{"ip":"20.163.9.212","total_events":15,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"380 bytes sent","bytes_sent":380,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T23:25:44","last_seen":"2026-09-15T13:31:33","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":161,"proto":"tcp","label":"SNMP","count":1},{"port":1389,"proto":"tcp","label":"","count":1},{"port":8880,"proto":"tcp","label":"","count":1},{"port":8945,"proto":"tcp","label":"","count":1},{"port":5093,"proto":"tcp","label":"","count":1},{"port":1194,"proto":"tcp","label":"OpenVPN","count":1},{"port":5061,"proto":"tcp","label":"SIPS","count":1},{"port":137,"proto":"tcp","label":"NetBIOS","count":1},{"port":8005,"proto":"tcp","label":"","count":1},{"port":9060,"proto":"tcp","label":"","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":2362,"proto":"tcp","label":"","count":1},{"port":3001,"proto":"tcp","label":"","count":1},{"port":111,"proto":"tcp","label":"RPC","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-26","count":1},{"date":"2026-08-27","count":1},{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":1},{"date":"2026-09-04","count":2},{"date":"2026-09-05","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-14","count":1},{"date":"2026-09-15","count":1}],"recent_events":[{"timestamp":"2026-09-15T13:31:33","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","ja3":"","session":"442d429b-2657-449c-8341-7e83daaf7bf5","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-09-14T18:31:41","port":9060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","method":"","user_agent":"","ja3":"","session":"001f1208-a749-4dc9-b205-d5049b8882f7","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}},{"timestamp":"2026-09-12T11:57:29","port":5061,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5061\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353036310a","method":"","user_agent":"","ja3":"","session":"52f15683-b9de-4b99-b7f6-41cb5fc547ae","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"2eb0e2ff18ccaaae","strings":["MGLNDD_<HONEYPOT>_5061"]}},{"timestamp":"2026-09-06T05:24:54","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_111\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131310a","method":"","user_agent":"","ja3":"","session":"cb7beafd-3228-408f-8f4b-13e914ad18a2","seq":1,"duration_ms":10,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"29242794e9bce34e","strings":["MGLNDD_<HONEYPOT>_111"]}},{"timestamp":"2026-09-05T09:18:44","port":1389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1389\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313338390a","method":"","user_agent":"","ja3":"","session":"4be67e94-f919-409f-b757-e79a3b554989","seq":1,"duration_ms":9,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"846b7cefadd324c8","strings":["MGLNDD_<HONEYPOT>_1389"]}},{"timestamp":"2026-09-04T12:42:12","port":1194,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1194\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313139340a","method":"","user_agent":"","ja3":"","session":"fb1d3af3-ddb0-4368-9f2c-afc98015e2fb","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"0b7bb21eee00c809","strings":["MGLNDD_<HONEYPOT>_1194"]}},{"timestamp":"2026-09-04T09:16:44","port":2362,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2362\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323336320a","method":"","user_agent":"","ja3":"","session":"1c4a89ed-45fa-4910-bc61-61ab7f351d2e","seq":1,"duration_ms":9,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"f7431096076cbeeb","strings":["MGLNDD_<HONEYPOT>_2362"]}},{"timestamp":"2026-09-02T07:54:31","port":8945,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8945\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383934350a","method":"","user_agent":"","ja3":"","session":"996fc906-c2bc-407b-aa18-14e27243ee9d","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"6849680bc8d35e8a","strings":["MGLNDD_<HONEYPOT>_8945"]}},{"timestamp":"2026-09-01T08:33:19","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"3bef2bba-59b0-4ae0-9142-d49d37bc4b54","seq":1,"duration_ms":10,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-01T02:01:59","port":137,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_137\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3133370a","method":"","user_agent":"","ja3":"","session":"de94f45a-9055-4bb5-9e04-931f181715bc","seq":1,"duration_ms":11,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"67c6c25f21993d93","strings":["MGLNDD_<HONEYPOT>_137"]}}],"http_methods":[],"distinct_ports_total":15,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-22T23:40:31.307926+00:00"}