{"ip":"20.168.116.235","total_events":5,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["5 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"127 bytes sent","bytes_sent":127,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T23:03:18","last_seen":"2026-10-05T01:56:30","events_24h":1,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5222,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T14:08:36","last_seen":"2026-10-05T14:08:36","recent":[{"timestamp":"2026-10-05T14:08:36","port":5222,"src_port":40606,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_5222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353232320a","sni":"","session":"6ff86eeb-48af-42e3-9926-06cb37c1c3d1","bytes_in":26,"source_verified":false,"enriched":{"digest":"dabac7026b711c14","strings":["MGLNDD_<HONEYPOT>_5222"]}}]},"top_ports":[{"port":25,"proto":"tcp","label":"SMTP","count":1},{"port":500,"proto":"tcp","label":"","count":1},{"port":8222,"proto":"tcp","label":"","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":4331,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-15","count":1},{"date":"2026-09-18","count":1},{"date":"2026-09-20","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T01:56:30","port":6066,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6066\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363036360a","method":"","user_agent":"","ja3":"","session":"5316ff43-b693-4d18-b073-9ba3c609535a","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"6a084a2d85c0db6a","strings":["MGLNDD_<HONEYPOT>_6066"]}},{"timestamp":"2026-09-30T16:04:46","port":8222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383232320a","method":"","user_agent":"","ja3":"","session":"6b56f6a0-c78c-4fbb-8a3c-1f8bfe1ccae4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"0e8cf1640a91339a","strings":["MGLNDD_<HONEYPOT>_8222"]}},{"timestamp":"2026-09-20T08:10:17","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","ja3":"","session":"6925e1e9-9dec-4fbb-8154-c7667ed862cd","seq":1,"duration_ms":60,"bytes_in":23,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-09-18T11:07:48","port":500,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_500\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3530300a","method":"","user_agent":"","ja3":"","session":"4fcccded-b4df-4c36-85f1-08fc5b4bf57c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":14,"enriched":{"digest":"eda2aa2d340b3204","strings":["MGLNDD_<HONEYPOT>_500"]}},{"timestamp":"2026-09-15T23:03:18","port":4331,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4331\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333310a","method":"","user_agent":"","ja3":"","session":"0e9f821c-efd0-493b-a313-f315a426803d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"b39e1c361ec44dc8","strings":["MGLNDD_<HONEYPOT>_4331"]}}],"http_methods":[],"distinct_ports_total":5,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:19:07.121747+00:00"}