{"ip":"57.152.33.247","total_events":84,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"strechoid","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (strechoid).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-02-18T19:21:14","last_seen":"2026-07-05T02:07:18","events_24h":1,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Washington","lat":38.7095,"lon":-78.1539,"asn":8075,"org":"Microsoft Corporation"},"source_domain":"azpdeg9nkaye.stretchoid.com","known_scanners":["strechoid","Stretchoid"],"scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8889,"proto":"tcp","label":"","count":6},{"port":27018,"proto":"tcp","label":"MongoDB","count":4},{"port":18480,"proto":"tcp","label":"","count":4},{"port":5601,"proto":"tcp","label":"Kibana","count":4},{"port":8834,"proto":"tcp","label":"","count":4},{"port":555,"proto":"tcp","label":"","count":4},{"port":2362,"proto":"tcp","label":"","count":3},{"port":8880,"proto":"tcp","label":"","count":3},{"port":1194,"proto":"tcp","label":"OpenVPN","count":3},{"port":2304,"proto":"tcp","label":"","count":2},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":2},{"port":8006,"proto":"tcp","label":"","count":2},{"port":18246,"proto":"tcp","label":"","count":2},{"port":7337,"proto":"tcp","label":"","count":2},{"port":15001,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-04-11","count":2},{"date":"2026-04-12","count":2},{"date":"2026-04-14","count":2},{"date":"2026-04-18","count":2},{"date":"2026-04-20","count":2},{"date":"2026-04-23","count":2},{"date":"2026-04-30","count":2},{"date":"2026-05-02","count":2},{"date":"2026-05-03","count":2},{"date":"2026-05-04","count":1},{"date":"2026-05-07","count":1},{"date":"2026-05-08","count":2},{"date":"2026-05-10","count":2},{"date":"2026-05-12","count":1},{"date":"2026-05-14","count":1},{"date":"2026-05-16","count":1},{"date":"2026-05-18","count":1},{"date":"2026-05-20","count":1},{"date":"2026-05-22","count":1},{"date":"2026-05-26","count":1},{"date":"2026-05-29","count":1},{"date":"2026-05-30","count":1},{"date":"2026-05-31","count":1},{"date":"2026-06-02","count":2},{"date":"2026-06-05","count":1},{"date":"2026-06-11","count":1},{"date":"2026-06-13","count":1},{"date":"2026-06-16","count":1},{"date":"2026-06-17","count":1},{"date":"2026-06-18","count":1},{"date":"2026-06-19","count":2},{"date":"2026-06-25","count":2},{"date":"2026-06-26","count":1},{"date":"2026-06-28","count":2},{"date":"2026-07-02","count":1},{"date":"2026-07-05","count":1}],"recent_events":[{"timestamp":"2026-07-05T02:07:18","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","community_id":"1:IwvzUAg2wzg3ZYDuMkJZ9feZ0iA=","ja3":"","session":"1154ca41-51ce-4fbb-ad80-9ac6ca55b945","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-07-02T20:37:44","port":1212,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1212\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313231320a","method":"","user_agent":"","community_id":"1:ynJfYq7+qRtWkKc6BUOvWPkWpp0=","ja3":"","session":"62ad09f8-f505-4147-a39d-1018c5d0144d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"d9ba7c28a4ff80be","strings":["MGLNDD_<HONEYPOT>_1212"]}},{"timestamp":"2026-06-28T22:02:15","port":8983,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8983\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383938330a","method":"","user_agent":"","community_id":"1:+hqU+8Vfg1x+r8mBA1o4BiAIWoQ=","ja3":"","session":"7ff00e4d-eaf2-48c2-a060-d3bfa8cbd692","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"a3295f60b8374e52","strings":["MGLNDD_<HONEYPOT>_8983"]}},{"timestamp":"2026-06-28T11:24:13","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","community_id":"1:KWjhoxb6vsfGwj7kTv8DGUMwLEc=","ja3":"","session":"cd7fe699-c6b7-4302-a3a1-93537c501cb1","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-06-26T10:48:02","port":8889,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8889\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838390a","method":"","user_agent":"","community_id":"1:3ZvHC7+sZZNXvd3/J4/k3PPXRHA=","ja3":"","session":"c331ab2a-c2fd-4f38-af6f-5fc40c5c2bee","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"de850e283b820234","strings":["MGLNDD_<HONEYPOT>_8889"]}},{"timestamp":"2026-06-25T19:34:03","port":981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_981\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938310a","method":"","user_agent":"","community_id":"1:IDjFs+I5Oz9BHvw+NIyle2JIXIY=","ja3":"","session":"4887deb0-85d1-473f-bcdf-03ec19089373","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"7db9c1ef4ae692a8","strings":["MGLNDD_<HONEYPOT>_981"]}},{"timestamp":"2026-06-25T09:46:36","port":6066,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6066\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363036360a","method":"","user_agent":"","community_id":"1:4C5F0Idqt/Tto6kIDn4IJynSNQc=","ja3":"","session":"6a3fea73-74fe-45f7-8384-4793f63f46ca","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"6a084a2d85c0db6a","strings":["MGLNDD_<HONEYPOT>_6066"]}},{"timestamp":"2026-06-19T13:19:27","port":8091,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8091\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383039310a","method":"","user_agent":"","community_id":"1:/x37BR78Y1aU0L4y/icp9yphuK0=","ja3":"","session":"c7f4e1ad-7178-4594-80aa-7989ff3a5b6b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"6ddd0549b0ac091a","strings":["MGLNDD_<HONEYPOT>_8091"]}},{"timestamp":"2026-06-19T04:19:55","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","community_id":"1:Iib6TfsXS/IrgAyNY3wlZWCUx1U=","ja3":"","session":"1fa29fc9-b17b-4249-8128-720f3b0cbcc2","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-06-18T14:03:37","port":10000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303030300a","method":"","user_agent":"","community_id":"1:Ff1Fl0CpVOfXULfwJKZolavaAXk=","ja3":"","session":"e185341f-1c0f-465a-9eac-c9a085bca3b9","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"c9a733fcff9a40bb","strings":["MGLNDD_<HONEYPOT>_10000"]}}],"http_methods":[],"distinct_ports_total":45,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-05T05:31:09.775178+00:00"}