{"ip":"20.14.76.20","total_events":15,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,085 bytes sent","bytes_sent":1085,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T17:55:49","last_seen":"2026-10-06T05:32:39","events_24h":0,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":4118,"proto":"tcp","label":"","count":2},{"port":8980,"proto":"tcp","label":"","count":2},{"port":9443,"proto":"tcp","label":"","count":2},{"port":444,"proto":"tcp","label":"","count":2},{"port":1911,"proto":"tcp","label":"","count":2},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":2638,"proto":"tcp","label":"","count":1},{"port":953,"proto":"tcp","label":"","count":1},{"port":115,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6061},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-16","count":2},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-28","count":1},{"date":"2026-09-30","count":2},{"date":"2026-10-01","count":2},{"date":"2026-10-02","count":1},{"date":"2026-10-04","count":2},{"date":"2026-10-05","count":1},{"date":"2026-10-06","count":2}],"recent_events":[{"timestamp":"2026-10-06T05:32:39","port":8980,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"6c68da22-8840-4895-90fb-a6e6ff43608d","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-10-06T05:32:39","port":8980,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8980\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383938300a","method":"","user_agent":"","ja3":"","session":"b2566688-e6bf-405f-880d-bf4f922832e0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"61432743ac1a4b81","strings":["MGLNDD_<HONEYPOT>_8980"]}},{"timestamp":"2026-10-05T20:09:23","port":2638,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2638\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323633380a","method":"","user_agent":"","ja3":"","session":"ce798f18-bfba-4d74-8940-d51c0f90ad22","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"a011082029d5c560","strings":["MGLNDD_<HONEYPOT>_2638"]}},{"timestamp":"2026-10-04T09:07:45","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4118\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343131380a","method":"","user_agent":"","ja3":"","session":"c30a6e7f-2dc4-430a-8582-3d2e57328c39","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"3298a42592e8be0d","strings":["MGLNDD_<HONEYPOT>_4118"]}},{"timestamp":"2026-10-04T09:07:44","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"b3ccadf5-89da-47d1-9146-00f4b46b6e2d","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":11},{"timestamp":"2026-10-02T19:58:40","port":115,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_115\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131350a","method":"","user_agent":"","ja3":"","session":"b9a5af21-02c5-4844-a483-662c0beee855","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"7f5ab1dee1c728d8","strings":["MGLNDD_<HONEYPOT>_115"]}},{"timestamp":"2026-10-01T23:37:17","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"4dd52e81-ccc6-4c79-8035-b229d27fea38","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}},{"timestamp":"2026-10-01T23:37:16","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"8bfad988-2ded-4bd2-ae9d-40460e08bff5","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":76},{"timestamp":"2026-09-30T09:38:57","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"bb2f023d-c5f9-4a84-b7b8-c3e9f0f96f66","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":76},{"timestamp":"2026-09-30T09:38:57","port":444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_444\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3434340a","method":"","user_agent":"","ja3":"","session":"d3ee8836-9217-4cbf-a5bd-9de0b9a3bc87","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"3b5dfc19c77b0a19","strings":["MGLNDD_<HONEYPOT>_444"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-10-08T12:09:10.791807+00:00"}