{"ip":"20.169.91.44","total_events":13,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"12+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 12 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"336 bytes sent","bytes_sent":336,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T16:48:31","last_seen":"2026-10-03T06:04:26","events_24h":0,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":23,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T13:41:29","last_seen":"2026-10-05T13:41:29","recent":[{"timestamp":"2026-10-05T13:41:29","port":23,"src_port":56832,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_23\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32330a","sni":"","session":"97a0fcaf-be1d-4a61-bbd3-c333ea6c41fd","bytes_in":24,"source_verified":false,"enriched":{"digest":"1515f0e7b77b4728","strings":["MGLNDD_<HONEYPOT>_23"]}}]},"top_ports":[{"port":1311,"proto":"tcp","label":"","count":2},{"port":25,"proto":"tcp","label":"SMTP","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":8086,"proto":"tcp","label":"InfluxDB","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":3790,"proto":"tcp","label":"","count":1},{"port":8005,"proto":"tcp","label":"","count":1},{"port":1212,"proto":"tcp","label":"","count":1},{"port":8222,"proto":"tcp","label":"","count":1},{"port":8983,"proto":"tcp","label":"Solr","count":1},{"port":9999,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-15","count":2},{"date":"2026-09-18","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":1},{"date":"2026-09-29","count":3},{"date":"2026-10-02","count":1},{"date":"2026-10-03","count":1}],"recent_events":[{"timestamp":"2026-10-03T06:04:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_80\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38300a","method":"","user_agent":"","ja3":"","session":"92ea5a9e-82ab-43f9-936b-756a26f7d809","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"0296647ad3680a85","strings":["MGLNDD_<HONEYPOT>_80"]}},{"timestamp":"2026-10-02T11:10:58","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6379\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363337390a","method":"","user_agent":"","ja3":"","session":"80fdce1a-585e-4988-a878-b80cd23f5dfa","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":5,"enriched":{"digest":"c527d5681f7b683c","strings":["MGLNDD_<HONEYPOT>_6379"]}},{"timestamp":"2026-09-29T16:48:34","port":8005,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8005\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030350a","method":"","user_agent":"","ja3":"","session":"440e2e8d-03ba-48dd-867d-36c19389480a","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"68450b1512177080","strings":["MGLNDD_<HONEYPOT>_8005"]}},{"timestamp":"2026-09-29T09:54:39","port":1311,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1311\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313331310a","method":"","user_agent":"","ja3":"","session":"1a6c7df8-abfe-462c-86ff-70e54007c017","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"d84753717ed087e5","strings":["MGLNDD_<HONEYPOT>_1311"]}},{"timestamp":"2026-09-29T02:16:10","port":1212,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1212\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313231320a","method":"","user_agent":"","ja3":"","session":"afe3cbdd-8b86-4a90-9119-aa3bdc4f1a57","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"d9ba7c28a4ff80be","strings":["MGLNDD_<HONEYPOT>_1212"]}},{"timestamp":"2026-09-28T04:28:37","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"136a412b-0824-4492-840c-d10f7f4c22df","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-09-27T01:39:04","port":3790,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3790\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333739300a","method":"","user_agent":"","ja3":"","session":"9627974e-69fd-4649-8c2f-697779dbb6ff","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"63555966e1b6b47f","strings":["MGLNDD_<HONEYPOT>_3790"]}},{"timestamp":"2026-09-25T00:35:03","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_25\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32350a","method":"","user_agent":"","ja3":"","session":"13c62354-7f5b-40ad-964d-a3e4b78368aa","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":40,"enriched":{"digest":"61b0e94a79290fe6","strings":["MGLNDD_<HONEYPOT>_25"]}},{"timestamp":"2026-09-24T13:48:40","port":8983,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8983\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383938330a","method":"","user_agent":"","ja3":"","session":"d870fbb0-0dce-4dec-98d3-b02c6fcdbdf5","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"a3295f60b8374e52","strings":["MGLNDD_<HONEYPOT>_8983"]}},{"timestamp":"2026-09-21T19:35:21","port":9999,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9999\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939390a","method":"","user_agent":"","ja3":"","session":"6ba2c1a5-3a79-4159-b976-7e538d625218","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"d4bd826f7438193d","strings":["MGLNDD_<HONEYPOT>_9999"]}}],"http_methods":[],"distinct_ports_total":12,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:49:21.590372+00:00"}