{"ip":"20.51.209.165","total_events":11,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"285 bytes sent","bytes_sent":285,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T13:48:54","last_seen":"2026-10-04T11:41:30","events_24h":0,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":8181,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T14:56:32","last_seen":"2026-10-05T14:56:32","recent":[{"timestamp":"2026-10-05T14:56:32","port":8181,"src_port":49613,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383138310a","sni":"","session":"697c476e-db26-4fea-920a-5fb7a9fe910a","bytes_in":27,"source_verified":false,"enriched":{"digest":"2f59c79da2fc8a42","strings":["MGLNDD_<HONEYPOT>_8181"]}}]},"top_ports":[{"port":8047,"proto":"tcp","label":"","count":1},{"port":4330,"proto":"tcp","label":"","count":1},{"port":88,"proto":"tcp","label":"","count":1},{"port":8081,"proto":"tcp","label":"","count":1},{"port":5353,"proto":"tcp","label":"","count":1},{"port":4333,"proto":"tcp","label":"","count":1},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":6066,"proto":"tcp","label":"","count":1},{"port":18246,"proto":"tcp","label":"","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":4443,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-22","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":2},{"date":"2026-09-30","count":3},{"date":"2026-10-02","count":2},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":1}],"recent_events":[{"timestamp":"2026-10-04T11:41:30","port":4443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343434330a","method":"","user_agent":"","ja3":"","session":"cbb9e4e9-b055-4309-b046-e747723c45a9","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"749ba4cf4d0a5648","strings":["MGLNDD_<HONEYPOT>_4443"]}},{"timestamp":"2026-10-03T12:29:16","port":8047,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8047\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383034370a","method":"","user_agent":"","ja3":"","session":"5c4783f0-985d-437b-bcb9-673598481776","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"c3e2dfba2b168eee","strings":["MGLNDD_<HONEYPOT>_8047"]}},{"timestamp":"2026-10-02T23:49:27","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"a66e678c-4302-43c6-a09e-665753583c8f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-10-02T10:39:42","port":6066,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_6066\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f363036360a","method":"","user_agent":"","ja3":"","session":"261de137-700c-4c9f-926e-1913f2eb1be5","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"6a084a2d85c0db6a","strings":["MGLNDD_<HONEYPOT>_6066"]}},{"timestamp":"2026-09-30T21:54:42","port":4333,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4333\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333330a","method":"","user_agent":"","ja3":"","session":"25bd62d2-0f60-4c65-be9f-b200cc41f7a7","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"cd717062b6876d01","strings":["MGLNDD_<HONEYPOT>_4333"]}},{"timestamp":"2026-09-30T19:41:06","port":88,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_88\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f38380a","method":"","user_agent":"","ja3":"","session":"ab1bc185-208b-4636-919a-96ff1433ed53","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"cec876e60fdeac39","strings":["MGLNDD_<HONEYPOT>_88"]}},{"timestamp":"2026-09-30T03:37:01","port":18246,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18246\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234360a","method":"","user_agent":"","ja3":"","session":"e08cfaf4-554c-4f85-897b-8e234b8b7c8d","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":13,"enriched":{"digest":"9698109cd89a1b97","strings":["MGLNDD_<HONEYPOT>_18246"]}},{"timestamp":"2026-09-26T21:52:01","port":8081,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8081\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038310a","method":"","user_agent":"","ja3":"","session":"81340658-62c8-4d42-85a2-44888cf95f15","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"ec226b1a61f4eceb","strings":["MGLNDD_<HONEYPOT>_8081"]}},{"timestamp":"2026-09-26T13:16:21","port":4330,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4330\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343333300a","method":"","user_agent":"","ja3":"","session":"f8bf7380-7f94-482b-bc10-55f60ad09591","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"2c82708bbcbee16d","strings":["MGLNDD_<HONEYPOT>_4330"]}},{"timestamp":"2026-09-25T06:09:52","port":8008,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8008\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030380a","method":"","user_agent":"","ja3":"","session":"bf8a1dd0-c317-4786-8779-f8dbba7a9fb3","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"c7734b2476b6d92a","strings":["MGLNDD_<HONEYPOT>_8008"]}}],"http_methods":[],"distinct_ports_total":11,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:49:41.228378+00:00"}