{"ip":"52.248.41.236","total_events":15,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,680 bytes sent","bytes_sent":1680,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-29T06:28:18","last_seen":"2026-09-13T03:32:36","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdsgq28gnm.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader"}],"malware":[],"top_ports":[{"port":11741,"proto":"tcp","label":"","count":2},{"port":17990,"proto":"tcp","label":"","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":4369,"proto":"tcp","label":"","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":1389,"proto":"tcp","label":"","count":1},{"port":427,"proto":"tcp","label":"","count":1},{"port":22,"proto":"tcp","label":"SSH","count":1},{"port":5902,"proto":"tcp","label":"","count":1},{"port":5006,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":7210,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":[]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2936,"e54ef3ec27fe1fea7ab64d3fa05359fd":466},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":3},{"date":"2026-09-03","count":3},{"date":"2026-09-04","count":1},{"date":"2026-09-06","count":2},{"date":"2026-09-09","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":1}],"recent_events":[{"timestamp":"2026-09-13T03:32:36","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/developmentserver/metadatauploader","summary":"","payload_hex":"474554202f646576656c6f706d656e747365727665722f6d6574616461746175706c6f6164657220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"ff572207-cca2-4d37-83d3-cb0d7b2b159f","seq":1,"duration_ms":244,"bytes_in":145,"bytes_out":78},{"timestamp":"2026-09-12T07:33:45","port":1389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"","session":"1bff8eaa-b357-4882-93f7-4202de190a8e","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":13},{"timestamp":"2026-09-09T07:37:49","port":4369,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4369\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343336390a","method":"","user_agent":"","ja3":"","session":"9aae17d7-bfd0-4403-ba0a-020075794d5e","seq":1,"duration_ms":9,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"e13ac51bd819a55e","strings":["MGLNDD_<HONEYPOT>_4369"]}},{"timestamp":"2026-09-06T12:55:30","port":11741,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0017�(\u0000\u0000\u0000�k@\u0003\u0000S�-\u0005����-\n\u0004\u0000=�\u0000\u0000\u0000\u0000\u0000\u0002�\u0000\u0004��\u0000\u0000","payload_hex":"000117e828000000c56b40030053dd2d<HONEYPOT>dd2d0a04003d80000000000002c20004ab840000","method":"","user_agent":"","ja3":"","session":"4f18cf6d-f931-49a6-91db-ef1a89312a92","seq":1,"duration_ms":93,"bytes_in":40,"bytes_out":13},{"timestamp":"2026-09-06T12:55:30","port":11741,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11741\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313734310a","method":"","user_agent":"","ja3":"","session":"c72ba3bb-ae2e-49f8-9359-961290c18bf0","seq":1,"duration_ms":10,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"a1ec9a788a406bb4","strings":["MGLNDD_<HONEYPOT>_11741"]}},{"timestamp":"2026-09-04T16:21:14","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"e55160df-40c3-48ff-9ae4-5b21ed2ac7f2","seq":1,"duration_ms":10,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-03T13:06:20","port":427,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_427\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3432370a","method":"","user_agent":"","ja3":"","session":"764b1df8-5b73-4e0e-83e5-b1135c40b288","seq":1,"duration_ms":9,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"7058c041eecd32b0","strings":["MGLNDD_<HONEYPOT>_427"]}},{"timestamp":"2026-09-03T11:04:29","port":1433,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0015\u0000\u0006\u0001\u0000\u001b\u0000\u0001\u0002\u0000\u001c\u0000\f\u0003\u0000(\u0000\u0004�\b\u0000\u0001U\u0000\u0000\u0000MSSQLServer\u0000H\u000f\u0000\u0000","payload_hex":"1201003400000000000015000601001b000102001c000c0300280004ff080001550000004d5353514c53657276657200480f0000","method":"","user_agent":"","ja3":"","session":"e7292c15-8ec3-459f-a01d-8946ccebe8db","seq":1,"duration_ms":10,"bytes_in":52,"bytes_out":13,"enriched":{"digest":"9852857ade38ccb3","strings":["MSSQLServer","UMSSQLServerH"]}},{"timestamp":"2026-09-03T04:15:39","port":5006,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5006\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353030360a","method":"","user_agent":"","ja3":"","session":"2b1a0bfe-8b09-4469-b7fb-9a844f02f25e","seq":1,"duration_ms":10,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"6c8dc9e0ae2ab558","strings":["MGLNDD_<HONEYPOT>_5006"]}},{"timestamp":"2026-08-31T15:04:08","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014\u001d\u0019<�-��n���\u0005c�!0\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000X\u0000�j�\\","payload_hex":"5353482d322e302d476f0d0a0000049c06141d193c902dadc56eb9cdd80563d0213000000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000005800886af85c","method":"","user_agent":"","ja3":"","session":"4e4d5c22-c271-4f49-b9e6-3bd278dfede6","seq":1,"duration_ms":225,"bytes_in":1196,"bytes_out":13,"enriched":{"digest":"4b02debf6c82e321","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneX"],"iocs":{"domains":["libssh.org","openssh.com"]}}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":13,"top_paths":[{"path":"/developmentserver/metadatauploader","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"]}],"data_as_of":"2026-09-23T09:48:08.177542+00:00"}