{"ip":"20.98.165.40","total_events":21,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,084 bytes sent","bytes_sent":2084,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T05:59:40","last_seen":"2026-10-07T01:16:57","events_24h":0,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":2222,"proto":"tcp","label":"SSH-alt","count":3},{"port":4118,"proto":"tcp","label":"","count":2},{"port":2455,"proto":"tcp","label":"","count":2},{"port":465,"proto":"tcp","label":"SMTPS","count":2},{"port":8085,"proto":"tcp","label":"","count":2},{"port":9090,"proto":"tcp","label":"Prometheus","count":2},{"port":28017,"proto":"tcp","label":"","count":1},{"port":7574,"proto":"tcp","label":"","count":1},{"port":8098,"proto":"tcp","label":"","count":1},{"port":28015,"proto":"tcp","label":"","count":1},{"port":1080,"proto":"tcp","label":"SOCKS","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":23,"proto":"tcp","label":"Telnet","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6061,"e54ef3ec27fe1fea7ab64d3fa05359fd":571},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-19","count":3},{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":1},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":5},{"date":"2026-09-29","count":3},{"date":"2026-10-01","count":2},{"date":"2026-10-03","count":2},{"date":"2026-10-04","count":1},{"date":"2026-10-06","count":1},{"date":"2026-10-07","count":1}],"recent_events":[{"timestamp":"2026-10-07T01:16:57","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_23\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32330a","method":"","user_agent":"","ja3":"","session":"fdd5952d-ff04-4312-a1a0-987a8f594ae6","seq":1,"duration_ms":44,"bytes_in":24,"bytes_out":12,"enriched":{"digest":"1515f0e7b77b4728","strings":["MGLNDD_<HONEYPOT>_23"]}},{"timestamp":"2026-10-06T00:42:26","port":7574,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7574\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373537340a","method":"","user_agent":"","ja3":"","session":"958a79f6-9a54-481c-86b2-b13988352790","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"d5e8a548af97f000","strings":["MGLNDD_<HONEYPOT>_7574"]}},{"timestamp":"2026-10-04T11:12:15","port":28017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_28017\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32383031370a","method":"","user_agent":"","ja3":"","session":"f3b96b6a-04d1-4029-834e-2508311a6a24","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"f9a3cfe97126b696","strings":["MGLNDD_<HONEYPOT>_28017"]}},{"timestamp":"2026-10-03T12:36:28","port":2455,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2455\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323435350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"60fa8f2e-df09-456a-beac-40f6c0dde8e7","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-10-03T12:36:28","port":2455,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2455\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323435350a","method":"","user_agent":"","ja3":"","session":"8b81af67-4d95-4a3e-8dd5-1a5b637cb6f6","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"a3cc5c000bac5710","strings":["MGLNDD_<HONEYPOT>_2455"]}},{"timestamp":"2026-10-01T18:37:00","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4118\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343131380a","method":"","user_agent":"","ja3":"","session":"15f3f86d-04bb-4245-a4ff-0834c89de3eb","seq":1,"duration_ms":101,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"3298a42592e8be0d","strings":["MGLNDD_<HONEYPOT>_4118"]}},{"timestamp":"2026-10-01T18:36:59","port":4118,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"59f63112-1846-4381-9c72-f018cf94bcf8","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-29T14:04:05","port":2222,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2222\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323232320a","method":"","user_agent":"","ja3":"","session":"d3557326-7b1e-4220-9067-72b350188c9f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"c33d3688bfbfd8f0","strings":["MGLNDD_<HONEYPOT>_2222"]}},{"timestamp":"2026-09-29T02:39:58","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0001\u0000local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ixia\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff01006c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000069786961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"0a9a28aa-ec7c-44d6-aa38-e74e3aa8e051","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":12,"enriched":{"digest":"e6496ea510190464","strings":["local","ixia","localixia"]}},{"timestamp":"2026-09-29T01:36:51","port":28015,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_28015\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32383031350a","method":"","user_agent":"","ja3":"","session":"a3e25583-9b29-4a89-9abb-de94c0caf32d","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"e11e225c62936189","strings":["MGLNDD_<HONEYPOT>_28015"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":14,"top_paths":[{"path":"/","count":3,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:2455","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-08T12:05:59.813615+00:00"}