{"ip":"20.12.243.131","data_as_of":"2026-10-26T12:34:17+00:00","observed":true,"total_events":6,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 7 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"447 bytes sent","bytes_sent":447,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-10-16T23:25:47","last_seen":"2026-10-26T03:10:23","events_24h":0,"events_7d":5,"interactive_sessions":7,"interactive_sessions_24h":1,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"smtp","sessions":2},{"protocol":"http","sessions":1},{"protocol":"s7comm","sessions":1},{"protocol":"winbox","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":7,"first_seen":"2026-10-17T00:00:08","last_seen":"2026-10-26T03:10:23","verdicts":[{"verdict":"scan","sessions":6},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smtp@3.8.6","sessions":2},{"persona":"mikrotik@6.49.10","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":1},{"persona":"ics@Siemens S7-1200","sessions":1}],"services":[{"protocol":"smtp","port":587,"sessions":2},{"protocol":"http","port":443,"sessions":1},{"protocol":"s7comm","port":102,"sessions":1},{"protocol":"winbox","port":8291,"sessions":1},{"protocol":"tcp","port":989,"sessions":1},{"protocol":"tcp","port":5660,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":6}]},"top_ports":[{"port":32400,"proto":"tcp","label":"","count":2,"sessions":0},{"port":587,"proto":"tcp","label":"SMTP","count":0,"sessions":2},{"port":7002,"proto":"tcp","label":"","count":1,"sessions":0},{"port":520,"proto":"tcp","label":"","count":1,"sessions":0},{"port":45000,"proto":"tcp","label":"","count":1,"sessions":0},{"port":2096,"proto":"tcp","label":"","count":1,"sessions":0},{"port":102,"proto":"tcp","label":"S7COMM","count":0,"sessions":1},{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":1},{"port":989,"proto":"tcp","label":"","count":0,"sessions":1},{"port":5660,"proto":"tcp","label":"","count":0,"sessions":1},{"port":8291,"proto":"tcp","label":"WINBOX","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t10i080600_dafb69683c10_583ba773bd60"],"tls_client_hello":"16030100ee010000ea0303c500f4a557ec900d09225c7c2d55fee2997295d3242a756e1545064acfd7ff772026ff02584889ab36be0dbe5dad1a7fd44a0080d9a1605ef4d8db550764c385110026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020721a5e45363df0c7cb730053fc817e22cc8238942c8307289a4bea1e","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab","8dace756ca50d2b376c065ba937de663"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t10i080600_dafb69683c10_583ba773bd60"],"tls_ja3":["8dace756ca50d2b376c065ba937de663"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3303,"b11cun040_00040016_aa48e2c8":5564,"t10i080600_dafb69683c10_583ba773bd60":0},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-10-16","count":1,"sessions":0},{"date":"2026-10-17","count":0,"sessions":1},{"date":"2026-10-19","count":1,"sessions":1},{"date":"2026-10-21","count":1,"sessions":3},{"date":"2026-10-22","count":0,"sessions":1},{"date":"2026-10-25","count":3,"sessions":0},{"date":"2026-10-26","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-26T03:10:23","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000!\u0002��2\u0007\u0000\u0000\u0000\u0000\u0000\b\u0000\b\u0000\u0001\u0012\u0004\u0011D\u0001\u0000�\t\u0000\u0004\u0000\u0011\u0000\u0001","payload_hex":"0300002102f080320700000000000800080001120411440100ff09000400110001","method":"","user_agent":"","ja3":"","session":"d47d8f87-c110-420b-8aeb-220ce6860eb5-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"03105af85d4c792c","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-26T03:10:22","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0019\u0002��2\u0001\u0000\u0000\u0000\u0000\u0000\b\u0000\u0000�\u0000\u0000\u0001\u0000\u0001\u0001�","payload_hex":"0300001902f08032010000000000080000f0000001000101e0","method":"","user_agent":"","ja3":"","session":"d47d8f87-c110-420b-8aeb-220ce6860eb5-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2af980da11f8f1be","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-26T03:10:21","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0016\u0011�\u0000\u0000\u0000\u0004\u0000�\u0002\u0001\u0000�\u0002\u0001\u0002�\u0001\n","payload_hex":"0300001611e00000000400c1020100c2020102c0010a","method":"","user_agent":"","ja3":"","session":"d47d8f87-c110-420b-8aeb-220ce6860eb5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1a42acaf9034e519","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-25T03:59:03","port":45000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:45000\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"2d029928-054e-4309-9c28-917a60912986","seq":1,"duration_ms":102,"bytes_in":117,"bytes_out":78},{"timestamp":"2026-10-25T00:15:58","port":32400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_32400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f33323430300a","method":"","user_agent":"","ja3":"","session":"2ccbdab5-3bdc-47a5-b14d-577590047e32","seq":1,"duration_ms":65,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"69b665d12e12de8d","strings":["MGLNDD_<HONEYPOT>_32400"]}},{"timestamp":"2026-10-25T00:15:58","port":32400,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"f534da9d-df1f-4393-9404-4570c88b4a60","seq":1,"duration_ms":101,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-21T21:55:49","port":5660,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"8d0c904e-b56e-4db6-bc2b-d67d781cf1e4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:42:52","port":520,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_520\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3532300a","method":"","user_agent":"","ja3":"","session":"e22e7bfe-af83-48f5-9d20-bed825e180a3","seq":1,"duration_ms":77,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"83084d3add49c508","strings":["MGLNDD_<HONEYPOT>_520"]}},{"timestamp":"2026-10-21T11:09:20","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_587\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f3538370a","method":"","user_agent":"","ja3":"","session":"b3064fd9-ef0d-44c7-a99c-6b14c67c0332-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1a703a83367b9f84","strings":["MGLNDD_<HONEYPOT>_587"]},"interactive":true},{"timestamp":"2026-10-21T11:09:20","port":587,"proto":"tcp","app_proto":"smtp","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO\r\n","payload_hex":"45484c4f0d0a","method":"","user_agent":"","ja3":"","session":"8854d6e6-bfff-454a-9e53-1651ff6c78e5-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"87f781591201aca6","label":"SMTP","strings":["EHLO"]},"interactive":true}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:45000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[]}