{"ip":"13.86.115.128","total_events":27,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"17+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 17 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,575 bytes sent","bytes_sent":1575,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T12:05:52","last_seen":"2026-10-03T22:51:54","events_24h":0,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5632,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T20:51:29","last_seen":"2026-10-06T20:51:29","recent":[{"timestamp":"2026-10-06T20:51:29","port":5632,"src_port":51406,"proto":"udp","app_proto":"","app_protocol":"","summary":"NQ\n","payload_hex":"4e510a","sni":"","session":"e54ab2f6-e8ec-4e6f-82d0-c0707d369635","bytes_in":3,"source_verified":false}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8580,"proto":"tcp","label":"","count":2},{"port":32400,"proto":"tcp","label":"","count":2},{"port":4040,"proto":"tcp","label":"","count":2},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":2},{"port":9000,"proto":"tcp","label":"Web-alt","count":2},{"port":9200,"proto":"tcp","label":"Elastic","count":2},{"port":18245,"proto":"tcp","label":"","count":2},{"port":502,"proto":"tcp","label":"","count":2},{"port":631,"proto":"tcp","label":"IPP","count":2},{"port":1337,"proto":"tcp","label":"","count":1},{"port":7001,"proto":"tcp","label":"WebLogic","count":1},{"port":50070,"proto":"tcp","label":"Hadoop","count":1},{"port":1930,"proto":"tcp","label":"","count":1},{"port":5001,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3121,"b11cuq060_00050816_84d4cebf":341,"b11cun040_00040016_aa48e2c8":6105},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":4,"ips":337}},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":2},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":3},{"date":"2026-09-21","count":5},{"date":"2026-09-23","count":2},{"date":"2026-09-25","count":1},{"date":"2026-09-29","count":5},{"date":"2026-09-30","count":2},{"date":"2026-10-02","count":2},{"date":"2026-10-03","count":2}],"recent_events":[{"timestamp":"2026-10-03T22:51:54","port":502,"proto":"tcp","app_proto":"","app_protocol":"modbus","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ZG\u0000\u0000\u0000\u0005\u0000+\u000e\u0001\u0000","payload_hex":"5a4700000005002b0e0100","method":"","user_agent":"","ja3":"","session":"70f2744b-0592-489a-93a3-840d2ded79c4","seq":1,"duration_ms":100,"bytes_in":11,"bytes_out":13},{"timestamp":"2026-10-03T22:51:54","port":502,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_502\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3530320a","method":"","user_agent":"","ja3":"","session":"650d0b37-4fd9-4c64-ade6-a87f8f2457fa","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"a73ecca3188141c4","strings":["MGLNDD_<HONEYPOT>_502"]}},{"timestamp":"2026-10-02T12:49:55","port":631,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"content-length\":\"147\",\"content-type\":\"application/ipp\",\"host\":\"<HONEYPOT>:631\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"\u0002\u0001\u0000\u000b\u0000\u0000\u0000\u0001\u0001G\u0000\u0012attributes-charset\u0000\u0005utf-8H\u0000\u001battributes-natural-language\u0000\u0005en-usE\u0000\u000bprinter-uri\u0000\u001cipp://<HONEYPOT>:631/ippD\u0000\u0014requested-attributes\u0000\u0003all\u0003","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ipp","summary":"","payload_hex":"504f5354202f69707020485454502f312e310d0a486f73743a20<HONEYPOT>3a3633310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a436f6e74656e742d4c656e6774683a203134370d0a4163636570743a202a2f2a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6970700d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a0201000b0000000101470012617474726962757465732d6368617273657400057574662d3848001b617474726962757465732d6e61747572616c2d6c616e67756167650005656e2d757345000b7072696e7465722d757269001c6970703a2f2f<HONEYPOT>3a3633312f6970704400147265717565737465642d617474726962757465730003616c6c03","method":"POST","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"8b0646dc-554a-4771-af93-46f5f41c9551","seq":1,"duration_ms":100,"bytes_in":318,"bytes_out":78},{"timestamp":"2026-10-02T12:49:55","port":631,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_631\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3633310a","method":"","user_agent":"","ja3":"","session":"71c3ff5f-3ce5-4909-9a46-09e3311756da","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"4ae9491bb6b1ff95","strings":["MGLNDD_<HONEYPOT>_631"]}},{"timestamp":"2026-09-30T08:53:22","port":8580,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"7ed47805-768d-454a-a1af-7817f5c45dbd","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-30T08:53:22","port":8580,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8580\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383538300a","method":"","user_agent":"","ja3":"","session":"d6029448-c4f3-42d7-9fc2-b31ef67fb230","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"f97ecfd9d8920010","strings":["MGLNDD_<HONEYPOT>_8580"]}},{"timestamp":"2026-09-29T21:31:08","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"2123da22-b5e7-4b51-a866-17be7bfa2d16","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-09-29T21:31:08","port":9000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393030300a","method":"","user_agent":"","ja3":"","session":"c07546b8-5fbc-47c9-9b4e-e36ce38eba10","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"3e376e3fadaa39a6","strings":["MGLNDD_<HONEYPOT>_9000"]}},{"timestamp":"2026-09-29T16:56:45","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/","summary":"","payload_hex":"474554202f76322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"6ad80157-94ea-45a6-893b-a4ffa6545076","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":78},{"timestamp":"2026-09-29T14:36:43","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1337\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313333370a","method":"","user_agent":"","ja3":"","session":"673f588d-7093-4400-9454-7a9bf210a1d0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"67786f48dc1d63e4","strings":["MGLNDD_<HONEYPOT>_1337"]}}],"http_methods":[{"method":"GET","count":7},{"method":"POST","count":1}],"distinct_ports_total":17,"top_paths":[{"path":"/","count":5,"ports":5},{"path":"/ipp","count":1,"ports":1},{"path":"/v2/","count":1,"ports":1},{"path":"/jmx?qry=Hadoop:service=NameNode,name=NameNodeInfo","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"147","notable":false},{"name":"Content-Type","value":"application/ipp","notable":true},{"name":"Host","value":"<HONEYPOT>:631","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-06T22:52:38.367161+00:00"}