{"ip":"20.121.120.111","total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"156 bytes sent","bytes_sent":156,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-18T23:35:35","last_seen":"2026-09-30T21:59:11","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":22,"events":1},{"port":5222,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T13:11:59","last_seen":"2026-10-05T14:11:24","recent":[{"timestamp":"2026-10-05T14:11:24","port":5222,"src_port":47154,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_5222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353232320a","sni":"","session":"e7ebfac7-d82f-4a8a-8277-6749d0dcd753","bytes_in":25,"source_verified":false,"enriched":{"digest":"dabac7026b711c14","strings":["MGLNDD_<HONEYPOT>_5222"]}},{"timestamp":"2026-10-05T13:11:59","port":22,"src_port":45238,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_22\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32320a","sni":"","session":"8492ce35-ebca-46e2-b3a1-681dff21aaa1","bytes_in":24,"source_verified":false,"enriched":{"digest":"2b490ed2b8e38cae","strings":["MGLNDD_<HONEYPOT>_22"]}}]},"top_ports":[{"port":4333,"proto":"tcp","label":"","count":1},{"port":5061,"proto":"tcp","label":"SIPS","count":1},{"port":8222,"proto":"tcp","label":"","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":771,"proto":"tcp","label":"","count":1},{"port":10443,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-18","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-28","count":2},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":1}],"recent_events":[{"timestamp":"2026-09-30T21:59:11","port":4333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333330a","method":"","user_agent":"","ja3":"","session":"fe897cf0-0266-43cb-92c2-4d23ffc6f0c4","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"cd717062b6876d01","strings":["MGLNDD_<HONEYPOT>_4333"]}},{"timestamp":"2026-09-29T08:49:48","port":2362,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2362\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323336320a","method":"","user_agent":"","ja3":"","session":"b68120e7-185a-4ee5-8c34-c039fc6d6583","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"f7431096076cbeeb","strings":["MGLNDD_<HONEYPOT>_2362"]}},{"timestamp":"2026-09-28T22:21:22","port":8222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383232320a","method":"","user_agent":"","ja3":"","session":"017dd308-fdc2-4c1d-846c-7277052c5c69","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"0e8cf1640a91339a","strings":["MGLNDD_<HONEYPOT>_8222"]}},{"timestamp":"2026-09-28T08:37:40","port":771,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_771\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3737310a","method":"","user_agent":"","ja3":"","session":"e24d50c6-4a36-4900-a722-eb79e053a9db","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"02612c44125dd412","strings":["MGLNDD_<HONEYPOT>_771"]}},{"timestamp":"2026-09-21T15:42:36","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"8939a529-5722-437e-8472-3fbd97babab2","seq":1,"duration_ms":104,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-09-18T23:35:35","port":5061,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5061\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353036310a","method":"","user_agent":"","ja3":"","session":"a2fde22f-696d-41c4-b991-38956b985a33","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"2eb0e2ff18ccaaae","strings":["MGLNDD_<HONEYPOT>_5061"]}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:50:05.904955+00:00"}