{"ip":"20.102.109.122","total_events":25,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"21+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 21 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"647 bytes sent","bytes_sent":647,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T03:37:55","last_seen":"2026-10-05T00:00:29","events_24h":1,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":1400,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T15:40:55","last_seen":"2026-10-05T15:40:55","recent":[{"timestamp":"2026-10-05T15:40:55","port":1400,"src_port":48985,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_1400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313430300a","sni":"","session":"f912653d-bf5d-4f3f-8a93-8c40180e24b7","bytes_in":27,"source_verified":false,"enriched":{"digest":"6c961e28437e9eaf","strings":["MGLNDD_<HONEYPOT>_1400"]}}]},"top_ports":[{"port":8081,"proto":"tcp","label":"","count":3},{"port":8086,"proto":"tcp","label":"InfluxDB","count":2},{"port":8222,"proto":"tcp","label":"","count":2},{"port":4331,"proto":"tcp","label":"","count":1},{"port":9529,"proto":"tcp","label":"","count":1},{"port":5351,"proto":"tcp","label":"","count":1},{"port":11211,"proto":"tcp","label":"Memcached","count":1},{"port":8333,"proto":"tcp","label":"Bitcoin","count":1},{"port":15001,"proto":"tcp","label":"","count":1},{"port":88,"proto":"tcp","label":"","count":1},{"port":123,"proto":"tcp","label":"NTP","count":1},{"port":3391,"proto":"tcp","label":"","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":161,"proto":"tcp","label":"SNMP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-26","count":2},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":2},{"date":"2026-09-04","count":1},{"date":"2026-09-08","count":3},{"date":"2026-09-09","count":1},{"date":"2026-09-11","count":2},{"date":"2026-09-14","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-28","count":2},{"date":"2026-10-02","count":1},{"date":"2026-10-04","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T00:00:29","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_80\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38300a","method":"","user_agent":"","ja3":"","session":"18f13b94-da35-438a-ab0b-4a20e802ca32","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":14,"enriched":{"digest":"0296647ad3680a85","strings":["MGLNDD_<HONEYPOT>_80"]}},{"timestamp":"2026-10-04T06:44:03","port":8086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8086\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038360a","method":"","user_agent":"","ja3":"","session":"38a495eb-5300-401c-b736-503f4e9c6c8f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"d593dd6d23410c6f","strings":["MGLNDD_<HONEYPOT>_8086"]}},{"timestamp":"2026-10-02T11:26:00","port":123,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_123\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3132330a","method":"","user_agent":"","ja3":"","session":"7eeccbb4-293c-46bb-80e1-388c89d7b999","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"b405ee720dc0ae95","strings":["MGLNDD_<HONEYPOT>_123"]}},{"timestamp":"2026-09-28T11:20:47","port":11211,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11211\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313231310a","method":"","user_agent":"","ja3":"","session":"efcecb03-b5f1-4850-b3db-1a8972ec1482","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":14,"enriched":{"digest":"c7d4106ac182a482","strings":["MGLNDD_<HONEYPOT>_11211"]}},{"timestamp":"2026-09-28T05:16:03","port":1212,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1212\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313231320a","method":"","user_agent":"","ja3":"","session":"622e659e-91d5-4ff5-a4a0-edba5462c8cc","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"d9ba7c28a4ff80be","strings":["MGLNDD_<HONEYPOT>_1212"]}},{"timestamp":"2026-09-24T21:51:15","port":18245,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18245\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234350a","method":"","user_agent":"","ja3":"","session":"aace93e7-fdc7-40a3-a760-bb3061c0dec7","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"3f43707931f767b4","strings":["MGLNDD_<HONEYPOT>_18245"]}},{"timestamp":"2026-09-20T02:57:14","port":8040,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8040\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383034300a","method":"","user_agent":"","ja3":"","session":"ef5cf91d-ef75-417c-b83b-bbe58c681792","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"5b54819c2aed193d","strings":["MGLNDD_<HONEYPOT>_8040"]}},{"timestamp":"2026-09-19T09:54:07","port":161,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_161\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136310a","method":"","user_agent":"","ja3":"","session":"302617d8-8697-409f-b96a-bb65aaeb17eb","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"70f4c7cf4e0b75fb","strings":["MGLNDD_<HONEYPOT>_161"]}},{"timestamp":"2026-09-18T15:44:01","port":5351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335310a","method":"","user_agent":"","ja3":"","session":"d6ae7f70-8f25-4ad6-824b-b53485a6cfc9","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"e158939d534ced87","strings":["MGLNDD_<HONEYPOT>_5351"]}},{"timestamp":"2026-09-14T06:58:38","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"2397c8da-9267-4212-9c6c-8143ba89c737","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}}],"http_methods":[],"distinct_ports_total":21,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T23:10:55.946947+00:00"}