{"ip":"20.102.105.220","total_events":11,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"286 bytes sent","bytes_sent":286,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T22:52:59","last_seen":"2026-10-05T08:51:28","events_24h":1,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":161,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T17:24:49","last_seen":"2026-10-05T17:24:49","recent":[{"timestamp":"2026-10-05T17:24:49","port":161,"src_port":42883,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_161\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136310a","sni":"","session":"918a22fb-8759-4c14-b0b5-ad0ee7b6d309","bytes_in":26,"source_verified":false,"enriched":{"digest":"70f4c7cf4e0b75fb","strings":["MGLNDD_<HONEYPOT>_161"]}}]},"top_ports":[{"port":9443,"proto":"tcp","label":"","count":2},{"port":8104,"proto":"tcp","label":"","count":1},{"port":8091,"proto":"tcp","label":"","count":1},{"port":9060,"proto":"tcp","label":"","count":1},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":18246,"proto":"tcp","label":"","count":1},{"port":5632,"proto":"tcp","label":"","count":1},{"port":5351,"proto":"tcp","label":"","count":1},{"port":1900,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-25","count":2},{"date":"2026-09-27","count":2},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-03","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T08:51:28","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"a3ec69a3-6188-4c93-98bb-3ff03cf3a702","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-10-03T11:51:02","port":8091,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8091\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383039310a","method":"","user_agent":"","ja3":"","session":"89b110e6-9865-4cdd-ba24-2db131ac4930","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"6ddd0549b0ac091a","strings":["MGLNDD_<HONEYPOT>_8091"]}},{"timestamp":"2026-10-01T00:24:03","port":1900,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1900\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313930300a","method":"","user_agent":"","ja3":"","session":"9840c3ee-3dd3-4c92-b3af-e96781c8565f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"b881120cd57c4aad","strings":["MGLNDD_<HONEYPOT>_1900"]}},{"timestamp":"2026-09-30T16:38:07","port":8104,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8104\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383130340a","method":"","user_agent":"","ja3":"","session":"5fe22d41-6688-4397-b5c7-ffa0b5d44734","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"e5e02ad15460eb52","strings":["MGLNDD_<HONEYPOT>_8104"]}},{"timestamp":"2026-09-29T06:51:13","port":5632,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5632\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353633320a","method":"","user_agent":"","ja3":"","session":"80720b27-5f9e-4316-b676-29870cf35deb","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"1afa0e8fa5e9175c","strings":["MGLNDD_<HONEYPOT>_5632"]}},{"timestamp":"2026-09-27T20:04:14","port":8008,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8008\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030380a","method":"","user_agent":"","ja3":"","session":"3b247e9d-3eb0-4663-80e0-41f65d6c15fc","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"c7734b2476b6d92a","strings":["MGLNDD_<HONEYPOT>_8008"]}},{"timestamp":"2026-09-27T12:00:33","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"b932a875-50c2-4f98-94f9-bfef31fb0dc1","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-09-25T18:43:58","port":18246,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18246\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234360a","method":"","user_agent":"","ja3":"","session":"57f86505-67fd-45ea-b268-dc02420f884c","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":14,"enriched":{"digest":"9698109cd89a1b97","strings":["MGLNDD_<HONEYPOT>_18246"]}},{"timestamp":"2026-09-25T00:16:11","port":2362,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2362\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323336320a","method":"","user_agent":"","ja3":"","session":"9668e241-1378-4b9b-af73-a8cf9627acad","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"f7431096076cbeeb","strings":["MGLNDD_<HONEYPOT>_2362"]}},{"timestamp":"2026-09-24T05:36:54","port":9060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","method":"","user_agent":"","ja3":"","session":"23cbbed9-5882-4f35-8dcb-41f4cda1f9aa","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:50:04.203701+00:00"}