{"ip":"20.169.57.79","total_events":10,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"256 bytes sent","bytes_sent":256,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T07:11:35","last_seen":"2026-10-04T22:37:36","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":9060,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T16:24:53","last_seen":"2026-10-05T16:24:53","recent":[{"timestamp":"2026-10-05T16:24:53","port":9060,"src_port":33716,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","sni":"","session":"46dd2462-ad02-4f14-a144-4fc3f1fd61a3","bytes_in":26,"source_verified":false,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}}]},"top_ports":[{"port":9990,"proto":"tcp","label":"","count":1},{"port":161,"proto":"tcp","label":"SNMP","count":1},{"port":8880,"proto":"tcp","label":"","count":1},{"port":18245,"proto":"tcp","label":"","count":1},{"port":8005,"proto":"tcp","label":"","count":1},{"port":9060,"proto":"tcp","label":"","count":1},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":771,"proto":"tcp","label":"","count":1},{"port":4545,"proto":"tcp","label":"","count":1},{"port":111,"proto":"tcp","label":"RPC","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-27","count":2},{"date":"2026-09-29","count":1},{"date":"2026-10-01","count":2},{"date":"2026-10-02","count":1},{"date":"2026-10-04","count":2}],"recent_events":[{"timestamp":"2026-10-04T22:37:36","port":8005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8005\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030350a","method":"","user_agent":"","ja3":"","session":"736c23d7-8f25-40af-91d5-425a406aea9e","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"68450b1512177080","strings":["MGLNDD_<HONEYPOT>_8005"]}},{"timestamp":"2026-10-04T11:22:36","port":771,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_771\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3737310a","method":"","user_agent":"","ja3":"","session":"cb6ffcef-0ff2-4aea-8269-892fb6580f01","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"02612c44125dd412","strings":["MGLNDD_<HONEYPOT>_771"]}},{"timestamp":"2026-10-02T19:19:08","port":18245,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18245\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234350a","method":"","user_agent":"","ja3":"","session":"60d2704f-7fb4-45e0-9cd5-ff99bd23bbb0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"3f43707931f767b4","strings":["MGLNDD_<HONEYPOT>_18245"]}},{"timestamp":"2026-10-01T08:42:41","port":4545,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4545\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343534350a","method":"","user_agent":"","ja3":"","session":"18b88df7-26bf-4262-b513-dcd42715ed4d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"f90297cb12896aa2","strings":["MGLNDD_<HONEYPOT>_4545"]}},{"timestamp":"2026-10-01T03:57:25","port":9060,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9060\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393036300a","method":"","user_agent":"","ja3":"","session":"fdb38980-0ca5-4518-ac43-88959944b4b0","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"a132d6101589eb56","strings":["MGLNDD_<HONEYPOT>_9060"]}},{"timestamp":"2026-09-29T07:25:52","port":111,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_111\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131310a","method":"","user_agent":"","ja3":"","session":"5ea86911-215e-4cfd-a04a-ecaa02c15c33","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"29242794e9bce34e","strings":["MGLNDD_<HONEYPOT>_111"]}},{"timestamp":"2026-09-27T11:01:06","port":8880,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8880\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383838300a","method":"","user_agent":"","ja3":"","session":"cc376c87-1d12-4c51-8d7c-9c7c59985b74","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"1c9a37bd34cce390","strings":["MGLNDD_<HONEYPOT>_8880"]}},{"timestamp":"2026-09-27T07:12:35","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"dc7815b9-adb2-48e1-9985-3d4ef1f82854","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-21T18:09:10","port":8008,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8008\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030380a","method":"","user_agent":"","ja3":"","session":"f65bd96f-3e97-4293-9b0e-4200204307e9","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"c7734b2476b6d92a","strings":["MGLNDD_<HONEYPOT>_8008"]}},{"timestamp":"2026-09-20T07:11:35","port":161,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_161\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136310a","method":"","user_agent":"","ja3":"","session":"b31c1781-e4f1-4ec5-8784-5b2209f1f52e","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"70f4c7cf4e0b75fb","strings":["MGLNDD_<HONEYPOT>_161"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:49:33.046833+00:00"}