{"ip":"20.14.94.44","total_events":12,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"309 bytes sent","bytes_sent":309,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T12:37:20","last_seen":"2026-10-02T20:09:20","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":5060,"events":1},{"port":9060,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T12:15:10","last_seen":"2026-10-05T16:26:05","recent":[{"timestamp":"2026-10-05T16:26:05","port":9060,"src_port":34490,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","sni":"","session":"4914971f-a172-4532-ac4c-6e774a616654","bytes_in":27,"source_verified":false,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}},{"timestamp":"2026-10-05T12:15:10","port":5060,"src_port":48289,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_5060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353036300a","sni":"","session":"55fcf6d0-c950-40aa-a734-07a270948075","bytes_in":25,"source_verified":false,"enriched":{"digest":"e9e2d1bd8d8b089c","strings":["MGLNDD_<HONEYPOT>_5060"]}}]},"top_ports":[{"port":8081,"proto":"tcp","label":"","count":1},{"port":1311,"proto":"tcp","label":"","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":5181,"proto":"tcp","label":"","count":1},{"port":9060,"proto":"tcp","label":"","count":1},{"port":5938,"proto":"tcp","label":"","count":1},{"port":8333,"proto":"tcp","label":"Bitcoin","count":1},{"port":11211,"proto":"tcp","label":"Memcached","count":1},{"port":4443,"proto":"tcp","label":"","count":1},{"port":55554,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-02","count":1}],"recent_events":[{"timestamp":"2026-10-02T20:09:20","port":8333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383333330a","method":"","user_agent":"","ja3":"","session":"0e94dc0b-0189-4cb5-a392-f4ef3804be18","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"0c8f3d85c9b5f804","strings":["MGLNDD_<HONEYPOT>_8333"]}},{"timestamp":"2026-10-01T20:54:49","port":5938,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5938\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353933380a","method":"","user_agent":"","ja3":"","session":"0916f512-dac9-4597-a0be-361908fd52fe","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"0ab43d27590d13a3","strings":["MGLNDD_<HONEYPOT>_5938"]}},{"timestamp":"2026-09-28T04:59:01","port":55554,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_55554\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f35353535340a","method":"","user_agent":"","ja3":"","session":"746f25d4-f9db-4b1c-aac2-e4d4b63a4eb4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"f69c5e1365afd28a","strings":["MGLNDD_<HONEYPOT>_55554"]}},{"timestamp":"2026-09-27T02:52:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_80\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38300a","method":"","user_agent":"","ja3":"","session":"71596c20-65c8-4b7a-aaec-7653c24d05da","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"0296647ad3680a85","strings":["MGLNDD_<HONEYPOT>_80"]}},{"timestamp":"2026-09-26T12:51:05","port":5181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353138310a","method":"","user_agent":"","ja3":"","session":"b32cc14a-6ea8-4c9c-9390-a5c98c4d781e","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"a3e66ac6e1744520","strings":["MGLNDD_<HONEYPOT>_5181"]}},{"timestamp":"2026-09-25T05:20:35","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"859905de-50d1-4db6-a04a-6a2d27bfec07","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}},{"timestamp":"2026-09-23T00:15:27","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6379\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363337390a","method":"","user_agent":"","ja3":"","session":"fa734df4-d303-42ca-9f8f-63e879bc9e79","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":5,"enriched":{"digest":"c527d5681f7b683c","strings":["MGLNDD_<HONEYPOT>_6379"]}},{"timestamp":"2026-09-22T08:30:45","port":11211,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11211\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313231310a","method":"","user_agent":"","ja3":"","session":"b9c5ba68-b358-4f61-b03c-cb13dda7a47a","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"c7d4106ac182a482","strings":["MGLNDD_<HONEYPOT>_11211"]}},{"timestamp":"2026-09-22T05:08:20","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"1ac98b24-f88b-4e92-a113-95c64946bc4d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-18T21:45:22","port":1311,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1311\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313331310a","method":"","user_agent":"","ja3":"","session":"f780bfb6-1a23-4492-b287-0ce8721b87c0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"d84753717ed087e5","strings":["MGLNDD_<HONEYPOT>_1311"]}}],"http_methods":[],"distinct_ports_total":12,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:49:21.780610+00:00"}