{"ip":"20.84.145.64","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"503 bytes sent","bytes_sent":503,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T18:26:07","last_seen":"2026-10-06T05:21:40","events_24h":1,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5632,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T01:15:13","last_seen":"2026-10-06T01:15:13","recent":[{"timestamp":"2026-10-06T01:15:13","port":5632,"src_port":52811,"proto":"udp","app_proto":"","app_protocol":"","summary":"NQ\n","payload_hex":"4e510a","sni":"","session":"4ab67861-36b1-40f1-9925-b268487f2708","bytes_in":3,"source_verified":false}]},"top_ports":[{"port":18080,"proto":"tcp","label":"","count":2},{"port":9443,"proto":"tcp","label":"","count":2},{"port":102,"proto":"tcp","label":"","count":1},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":1},{"port":5432,"proto":"tcp","label":"Postgres","count":1},{"port":9200,"proto":"tcp","label":"Elastic","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1},{"port":4567,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6105},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-22","count":2},{"date":"2026-09-24","count":2},{"date":"2026-09-26","count":1},{"date":"2026-09-28","count":3},{"date":"2026-10-02","count":1},{"date":"2026-10-06","count":1}],"recent_events":[{"timestamp":"2026-10-06T05:21:40","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/manager/html","summary":"","payload_hex":"474554202f6d616e616765722f68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"39efb5c8-f1f0-4660-8538-5331eb8a4fc2","seq":1,"duration_ms":100,"bytes_in":127,"bytes_out":77},{"timestamp":"2026-10-02T17:12:59","port":4567,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4567\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343536370a","method":"","user_agent":"","ja3":"","session":"599aef57-69d6-4d8a-a785-c4642cc6e6d4","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"cce23ea5e8ac26ab","strings":["MGLNDD_<HONEYPOT>_4567"]}},{"timestamp":"2026-09-28T22:49:17","port":18080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"abce483e-e062-4e21-94bc-09f641dd120a","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-28T22:49:17","port":18080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18080\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383038300a","method":"","user_agent":"","ja3":"","session":"b36e3d3b-1190-4bdf-88cc-68cc20989456","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"a52f135ae1bb74c7","strings":["MGLNDD_<HONEYPOT>_18080"]}},{"timestamp":"2026-09-28T20:32:10","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0000\u0010\u0000\u0000","payload_hex":"0000000800100000","method":"","user_agent":"","ja3":"","session":"e6119d7a-19f3-4887-9e39-f0af847e0796","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":12},{"timestamp":"2026-09-26T02:36:10","port":102,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_102\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3130320a","method":"","user_agent":"","ja3":"","session":"c0f5e86c-9354-4a97-966f-a80535f63ad4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"8fbbf270736a6700","strings":["MGLNDD_<HONEYPOT>_102"]}},{"timestamp":"2026-09-24T18:56:59","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_search","summary":"","payload_hex":"474554202f5f73656172636820485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"127603ba-56c2-44e6-ad1a-1e86cb1dd01e","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-09-24T12:11:05","port":5800,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5800\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353830300a","method":"","user_agent":"","ja3":"","session":"8da37758-518b-4567-9015-20706ba47359","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"df0594be3f65b845","strings":["MGLNDD_<HONEYPOT>_5800"]}},{"timestamp":"2026-09-22T18:26:07","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"383d6c26-9488-4e8b-8d40-34327da65fcc","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-09-22T18:26:07","port":9443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393434330a","method":"","user_agent":"","ja3":"","session":"3fa104e1-73d2-4f58-b58c-9302cc9338ee","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"1cf514ee65f8f93e","strings":["MGLNDD_<HONEYPOT>_9443"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/_search","count":1,"ports":1},{"path":"/manager/html","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8088","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-06T22:52:34.790778+00:00"}