{"ip":"135.119.91.156","total_events":15,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["15 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,079 bytes sent","bytes_sent":1079,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T17:04:06","last_seen":"2026-10-03T22:17:59","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5060,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T12:56:28","last_seen":"2026-10-05T12:56:28","recent":[{"timestamp":"2026-10-05T12:56:28","port":5060,"src_port":55421,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"OPTIONS sip:UxxYboya@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 10.5.0.165:55421;branch=FisIpq.5121823410;rport;alias\r\nFrom: sip:NbXSAnKc@10.5.0.165:55421;tag=92488913\r\nTo: sip:RwXgdofZ@<HONEYPOT>\r\nCall-ID: 5554462752@10.5.0.165\r\nCSeq: 1 OPTIONS\r\nContact: sip:HZWYhXRv@10.5.0.165:55421\r\nContent-Length: 0\r\nMax-Forwards: 20\r\nUser-Agent: NzPhQxMk\r\nAccept: text/plain\r\n\r\n","payload_hex":"4f5054494f4e53207369703a55787859626f796140<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f5544502031302e352e302e3136353a35353432313b6272616e63683d4669734970712e353132313832333431303b72706f72743b616c6961730d0a46726f6d3a207369703a4e625853416e4b634031302e352e302e3136353a35353432313b7461673d39323438383931330d0a546f3a207369703a52775867646f665a40<HONEYPOT>0d0a43616c6c2d49443a20353535343436323735324031302e352e302e3136350d0a435365713a2031204f5054494f4e530d0a436f6e746163743a207369703a485a5759685852764031302e352e302e3136353a35353432310d0a436f6e74656e742d4c656e6774683a20300d0a4d61782d466f7277617264733a2032300d0a557365722d4167656e743a204e7a506851784d6b0d0a4163636570743a20746578742f706c61696e0d0a0d0a","sni":"","session":"cc6ddad1-8aee-4ad3-98ae-f3c6fc91683e","bytes_in":368,"source_verified":false,"enriched":{"digest":"2d3f97e2a7e2b364","label":"HTTP","strings":["OPTIONS sip:UxxYboya@<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 10.5.0.165:55421;branch=FisIpq.5121823410;rport;alias","From: sip:NbXSAnKc@10.5.0.165:55421;tag=92488913","To: sip:RwXgdofZ@<HONEYPOT>","Call-ID: 5554462752@10.5.0.165","CSeq: 1 OPTIONS","Contact: sip:HZWYhXRv@10.5.0.165:55421","Content-Length: 0","Max-Forwards: 20","User-Agent: NzPhQxMk"],"iocs":{"ips":["10.5.0.165"],"paths":["/2.0/UDP"]}}}]},"top_ports":[{"port":4911,"proto":"tcp","label":"","count":2},{"port":6666,"proto":"tcp","label":"","count":2},{"port":17990,"proto":"tcp","label":"","count":2},{"port":435,"proto":"tcp","label":"","count":2},{"port":81,"proto":"tcp","label":"","count":2},{"port":1434,"proto":"tcp","label":"MSSQL","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1},{"port":7574,"proto":"tcp","label":"","count":1},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6044},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":2},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":2},{"date":"2026-09-26","count":1},{"date":"2026-09-28","count":5},{"date":"2026-10-01","count":1},{"date":"2026-10-03","count":2}],"recent_events":[{"timestamp":"2026-10-03T22:17:59","port":1434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"ed75fa99-c0f5-4d37-bfd0-748395edaeb0","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-10-03T22:17:59","port":1434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1434\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313433340a","method":"","user_agent":"","ja3":"","session":"e7446d22-c0ca-40b5-bbd4-70583429a8f3","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"554fc18aa7a30632","strings":["MGLNDD_<HONEYPOT>_1434"]}},{"timestamp":"2026-10-01T13:09:23","port":5269,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5269\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353236390a","method":"","user_agent":"","ja3":"","session":"1172ce30-5682-4dbc-a0b5-871d3c8bdd26","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"680f85abd1c8c06b","strings":["MGLNDD_<HONEYPOT>_5269"]}},{"timestamp":"2026-09-28T17:24:41","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"07763a8a-fc09-429e-a371-58121fa1fec4","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":14,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-09-28T17:24:41","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4911\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343931310a","method":"","user_agent":"","ja3":"","session":"4dfa94b0-315a-4b3a-8b75-cd2c8dc6f26f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"7844300940c47106","strings":["MGLNDD_<HONEYPOT>_4911"]}},{"timestamp":"2026-09-28T03:29:24","port":17990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e1b6d21a-dbe9-490c-bb59-a7ccfdaaac00","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-28T03:29:24","port":17990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_17990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31373939300a","method":"","user_agent":"","ja3":"","session":"9ee25135-8846-49f0-b6e4-0b7965e1ea8b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"69a7980084b38b31","strings":["MGLNDD_<HONEYPOT>_17990"]}},{"timestamp":"2026-09-28T02:26:30","port":7574,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7574\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373537340a","method":"","user_agent":"","ja3":"","session":"e4a6b73a-d601-4235-a2ea-6980a14b02df","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"d5e8a548af97f000","strings":["MGLNDD_<HONEYPOT>_7574"]}},{"timestamp":"2026-09-26T00:58:37","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/setup/eureka_info","summary":"","payload_hex":"474554202f73657475702f657572656b615f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"32d19b07-7a02-4a5c-8589-f8cb583100b4","seq":1,"duration_ms":101,"bytes_in":132,"bytes_out":79},{"timestamp":"2026-09-21T00:33:02","port":81,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:81\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"ac572894-290a-4887-83a2-eb4f684ae64c","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":79}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/setup/eureka_info","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-10-05T20:49:39.506211+00:00"}