{"ip":"172.190.105.13","total_events":15,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"383 bytes sent","bytes_sent":383,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T11:58:28","last_seen":"2026-10-05T19:46:07","events_24h":2,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5222,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T14:01:33","last_seen":"2026-10-05T14:01:33","recent":[{"timestamp":"2026-10-05T14:01:33","port":5222,"src_port":49308,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_5222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353232320a","sni":"","session":"71fd8744-0bf2-4fce-a0a0-26d655119647","bytes_in":27,"source_verified":false,"enriched":{"digest":"dabac7026b711c14","strings":["MGLNDD_<HONEYPOT>_5222"]}}]},"top_ports":[{"port":8086,"proto":"tcp","label":"InfluxDB","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":554,"proto":"tcp","label":"","count":1},{"port":5093,"proto":"tcp","label":"","count":1},{"port":3790,"proto":"tcp","label":"","count":1},{"port":8005,"proto":"tcp","label":"","count":1},{"port":9060,"proto":"tcp","label":"","count":1},{"port":5938,"proto":"tcp","label":"","count":1},{"port":1414,"proto":"tcp","label":"","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":8983,"proto":"tcp","label":"Solr","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":4443,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1},{"port":8889,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":1},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":1},{"date":"2026-09-23","count":1},{"date":"2026-09-26","count":2},{"date":"2026-09-27","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-02","count":3},{"date":"2026-10-04","count":1},{"date":"2026-10-05","count":2}],"recent_events":[{"timestamp":"2026-10-05T19:46:07","port":3790,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3790\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333739300a","method":"","user_agent":"","ja3":"","session":"dbc3598a-5239-4906-b7b9-c413017c8374","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"63555966e1b6b47f","strings":["MGLNDD_<HONEYPOT>_3790"]}},{"timestamp":"2026-10-05T09:10:48","port":5938,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5938\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353933380a","method":"","user_agent":"","ja3":"","session":"880f6d13-1bd3-413d-82e4-ea8803367571","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"0ab43d27590d13a3","strings":["MGLNDD_<HONEYPOT>_5938"]}},{"timestamp":"2026-10-04T05:27:31","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6379\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363337390a","method":"","user_agent":"","ja3":"","session":"cbf8f944-76bb-4a78-ad2a-0ce1ea6a7a85","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":5,"enriched":{"digest":"c527d5681f7b683c","strings":["MGLNDD_<HONEYPOT>_6379"]}},{"timestamp":"2026-10-02T17:25:23","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343434330a","method":"","user_agent":"","ja3":"","session":"3372d85f-26c7-4150-a8db-d723a51009ca","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"749ba4cf4d0a5648","strings":["MGLNDD_<HONEYPOT>_4443"]}},{"timestamp":"2026-10-02T07:21:34","port":8005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8005\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030350a","method":"","user_agent":"","ja3":"","session":"46a5b1d9-0c61-4095-9d19-131432b50c98","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"68450b1512177080","strings":["MGLNDD_<HONEYPOT>_8005"]}},{"timestamp":"2026-10-02T01:02:25","port":9060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","method":"","user_agent":"","ja3":"","session":"79c9aa29-1804-44de-8699-f5edab31208a","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}},{"timestamp":"2026-10-01T12:20:40","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"e34336c5-c02b-436a-826a-5d298dfbf11d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-27T17:47:33","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"848ea056-d264-4913-b886-82fe228c9fc7","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-09-26T05:50:38","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_80\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38300a","method":"","user_agent":"","ja3":"","session":"be01ea1a-3fa4-46a4-a0f2-f2b29413d069","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"0296647ad3680a85","strings":["MGLNDD_<HONEYPOT>_80"]}},{"timestamp":"2026-09-26T02:23:10","port":1414,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1414\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313431340a","method":"","user_agent":"","ja3":"","session":"f5826c0a-d0a9-45b1-b00d-272092958eb5","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"be2331fdf69dff81","strings":["MGLNDD_<HONEYPOT>_1414"]}}],"http_methods":[],"distinct_ports_total":15,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T23:58:35.891385+00:00"}