{"ip":"20.84.91.51","total_events":12,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["12 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"694 bytes sent","bytes_sent":694,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T13:02:49","last_seen":"2026-10-05T12:47:29","events_24h":3,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5060,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T12:54:59","last_seen":"2026-10-05T12:54:59","recent":[{"timestamp":"2026-10-05T12:54:59","port":5060,"src_port":47024,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"OPTIONS sip:plvJBPvq@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 10.2.1.173:47024;branch=zblErb.7774659602;rport;alias\r\nFrom: sip:AiXUovgG@10.2.1.173:47024;tag=13213533\r\nTo: sip:UJBQaOef@<HONEYPOT>\r\nCall-ID: 2335769362@10.2.1.173\r\nCSeq: 1 OPTIONS\r\nContact: sip:IEAoCEVD@10.2.1.173:47024\r\nContent-Length: 0\r\nMax-Forwards: 20\r\nUser-Agent: uyGbPpBJ\r\nAccept: text/plain\r\n\r\n","payload_hex":"4f5054494f4e53207369703a706c764a4250767140<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f5544502031302e322e312e3137333a34373032343b6272616e63683d7a626c4572622e373737343635393630323b72706f72743b616c6961730d0a46726f6d3a207369703a416958556f7667474031302e322e312e3137333a34373032343b7461673d31333231333533330d0a546f3a207369703a554a4251614f656640<HONEYPOT>0d0a43616c6c2d49443a20323333353736393336324031302e322e312e3137330d0a435365713a2031204f5054494f4e530d0a436f6e746163743a207369703a4945416f434556444031302e322e312e3137333a34373032340d0a436f6e74656e742d4c656e6774683a20300d0a4d61782d466f7277617264733a2032300d0a557365722d4167656e743a20757947625070424a0d0a4163636570743a20746578742f706c61696e0d0a0d0a","sni":"","session":"c2cfbd53-7a84-4d28-82c2-ecb1d6878ccf","bytes_in":366,"source_verified":false,"enriched":{"digest":"931e2a0853c52dd3","label":"HTTP","strings":["OPTIONS sip:plvJBPvq@<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 10.2.1.173:47024;branch=zblErb.7774659602;rport;alias","From: sip:AiXUovgG@10.2.1.173:47024;tag=13213533","To: sip:UJBQaOef@<HONEYPOT>","Call-ID: 2335769362@10.2.1.173","CSeq: 1 OPTIONS","Contact: sip:IEAoCEVD@10.2.1.173:47024","Content-Length: 0","Max-Forwards: 20","User-Agent: uyGbPpBJ"],"iocs":{"ips":["10.2.1.173"],"paths":["/2.0/UDP"]}}}]},"top_ports":[{"port":32400,"proto":"tcp","label":"","count":2},{"port":1443,"proto":"tcp","label":"","count":2},{"port":4200,"proto":"tcp","label":"","count":2},{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":1},{"port":8140,"proto":"tcp","label":"","count":1},{"port":3389,"proto":"tcp","label":"RDP","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":23,"proto":"tcp","label":"Telnet","count":1},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303deb2ac06ea69e6985a27e5079d28773327298af127108c2e9c17e391574b80752032cc6cd826e6b128829a279b2c43234540adb2f6ced740a2d3ea131e09c0f25c0026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020aa89e550d0d76e1c6b2d5562b7202af0421eb0ec53788ace86f65fc5","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3133,"b11cun040_00040016_aa48e2c8":6048},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-23","count":2},{"date":"2026-09-27","count":3},{"date":"2026-09-28","count":2},{"date":"2026-10-05","count":3}],"recent_events":[{"timestamp":"2026-10-05T12:47:29","port":4200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"bdc41e78-1390-4f99-a893-f8fc56329917","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":76},{"timestamp":"2026-10-05T12:47:29","port":4200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4200\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343230300a","method":"","user_agent":"","ja3":"","session":"23fe4a02-0ac2-49c6-b141-235884371a67","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"399b514ef4dfabfb","strings":["MGLNDD_<HONEYPOT>_4200"]}},{"timestamp":"2026-10-05T10:20:16","port":8140,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8140\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383134300a","method":"","user_agent":"","ja3":"","session":"e79e259f-76ae-434b-9519-26dba92f89f9","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"b874a11589f2894b","strings":["MGLNDD_<HONEYPOT>_8140"]}},{"timestamp":"2026-09-28T00:38:07","port":1443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313434330a","method":"","user_agent":"","ja3":"","session":"112e7026-75ee-4c9d-aafb-c1337a4c3752","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":11,"enriched":{"digest":"2e67910546079b84","strings":["MGLNDD_<HONEYPOT>_1443"]}},{"timestamp":"2026-09-28T00:38:06","port":1443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"90770b70-9b43-4483-b228-c5a767dca93e","seq":1,"duration_ms":101,"bytes_in":114,"bytes_out":76},{"timestamp":"2026-09-27T07:48:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/developmentserver/metadatauploader","summary":"","payload_hex":"474554202f646576656c6f706d656e747365727665722f6d6574616461746175706c6f6164657220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"8c70a27e-80f0-4c57-a5b2-1860f07473db","seq":1,"duration_ms":266,"bytes_in":144,"bytes_out":76},{"timestamp":"2026-09-27T05:02:20","port":5269,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5269\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353236390a","method":"","user_agent":"","ja3":"","session":"540ee4e9-a2b2-476e-90e5-ee47a18572cb","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"680f85abd1c8c06b","strings":["MGLNDD_<HONEYPOT>_5269"]}},{"timestamp":"2026-09-27T02:31:51","port":5800,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5800\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353830300a","method":"","user_agent":"","ja3":"","session":"45aeac91-5cdc-4326-b51c-174812beac97","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":11,"enriched":{"digest":"df0594be3f65b845","strings":["MGLNDD_<HONEYPOT>_5800"]}},{"timestamp":"2026-09-23T15:38:15","port":32400,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"186b8186-1069-44ea-8a57-b4fbca71423f","seq":1,"duration_ms":102,"bytes_in":115,"bytes_out":76},{"timestamp":"2026-09-23T15:38:15","port":32400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_32400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f33323430300a","method":"","user_agent":"","ja3":"","session":"fe734ba1-73a3-43ad-8d2f-20426dafc8de","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":11,"enriched":{"digest":"69b665d12e12de8d","strings":["MGLNDD_<HONEYPOT>_32400"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/developmentserver/metadatauploader","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:4200","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"]}],"data_as_of":"2026-10-05T18:51:43.466446+00:00"}