{"ip":"20.150.195.48","total_events":15,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"381 bytes sent","bytes_sent":381,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T18:10:49","last_seen":"2026-10-06T09:07:20","events_24h":1,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":8088,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-07T01:29:37","last_seen":"2026-10-07T01:29:37","recent":[{"timestamp":"2026-10-07T01:29:37","port":8088,"src_port":56817,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","sni":"","session":"ff63c2a4-a9ee-4c09-8413-6154fb032994","bytes_in":27,"source_verified":false,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}}]},"top_ports":[{"port":25,"proto":"tcp","label":"SMTP","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":8084,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":5938,"proto":"tcp","label":"","count":1},{"port":8181,"proto":"tcp","label":"","count":1},{"port":2375,"proto":"tcp","label":"Docker","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":623,"proto":"tcp","label":"","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1},{"port":4332,"proto":"tcp","label":"","count":1},{"port":8889,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-14","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":1},{"date":"2026-10-01","count":1},{"date":"2026-10-02","count":1},{"date":"2026-10-04","count":1},{"date":"2026-10-06","count":1}],"recent_events":[{"timestamp":"2026-10-06T09:07:20","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","ja3":"","session":"c056fb1e-27a2-4bed-bd93-0560abcc0059","seq":1,"duration_ms":58,"bytes_in":24,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-10-04T12:10:18","port":5938,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5938\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353933380a","method":"","user_agent":"","ja3":"","session":"0105982a-318a-444f-8c1f-cdf520b76c3a","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"0ab43d27590d13a3","strings":["MGLNDD_<HONEYPOT>_5938"]}},{"timestamp":"2026-10-02T05:03:54","port":8181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383138310a","method":"","user_agent":"","ja3":"","session":"b69b4861-bda3-4253-8ac7-ef4dd01ad41f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"2f59c79da2fc8a42","strings":["MGLNDD_<HONEYPOT>_8181"]}},{"timestamp":"2026-10-01T23:46:01","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","ja3":"","session":"423c99f5-41ea-4623-9cf4-01c689131968","seq":1,"duration_ms":55,"bytes_in":24,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-09-28T21:06:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_80\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38300a","method":"","user_agent":"","ja3":"","session":"4ca5fe56-c8b7-4e54-bb56-f794205f72e4","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"0296647ad3680a85","strings":["MGLNDD_<HONEYPOT>_80"]}},{"timestamp":"2026-09-27T17:58:51","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"e555c3c1-0510-4ce5-9316-c55bee161039","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":13,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-09-26T23:49:58","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"b39b4fe1-6127-497a-a157-5aac6320ceb6","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}},{"timestamp":"2026-09-24T02:20:11","port":2375,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2375\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323337350a","method":"","user_agent":"","ja3":"","session":"3b55a75a-4719-42a1-8ac8-ada725b530bf","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"26b4401efba6dd21","strings":["MGLNDD_<HONEYPOT>_2375"]}},{"timestamp":"2026-09-14T12:14:35","port":8889,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8889\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838390a","method":"","user_agent":"","ja3":"","session":"e0413b15-feb8-45fb-bca1-f114da0dc200","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"de850e283b820234","strings":["MGLNDD_<HONEYPOT>_8889"]}},{"timestamp":"2026-09-13T03:55:55","port":8084,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8084\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038340a","method":"","user_agent":"","ja3":"","session":"de87943c-0185-4bf6-a90b-1f5c1565d7be","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"59979471e5607f55","strings":["MGLNDD_<HONEYPOT>_8084"]}}],"http_methods":[],"distinct_ports_total":14,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-07T02:48:09.287505+00:00"}