{"ip":"20.55.39.105","total_events":11,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"285 bytes sent","bytes_sent":285,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T00:14:15","last_seen":"2026-10-06T05:57:49","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":53,"events":1},{"port":8088,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T02:12:35","last_seen":"2026-10-07T01:24:45","recent":[{"timestamp":"2026-10-07T01:24:45","port":8088,"src_port":37323,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","sni":"","session":"858b5c21-4259-494a-b6a8-c60ab39f8634","bytes_in":26,"source_verified":false,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}},{"timestamp":"2026-10-06T02:12:35","port":53,"src_port":55992,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_53\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f35330a","sni":"","session":"5ac6abdc-9641-41ad-9536-59d30de967ef","bytes_in":25,"source_verified":false,"enriched":{"digest":"f683c0a3971ee755","strings":["MGLNDD_<HONEYPOT>_53"]}}]},"top_ports":[{"port":5353,"proto":"tcp","label":"","count":1},{"port":1389,"proto":"tcp","label":"","count":1},{"port":5093,"proto":"tcp","label":"","count":1},{"port":5061,"proto":"tcp","label":"SIPS","count":1},{"port":500,"proto":"tcp","label":"","count":1},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":1},{"port":5938,"proto":"tcp","label":"","count":1},{"port":2181,"proto":"tcp","label":"","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1},{"port":8834,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":1},{"date":"2026-09-30","count":2},{"date":"2026-10-02","count":2},{"date":"2026-10-04","count":1},{"date":"2026-10-06","count":1}],"recent_events":[{"timestamp":"2026-10-06T05:57:49","port":5938,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5938\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353933380a","method":"","user_agent":"","ja3":"","session":"80aa8698-d47a-4121-a03a-ed75bbf3be80","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"0ab43d27590d13a3","strings":["MGLNDD_<HONEYPOT>_5938"]}},{"timestamp":"2026-10-04T23:06:25","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323138310a","method":"","user_agent":"","ja3":"","session":"027cc877-c3e2-4e68-98d1-2c42195b1316","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"a40f382094844108","strings":["MGLNDD_<HONEYPOT>_2181"]}},{"timestamp":"2026-10-02T18:39:36","port":1389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1389\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313338390a","method":"","user_agent":"","ja3":"","session":"ce76dc62-d4d4-44ab-8b0e-38559daa47cb","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"846b7cefadd324c8","strings":["MGLNDD_<HONEYPOT>_1389"]}},{"timestamp":"2026-10-02T09:18:37","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"15f8974e-0f74-4fc0-a076-3ec0d81ffa86","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-30T15:45:10","port":500,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_500\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3530300a","method":"","user_agent":"","ja3":"","session":"5676bdf0-5b84-438f-998c-fc395c3ca552","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"eda2aa2d340b3204","strings":["MGLNDD_<HONEYPOT>_500"]}},{"timestamp":"2026-09-30T10:33:08","port":8008,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8008\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030380a","method":"","user_agent":"","ja3":"","session":"3ffbf550-1ffa-4540-957e-ef9d4fddccc0","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"c7734b2476b6d92a","strings":["MGLNDD_<HONEYPOT>_8008"]}},{"timestamp":"2026-09-27T13:43:17","port":8088,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","method":"","user_agent":"","ja3":"","session":"f6c92ea2-19b2-43db-99f9-32374e6e3af7","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}},{"timestamp":"2026-09-26T00:13:13","port":5353,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5353\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353335330a","method":"","user_agent":"","ja3":"","session":"c934c895-d574-4027-839a-b0ac4efd8213","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"a0612689837e5cde","strings":["MGLNDD_<HONEYPOT>_5353"]}},{"timestamp":"2026-09-24T22:43:50","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","ja3":"","session":"b68ca962-2df3-4b0d-a12c-462c9296f2e6","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-09-17T02:07:58","port":8834,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8834\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383833340a","method":"","user_agent":"","ja3":"","session":"edb6b58f-b44c-4288-b569-d2b172c20143","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"13673c28c520e599","strings":["MGLNDD_<HONEYPOT>_8834"]}}],"http_methods":[],"distinct_ports_total":11,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-07T02:48:12.324953+00:00"}