{"ip":"20.169.84.56","total_events":12,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["12 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"981 bytes sent","bytes_sent":981,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T04:49:20","last_seen":"2026-10-01T13:54:09","events_24h":2,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":6666,"proto":"tcp","label":"","count":2},{"port":11740,"proto":"tcp","label":"","count":2},{"port":53,"proto":"tcp","label":"DNS","count":2},{"port":1830,"proto":"tcp","label":"","count":1},{"port":50070,"proto":"tcp","label":"Hadoop","count":1},{"port":20547,"proto":"tcp","label":"","count":1},{"port":2049,"proto":"tcp","label":"NFS","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":7001,"proto":"tcp","label":"WebLogic","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1909h1_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100fd010000f903034c07e8d9274bd558531a19830caa8f58192aaf70628af2bd7629621b00f7aaa520d3e89d24c2992799f3f4aa3163c42b7a7a12ca966c96edfa1f0ac276704b3e590026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100008a000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000010000b000908687474702f312e3100120000002b0009080304030303020301003300260024001d00205d5118bb44e806661be427e4cf488a65cb971f4284a6287d20b571","tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"http_akin":["b11cun040_00040016_aa48e2c8","b11cuq060_00050816_e6aecace"]},"fingerprint_peers":{"t13i1909h1_9dc949149365_97f8aa674fd9":395,"b11cun040_00040016_aa48e2c8":6196,"b11cuq060_00050816_e6aecace":4},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-22","count":2},{"date":"2026-09-24","count":1},{"date":"2026-09-25","count":2},{"date":"2026-09-27","count":2},{"date":"2026-09-28","count":1},{"date":"2026-09-30","count":2},{"date":"2026-10-01","count":2}],"recent_events":[{"timestamp":"2026-10-01T13:54:09","port":7001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373030310a","method":"","user_agent":"","ja3":"","session":"54793dea-cb0e-4062-9c56-1bc67e3b37b8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"964f94a9f03250d9","strings":["MGLNDD_<HONEYPOT>_7001"]}},{"timestamp":"2026-10-01T08:22:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/event-stream\",\"accept-encoding\":\"gzip\",\"content-length\":\"168\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"mcp-fingerprint-probe\",\"version\":\"1.0\"}}}","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/mcp","summary":"","payload_hex":"504f5354202f6d637020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a436f6e74656e742d4c656e6774683a203136380d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f6576656e742d73747265616d0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226a736f6e727063223a22322e30222c226964223a312c226d6574686f64223a22696e697469616c697a65222c22706172616d73223a7b2270726f746f636f6c56657273696f6e223a22323032352d30332d3236222c226361706162696c6974696573223a7b7d2c22636c69656e74496e666f223a7b226e616d65223a226d63702d66696e6765727072696e742d70726f6265222c2276657273696f6e223a22312e30227d7d7d","method":"POST","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"69fe8ce8-927f-4843-8058-8eae6f3f26cc","seq":1,"duration_ms":160,"bytes_in":367,"bytes_out":77},{"timestamp":"2026-09-30T00:29:48","port":6666,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6666\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363636360a","method":"","user_agent":"","ja3":"","session":"c4ce13e2-6fd5-47e2-a4da-0dc82ff40eae","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"70dee524d0961fdd","strings":["MGLNDD_<HONEYPOT>_6666"]}},{"timestamp":"2026-09-30T00:29:47","port":6666,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6666\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363636360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"8f253d8b-00fe-4a04-8c14-fb6a1f5fbeae","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-28T23:48:30","port":20547,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_20547\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32303534370a","method":"","user_agent":"","ja3":"","session":"79181886-cf9b-4a90-bdb3-b5bd9aaaa6be","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"e3ea289ac576fe01","strings":["MGLNDD_<HONEYPOT>_20547"]}},{"timestamp":"2026-09-27T02:35:52","port":11740,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0017�$\u0000\u0000\u0000�|P\u0003\u00003u��\u0000\n\u0006\u0001�-�\u0005���\u0002�\u0000\u0004\u0003�oH","payload_hex":"000117e824000000c57c5003003375e8a9000a0601f12ddc<HONEYPOT>02c2000403b96f48","method":"","user_agent":"","ja3":"","session":"31e9381e-8d58-4200-ad1b-ee137b616016","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":12},{"timestamp":"2026-09-27T02:35:52","port":11740,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11740\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313734300a","method":"","user_agent":"","ja3":"","session":"9e7b86fb-26b9-484d-9c4b-6d27c50b6283","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"84f3f8f8b731cca5","strings":["MGLNDD_<HONEYPOT>_11740"]}},{"timestamp":"2026-09-25T12:07:39","port":53,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:53\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"a1fd0941-3d84-4cb9-96d1-0f1bab8ed2a0","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-09-25T12:07:39","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_53\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f35330a","method":"","user_agent":"","ja3":"","session":"48832ecb-bb6a-4f9d-8768-c737229ac76d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"f683c0a3971ee755","strings":["MGLNDD_<HONEYPOT>_53"]}},{"timestamp":"2026-09-24T13:27:55","port":1830,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1830\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313833300a","method":"","user_agent":"","ja3":"","session":"ecb8262f-c59e-4450-a2c0-bfea03bc9cab","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"2ee951bfe25583c7","strings":["MGLNDD_<HONEYPOT>_1830"]}}],"http_methods":[{"method":"GET","count":3},{"method":"POST","count":1}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/mcp","count":1,"ports":1},{"path":"/jmx?qry=Hadoop:service=NameNode,name=NameNodeInfo","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/event-stream","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"168","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":2,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-01T20:21:18.366319+00:00"}