{"ip":"20.14.92.231","total_events":16,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,005 bytes sent","bytes_sent":1005,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-27T11:32:59","last_seen":"2026-09-15T00:03:58","events_24h":0,"events_7d":1,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":4911,"proto":"tcp","label":"","count":2},{"port":1270,"proto":"tcp","label":"","count":2},{"port":7337,"proto":"tcp","label":"","count":2},{"port":162,"proto":"tcp","label":"SNMP","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":28017,"proto":"tcp","label":"","count":1},{"port":8945,"proto":"tcp","label":"","count":1},{"port":5902,"proto":"tcp","label":"","count":1},{"port":47808,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":6488},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-27","count":2},{"date":"2026-08-30","count":1},{"date":"2026-09-01","count":3},{"date":"2026-09-03","count":2},{"date":"2026-09-04","count":2},{"date":"2026-09-05","count":2},{"date":"2026-09-06","count":1},{"date":"2026-09-09","count":2},{"date":"2026-09-15","count":1}],"recent_events":[{"timestamp":"2026-09-15T00:03:58","port":47808,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_47808\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f34373830380a","method":"","user_agent":"","ja3":"","session":"205a456a-878e-475f-847b-6dfda96ad6b2","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"80cc8e21fd37eeff","strings":["MGLNDD_<HONEYPOT>_47808"]}},{"timestamp":"2026-09-09T13:13:29","port":1433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1433\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313433330a","method":"","user_agent":"","ja3":"","session":"c1f3a84a-df23-4a24-b3df-2b9b70ae8c1f","seq":1,"duration_ms":10,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"1cd1e6467fdbf487","strings":["MGLNDD_<HONEYPOT>_1433"]}},{"timestamp":"2026-09-09T11:06:42","port":5902,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5902\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353930320a","method":"","user_agent":"","ja3":"","session":"941a3e9e-d3ff-474a-9d90-d25094d28324","seq":1,"duration_ms":9,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"aca496cccb48c981","strings":["MGLNDD_<HONEYPOT>_5902"]}},{"timestamp":"2026-09-06T06:45:28","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"info\n","payload_hex":"696e666f0a","method":"","user_agent":"","ja3":"","session":"bce24940-afbb-4da3-a149-ab0ae6967c76","seq":1,"duration_ms":10,"bytes_in":5,"bytes_out":5,"enriched":{"digest":"886ead46232ac934","strings":["info"]}},{"timestamp":"2026-09-05T03:17:32","port":7337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7337\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373333370a","method":"","user_agent":"","ja3":"","session":"f850eb79-504e-4108-a877-64f8c1bdea2b","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"23b4de2af735090c","strings":["MGLNDD_<HONEYPOT>_7337"]}},{"timestamp":"2026-09-05T03:17:32","port":7337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"19b03482-3f40-412b-8cc6-e18c0dadeb4e","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-04T10:54:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8080\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038300a","method":"","user_agent":"","ja3":"","session":"c352bfe0-5c24-4c8a-aeb5-8036b11adf54","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"771a62c3980bb829","strings":["MGLNDD_<HONEYPOT>_8080"]}},{"timestamp":"2026-09-04T10:54:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"2d172502-ca5e-422f-bb4b-e48679c7ae9a","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-03T19:37:52","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4911\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343931310a","method":"","user_agent":"","ja3":"","session":"c384a02e-a4f2-4fef-91f1-94a05d8f73ac","seq":1,"duration_ms":10,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"7844300940c47106","strings":["MGLNDD_<HONEYPOT>_4911"]}},{"timestamp":"2026-09-03T19:37:51","port":4911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"a4825600-287e-40d9-b691-59fa32afaf13","seq":1,"duration_ms":10,"bytes_in":513,"bytes_out":12,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-21T13:31:02.799414+00:00"}