{"ip":"20.106.52.102","total_events":23,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"763 bytes sent","bytes_sent":763,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T21:31:28","last_seen":"2026-10-04T20:48:00","events_24h":2,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":1900,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T15:10:53","last_seen":"2026-10-05T15:10:53","recent":[{"timestamp":"2026-10-05T15:10:53","port":1900,"src_port":41499,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHost:239.255.255.250:1900\r\nST:upnp:rootdevice\r\nMan:\"ssdp:discover\"\r\nMX:3\r\n\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a486f73743a3233392e3235352e3235352e3235303a313930300d0a53543a75706e703a726f6f746465766963650d0a4d616e3a22737364703a646973636f766572220d0a4d583a330d0a0d0a0d0a","sni":"","session":"13e6bbb1-c30f-430b-9d7f-18edba185a49","bytes_in":99,"source_verified":false,"enriched":{"digest":"a79d7ed53f941f3b","strings":["M-SEARCH * HTTP/1.1","Host:239.255.255.250:1900","ST:upnp:rootdevice","Man:\"ssdp:discover\"","MX:3"],"iocs":{"ips":["239.255.255.250"]}}}]},"top_ports":[{"port":9002,"proto":"tcp","label":"","count":2},{"port":2304,"proto":"tcp","label":"","count":2},{"port":69,"proto":"tcp","label":"","count":2},{"port":118,"proto":"tcp","label":"","count":2},{"port":60001,"proto":"tcp","label":"","count":2},{"port":4433,"proto":"tcp","label":"","count":2},{"port":989,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":7002,"proto":"tcp","label":"","count":1},{"port":9160,"proto":"tcp","label":"","count":1},{"port":8098,"proto":"tcp","label":"","count":1},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1},{"port":2049,"proto":"tcp","label":"NFS","count":1},{"port":4848,"proto":"tcp","label":"","count":1},{"port":6667,"proto":"tcp","label":"IRC","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6048},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-24","count":5},{"date":"2026-09-27","count":5},{"date":"2026-09-28","count":3},{"date":"2026-09-29","count":2},{"date":"2026-09-30","count":2},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":2}],"recent_events":[{"timestamp":"2026-10-04T20:48:00","port":60001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"77195cb2-2b7d-4d9f-a9fa-13fc6118a3e1","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-04T20:48:00","port":60001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_60001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f36303030310a","method":"","user_agent":"","ja3":"","session":"6dcd802a-ed98-4b3a-85b4-e3611e574b82","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":13,"enriched":{"digest":"ed4d29b45f89b7e1","strings":["MGLNDD_<HONEYPOT>_60001"]}},{"timestamp":"2026-10-03T20:04:27","port":6667,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6667\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363636370a","method":"","user_agent":"","ja3":"","session":"592dbd3b-8a34-467d-befa-89dcd9ec334a","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"8d5ff080cb602e8b","strings":["MGLNDD_<HONEYPOT>_6667"]}},{"timestamp":"2026-09-30T19:37:07","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"86d0e77b-db98-4d3d-98a5-8d84a53bcbfe","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-30T19:37:07","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_989\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938390a","method":"","user_agent":"","ja3":"","session":"4fe842a6-d8b0-421c-86f7-7b363c8bde13","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"25b5023164b356a8","strings":["MGLNDD_<HONEYPOT>_989"]}},{"timestamp":"2026-09-29T22:28:28","port":4848,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4848\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343834380a","method":"","user_agent":"","ja3":"","session":"c37f98c6-82fd-4971-9954-925ae8852332","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"878e9ce5cb116538","strings":["MGLNDD_<HONEYPOT>_4848"]}},{"timestamp":"2026-09-29T12:15:23","port":118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_118\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131380a","method":"","user_agent":"","ja3":"","session":"47f160e2-41b1-4b4e-9d3e-58c73dcdfea9","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"04defdb110368e3d","strings":["MGLNDD_<HONEYPOT>_118"]}},{"timestamp":"2026-09-28T15:33:08","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3128\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333132380a","method":"","user_agent":"","ja3":"","session":"77d10046-8115-4a7c-abd0-e8591b82a532","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"f2dd72b325ce9695","strings":["MGLNDD_<HONEYPOT>_3128"]}},{"timestamp":"2026-09-28T07:37:32","port":69,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_69\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f36390a","method":"","user_agent":"","ja3":"","session":"447f6660-0c92-4774-a5b8-0fc81761df0f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"dd453e2efce8c061","strings":["MGLNDD_<HONEYPOT>_69"]}},{"timestamp":"2026-09-28T07:37:31","port":69,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"74658c78-1783-4c91-aae0-53b3b21ad7e6","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":15,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T19:36:51.390550+00:00"}