{"ip":"20.102.113.3","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"209 bytes sent","bytes_sent":209,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T15:12:02","last_seen":"2026-10-05T11:02:28","events_24h":1,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":23,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T13:44:04","last_seen":"2026-10-05T13:44:04","recent":[{"timestamp":"2026-10-05T13:44:04","port":23,"src_port":35434,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_23\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32330a","sni":"","session":"4040ebee-5bc2-4aa2-bf6c-4c610916ffa1","bytes_in":24,"source_verified":false,"enriched":{"digest":"1515f0e7b77b4728","strings":["MGLNDD_<HONEYPOT>_23"]}}]},"top_ports":[{"port":9990,"proto":"tcp","label":"","count":1},{"port":8880,"proto":"tcp","label":"","count":1},{"port":10000,"proto":"tcp","label":"Webmin","count":1},{"port":1414,"proto":"tcp","label":"","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":8333,"proto":"tcp","label":"Bitcoin","count":1},{"port":9529,"proto":"tcp","label":"","count":1},{"port":8889,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-23","count":1},{"date":"2026-09-25","count":1},{"date":"2026-10-02","count":1},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T11:02:28","port":8333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383333330a","method":"","user_agent":"","ja3":"","session":"584304f7-7f87-4745-8e2f-cf9d5683b579","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"0c8f3d85c9b5f804","strings":["MGLNDD_<HONEYPOT>_8333"]}},{"timestamp":"2026-10-04T10:56:45","port":8880,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8880\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838300a","method":"","user_agent":"","ja3":"","session":"af3d0786-1ea9-49c8-9add-6583b5f4036a","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"1c9a37bd34cce390","strings":["MGLNDD_<HONEYPOT>_8880"]}},{"timestamp":"2026-10-03T05:47:04","port":8889,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8889\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838390a","method":"","user_agent":"","ja3":"","session":"47da14a8-cc73-4521-8547-1820c9e4858c","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"de850e283b820234","strings":["MGLNDD_<HONEYPOT>_8889"]}},{"timestamp":"2026-10-02T13:00:55","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"850c8de2-b31a-4bcc-92aa-c2ed0966d03e","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-25T07:33:11","port":1414,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1414\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313431340a","method":"","user_agent":"","ja3":"","session":"e0d4062c-96c9-4395-9a75-8a2608436121","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"be2331fdf69dff81","strings":["MGLNDD_<HONEYPOT>_1414"]}},{"timestamp":"2026-09-23T09:57:48","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"8af0a9b1-e351-4f0f-83ef-09520eb54bec","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-09-20T07:26:52","port":9529,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9529\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393532390a","method":"","user_agent":"","ja3":"","session":"ee65f09f-cfaa-404b-955c-dccf68f5d418","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"b4354cbb0f562919","strings":["MGLNDD_<HONEYPOT>_9529"]}},{"timestamp":"2026-09-19T15:12:02","port":10000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10000\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303030300a","method":"","user_agent":"","ja3":"","session":"9d920709-42e0-4d5d-aabc-8025e4beb0aa","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"c9a733fcff9a40bb","strings":["MGLNDD_<HONEYPOT>_10000"]}}],"http_methods":[],"distinct_ports_total":8,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T18:51:40.505611+00:00"}