{"ip":"20.169.85.57","total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"151 bytes sent","bytes_sent":151,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-18T05:14:28","last_seen":"2026-09-24T12:01:15","events_24h":2,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":981,"proto":"tcp","label":"","count":3},{"port":1311,"proto":"tcp","label":"","count":1},{"port":123,"proto":"tcp","label":"NTP","count":1},{"port":8333,"proto":"tcp","label":"Bitcoin","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-18","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":2}],"recent_events":[{"timestamp":"2026-09-24T12:01:15","port":981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_192.3.118.146_981\n","payload_hex":"4d474c4e44445f3139322e332e3131382e3134365f3938310a","method":"","user_agent":"","ja3":"","session":"6135de9a-4011-436c-ada1-e5084f898a1d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"9424cfe88f9aa443","strings":["MGLNDD_192.3.118.146_981"],"iocs":{"ips":["192.3.118.146"]}}},{"timestamp":"2026-09-24T05:00:29","port":1311,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_185.228.81.201_1311\n","payload_hex":"4d474c4e44445f3138352e3232382e38312e3230315f313331310a","method":"","user_agent":"","ja3":"","session":"61f5627b-b9e9-4411-9feb-c08d50015f5d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"4545686ff5f1efee","strings":["MGLNDD_185.228.81.201_1311"],"iocs":{"ips":["185.228.81.201"]}}},{"timestamp":"2026-09-23T14:44:58","port":981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_981\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938310a","method":"","user_agent":"","ja3":"","session":"e8fd15ac-3e75-469d-8d35-dd2c86da99a8","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"7db9c1ef4ae692a8","strings":["MGLNDD_<HONEYPOT>_981"]}},{"timestamp":"2026-09-22T03:19:43","port":123,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_123\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3132330a","method":"","user_agent":"","ja3":"","session":"d0d33d28-d5dd-4dc4-9fc9-ad9228577111","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"b405ee720dc0ae95","strings":["MGLNDD_<HONEYPOT>_123"]}},{"timestamp":"2026-09-21T20:26:50","port":981,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_981\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938310a","method":"","user_agent":"","ja3":"","session":"4641aca7-ea44-48c9-816d-7426de079d0c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"7db9c1ef4ae692a8","strings":["MGLNDD_<HONEYPOT>_981"]}},{"timestamp":"2026-09-18T05:14:28","port":8333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383333330a","method":"","user_agent":"","ja3":"","session":"71985c5e-fcd1-4c06-998e-035c231256fa","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"0c8f3d85c9b5f804","strings":["MGLNDD_<HONEYPOT>_8333"]}}],"http_methods":[],"distinct_ports_total":4,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T15:30:27.420028+00:00"}