-01","count":4,"sessions":0},{"date":"2026-10-02","count":1,"sessions":0},{"date":"2026-10-03","count":1,"sessions":0},{"date":"2026-10-05","count":4,"sessions":0},{"date":"2026-10-06","count":3,"sessions":0},{"date":"2026-10-10","count":4,"sessions":0},{"date":"2026-10-12","count":2,"sessions":0},{"date":"2026-10-14","count":2,"sessions":0},{"date":"2026-10-15","count":4,"sessions":0},{"date":"2026-10-16","count":1,"sessions":0},{"date":"2026-10-17","count":3,"sessions":0},{"date":"2026-10-19","count":3,"sessions":0},{"date":"2026-10-21","count":0,"sessions":4},{"date":"2026-10-23","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T19:32:11","port":20,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_20\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32300a","method":"","user_agent":"","ja3":"","session":"aef4e9ba-d3b5-40bb-92ec-5c9d38b70325","seq":1,"duration_ms":61,"bytes_in":23,"bytes_out":12,"enriched":{"digest":"40b085a52b2d8565","strings":["MGLNDD_<HONEYPOT>_20"]}},{"timestamp":"2026-10-19T13:21:29","port":1443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313434330a","method":"","user_agent":"","ja3":"","session":"dae8cc06-8259-486e-a32e-8b8efce97d49","seq":1,"duration_ms":60,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"2e67910546079b84","strings":["MGLNDD_<HONEYPOT>_1443"]}},{"timestamp":"2026-10-19T13:21:29","port":1443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"240ad69a-54de-45dc-be3b-013982b17e4c","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-10-19T12:37:03","port":20,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_20\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32300a","method":"","user_agent":"","ja3":"","session":"3d36a668-4ce3-4070-96fc-52024896d617","seq":1,"duration_ms":2,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"40b085a52b2d8565","strings":["MGLNDD_<HONEYPOT>_20"]}},{"timestamp":"2026-10-17T15:45:21","port":8009,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8009\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030390a","method":"","user_agent":"","ja3":"","session":"be2f4114-3024-43d7-8317-1a89b2eef19b","seq":1,"duration_ms":81,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"ef2490a9ba5284a0","strings":["MGLNDD_<HONEYPOT>_8009"]}},{"timestamp":"2026-10-17T15:45:21","port":8009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8009\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030390d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"465b67cf-f18a-42e8-8585-8efee86363bf","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-10-17T14:13:50","port":512,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_512\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3531320a","method":"","user_agent":"","ja3":"","session":"2d4c6b7a-5526-47b0-b0f5-b33f35170649","seq":1,"duration_ms":63,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"2690491a0db0c66a","strings":["MGLNDD_<HONEYPOT>_512"]}},{"timestamp":"2026-10-16T06:37:33","port":28017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_28017\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32383031370a","method":"","user_agent":"","ja3":"","session":"6731e8bb-d92d-4ef4-a25b-f092d40fcfaf","seq":1,"duration_ms":10,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"f9a3cfe97126b696","strings":["MGLNDD_<HONEYPOT>_28017"]}},{"timestamp":"2026-10-15T18:33:25","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/manager/html","summary":"","payload_hex":"474554202f6d616e616765722f68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"e47b49a6-f4c7-4d10-a243-4f92c1a3d683","seq":1,"duration_ms":100,"bytes_in":127,"bytes_out":77},{"timestamp":"2026-10-15T00:02:38","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_445\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3434350a","method":"","user_agent":"","ja3":"","session":"09da926b-8405-4688-a851-e8545d32ae11","seq":1,"duration_ms":63,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"10e5329c7d7334ac","strings":["MGLNDD_<HONEYPOT>_445"]}}],"http_methods":[{"method":"GET","count":13}],"distinct_ports_total":28,"top_paths":[{"path":"/","count":8,"ports":6},{"path":"/_search","count":2,"ports":1},{"path":"/stats","count":1,"ports":1},{"path":"/manager/html","count":1,"ports":1},{"path":"/_all_dbs","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[]}