{"ip":"172.172.161.152","total_events":11,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"283 bytes sent","bytes_sent":283,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T05:08:27","last_seen":"2026-10-05T11:37:43","events_24h":1,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":9433,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T13:27:43","last_seen":"2026-10-05T13:27:43","recent":[{"timestamp":"2026-10-05T13:27:43","port":9433,"src_port":45630,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_9433\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393433330a","sni":"","session":"dcd0650f-f196-4b05-91ed-d40ce257c0eb","bytes_in":26,"source_verified":false,"enriched":{"digest":"a2fb35a7c358636e","strings":["MGLNDD_<HONEYPOT>_9433"]}}]},"top_ports":[{"port":8081,"proto":"tcp","label":"","count":1},{"port":5353,"proto":"tcp","label":"","count":1},{"port":8104,"proto":"tcp","label":"","count":1},{"port":161,"proto":"tcp","label":"SNMP","count":1},{"port":5181,"proto":"tcp","label":"","count":1},{"port":1212,"proto":"tcp","label":"","count":1},{"port":8181,"proto":"tcp","label":"","count":1},{"port":8998,"proto":"tcp","label":"","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":5351,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":2},{"date":"2026-09-19","count":2},{"date":"2026-09-20","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-03","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T11:37:43","port":161,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_161\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136310a","method":"","user_agent":"","ja3":"","session":"45d8bcf8-6198-4ef9-b3e5-38a73f540380","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"70f4c7cf4e0b75fb","strings":["MGLNDD_<HONEYPOT>_161"]}},{"timestamp":"2026-10-03T17:57:39","port":2362,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2362\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323336320a","method":"","user_agent":"","ja3":"","session":"88e55aaa-45d1-4351-a8c8-f254866cb76c","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"f7431096076cbeeb","strings":["MGLNDD_<HONEYPOT>_2362"]}},{"timestamp":"2026-10-01T18:43:13","port":5181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353138310a","method":"","user_agent":"","ja3":"","session":"45864b49-ffbc-4bdc-a078-fb577582d2b1","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"a3e66ac6e1744520","strings":["MGLNDD_<HONEYPOT>_5181"]}},{"timestamp":"2026-09-27T07:07:57","port":5351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335310a","method":"","user_agent":"","ja3":"","session":"f0610cff-b245-4d2d-b0cb-fcb1f5ff1fde","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"e158939d534ced87","strings":["MGLNDD_<HONEYPOT>_5351"]}},{"timestamp":"2026-09-26T07:32:36","port":8104,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8104\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383130340a","method":"","user_agent":"","ja3":"","session":"99600c77-a723-46e3-80f0-c1a5af593023","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"e5e02ad15460eb52","strings":["MGLNDD_<HONEYPOT>_8104"]}},{"timestamp":"2026-09-24T17:51:19","port":6066,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6066\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363036360a","method":"","user_agent":"","ja3":"","session":"7c9fcb0c-3c4a-44b8-b5ba-45286e211b5a","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":15,"enriched":{"digest":"6a084a2d85c0db6a","strings":["MGLNDD_<HONEYPOT>_6066"]}},{"timestamp":"2026-09-20T12:21:51","port":1212,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1212\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313231320a","method":"","user_agent":"","ja3":"","session":"76c080cf-9421-4426-ab04-b8c7ec90e31c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"d9ba7c28a4ff80be","strings":["MGLNDD_<HONEYPOT>_1212"]}},{"timestamp":"2026-09-19T01:29:56","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"d7bf5704-134a-4de1-9025-c92781e2dba2","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":15,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}},{"timestamp":"2026-09-19T00:56:47","port":5353,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5353\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335330a","method":"","user_agent":"","ja3":"","session":"46d6f144-bedf-4b80-932d-4578b3138b42","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"a0612689837e5cde","strings":["MGLNDD_<HONEYPOT>_5353"]}},{"timestamp":"2026-09-16T15:08:17","port":8181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383138310a","method":"","user_agent":"","ja3":"","session":"76dce2d2-c1b3-4ac1-8b50-6738054275d0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":15,"enriched":{"digest":"2f59c79da2fc8a42","strings":["MGLNDD_<HONEYPOT>_8181"]}}],"http_methods":[],"distinct_ports_total":11,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T22:22:52.934405+00:00"}