{"ip":"20.221.58.2","total_events":16,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"804 bytes sent","bytes_sent":804,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T09:37:54","last_seen":"2026-10-04T15:38:17","events_24h":0,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2019-9621","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5093,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T16:06:23","last_seen":"2026-10-05T16:06:23","recent":[{"timestamp":"2026-10-05T16:06:23","port":5093,"src_port":52253,"proto":"udp","app_proto":"","app_protocol":"","summary":"DIGI\u0000\u0001\u0000\u0006������","payload_hex":"4449474900010006ffffffffffff","sni":"","session":"cc295f3b-3680-41ea-82e1-af77f8bc2811","bytes_in":14,"source_verified":false,"enriched":{"digest":"02ef84d36fa01651","strings":["DIGI"]}}]},"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":2052,"proto":"tcp","label":"","count":2},{"port":990,"proto":"tcp","label":"FTPS","count":1},{"port":7002,"proto":"tcp","label":"","count":1},{"port":9160,"proto":"tcp","label":"","count":1},{"port":873,"proto":"tcp","label":"Rsync","count":1},{"port":5432,"proto":"tcp","label":"Postgres","count":1},{"port":20547,"proto":"tcp","label":"","count":1},{"port":1028,"proto":"tcp","label":"","count":1},{"port":47808,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":5901,"proto":"tcp","label":"","count":1},{"port":5903,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea03039c6aa5fd7959188b80f15e70af1342d6a49d8936171efdcdb3ced83a79674fdc200a3a6fbe96c570fd97a7e349bcd60b0c2784ec92f9805d2db2f7a7bf64084fb60026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d002079ca1d358618ccb5aea67f70ac518448721c4107028b22e3d83ab800","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3133,"b11cun040_00040016_aa48e2c8":6048},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":3},{"date":"2026-09-19","count":1},{"date":"2026-09-24","count":2},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-29","count":2},{"date":"2026-09-30","count":2},{"date":"2026-10-01","count":1},{"date":"2026-10-03","count":2},{"date":"2026-10-04","count":1}],"recent_events":[{"timestamp":"2026-10-04T15:38:17","port":9160,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9160\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393136300a","method":"","user_agent":"","ja3":"","session":"845fa5dd-3db2-4f9d-b02a-52ad552b4486","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"428edf2ea6cd80d1","strings":["MGLNDD_<HONEYPOT>_9160"]}},{"timestamp":"2026-10-03T18:21:35","port":2052,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2052\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323035320d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"d6e42646-0b45-48fd-9f48-76b052666320","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":76},{"timestamp":"2026-10-03T18:21:35","port":2052,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2052\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323035320a","method":"","user_agent":"","ja3":"","session":"7fa3a26b-4c1d-4d39-ba12-4d208d83bd82","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"49db35f3daae3590","strings":["MGLNDD_<HONEYPOT>_2052"]}},{"timestamp":"2026-10-01T15:16:30","port":20547,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_20547\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32303534370a","method":"","user_agent":"","ja3":"","session":"fdd2b895-c7b0-4fce-bf9a-e2253d683040","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"e3ea289ac576fe01","strings":["MGLNDD_<HONEYPOT>_20547"]}},{"timestamp":"2026-09-30T16:57:17","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0000\u0010\u0000\u0000","payload_hex":"0000000800100000","method":"","user_agent":"","ja3":"","session":"07b0f144-18f9-4b8d-9a56-0dd81fab01a6","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":11},{"timestamp":"2026-09-30T12:57:53","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/actuator/health","summary":"","payload_hex":"474554202f6163747561746f722f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"22caa90d-6c9a-4c67-b46e-e9425e26abf2","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":76},{"timestamp":"2026-09-29T08:49:36","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"2449f28d-983a-4138-92cf-b133b8fc8650","seq":1,"duration_ms":103,"bytes_in":115,"bytes_out":76},{"timestamp":"2026-09-29T08:49:36","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383434330a","method":"","user_agent":"","ja3":"","session":"ac251d07-0d8e-4562-aaa9-b6d000651670","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"6f7f3440a9023eca","strings":["MGLNDD_<HONEYPOT>_8443"]}},{"timestamp":"2026-09-27T09:56:22","port":5901,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5901\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353930310a","method":"","user_agent":"","ja3":"","session":"5a2bdbe8-4737-4033-abed-dba400c81e0f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"9078fa70d6081c5f","strings":["MGLNDD_<HONEYPOT>_5901"]}},{"timestamp":"2026-09-26T05:29:23","port":873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_873\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3837330a","method":"","user_agent":"","ja3":"","session":"a59c6ed1-8117-4143-89d8-be87d11e92f4","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":11,"enriched":{"digest":"9c506c8ce434b205","strings":["MGLNDD_<HONEYPOT>_873"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":14,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/actuator/health","count":1,"ports":1},{"path":"/autodiscover/autodiscover.json?@zdi/Powershell","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:2052","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2019-9621","tag_type":"cve","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/autodiscover","reference_urls":["https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","https://nvd.nist.gov/vuln/detail/cve-2019-9621","http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","https://bugzilla.zimbra.com/show_bug.cgi?id=109127"]}],"data_as_of":"2026-10-05T18:50:55.993244+00:00"}