I think it will help defenders to know - if you see scanning from stretchoid.com systems, it’s actually Microsoft. They run an undocumented shell organisation that does exploitation of internet hosts.