{"ip":"20.150.195.42","total_events":10,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"255 bytes sent","bytes_sent":255,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T08:55:17","last_seen":"2026-10-05T17:58:50","events_24h":0,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":139,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T04:04:20","last_seen":"2026-10-06T04:04:20","recent":[{"timestamp":"2026-10-06T04:04:20","port":139,"src_port":40819,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_139\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133390a","sni":"","session":"b131f423-0242-4d5a-a37e-8e02937ab257","bytes_in":25,"source_verified":false,"enriched":{"digest":"c6b7de44939720a9","strings":["MGLNDD_<HONEYPOT>_139"]}}]},"top_ports":[{"port":1311,"proto":"tcp","label":"","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":8880,"proto":"tcp","label":"","count":1},{"port":5093,"proto":"tcp","label":"","count":1},{"port":8181,"proto":"tcp","label":"","count":1},{"port":4545,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":11211,"proto":"tcp","label":"Memcached","count":1},{"port":4443,"proto":"tcp","label":"","count":1},{"port":8889,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-28","count":1},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":2},{"date":"2026-10-02","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T17:58:50","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"dbe99053-49e0-4c12-b1bc-e827a6fcb2a7","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-10-02T16:44:19","port":8880,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8880\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838300a","method":"","user_agent":"","ja3":"","session":"40ea53d6-30a3-48fc-bb41-cd4094350163","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"1c9a37bd34cce390","strings":["MGLNDD_<HONEYPOT>_8880"]}},{"timestamp":"2026-09-30T04:59:43","port":11211,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11211\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313231310a","method":"","user_agent":"","ja3":"","session":"5c5e2cda-a066-4669-a853-91ff7524f5ac","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"c7d4106ac182a482","strings":["MGLNDD_<HONEYPOT>_11211"]}},{"timestamp":"2026-09-30T03:10:34","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343434330a","method":"","user_agent":"","ja3":"","session":"485e3744-9109-49e3-bda5-74129971aded","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"749ba4cf4d0a5648","strings":["MGLNDD_<HONEYPOT>_4443"]}},{"timestamp":"2026-09-29T22:21:49","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"9b4d5335-845d-420a-a9b7-0e70ff3bd4da","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-28T00:05:01","port":8889,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8889\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838390a","method":"","user_agent":"","ja3":"","session":"e0d1dd12-c23b-4f69-a65e-b5b7044a424d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"de850e283b820234","strings":["MGLNDD_<HONEYPOT>_8889"]}},{"timestamp":"2026-09-26T23:08:00","port":8181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383138310a","method":"","user_agent":"","ja3":"","session":"85483e86-be16-45e8-b614-8c2396c8a5fe","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"2f59c79da2fc8a42","strings":["MGLNDD_<HONEYPOT>_8181"]}},{"timestamp":"2026-09-20T06:15:27","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"2634474f-b2b6-4d69-b01d-459377b05a5b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-19T19:13:58","port":1311,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1311\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313331310a","method":"","user_agent":"","ja3":"","session":"7cf87d60-13b3-4607-9308-931b174d8148","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"d84753717ed087e5","strings":["MGLNDD_<HONEYPOT>_1311"]}},{"timestamp":"2026-09-16T08:55:17","port":4545,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4545\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343534350a","method":"","user_agent":"","ja3":"","session":"c2c9ca55-c4e2-4f74-b20d-2b0ffd60abf2","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"f90297cb12896aa2","strings":["MGLNDD_<HONEYPOT>_4545"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-06T23:40:59.133463+00:00"}