{"ip":"4.249.17.128","total_events":11,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"287 bytes sent","bytes_sent":287,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T03:37:09","last_seen":"2026-10-04T17:02:24","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4532,"lon":-112.0748,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":8088,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-07T01:24:28","last_seen":"2026-10-07T01:24:28","recent":[{"timestamp":"2026-10-07T01:24:28","port":8088,"src_port":40357,"proto":"udp","app_proto":"","app_protocol":"","summary":"MGLNDD_<HONEYPOT>_8088\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038380a","sni":"","session":"5324ada5-404a-493e-b095-094b6b566952","bytes_in":25,"source_verified":false,"enriched":{"digest":"9abc0a23256b9fe9","strings":["MGLNDD_<HONEYPOT>_8088"]}}]},"top_ports":[{"port":8086,"proto":"tcp","label":"InfluxDB","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":1},{"port":9990,"proto":"tcp","label":"","count":1},{"port":5093,"proto":"tcp","label":"","count":1},{"port":8181,"proto":"tcp","label":"","count":1},{"port":2181,"proto":"tcp","label":"","count":1},{"port":15001,"proto":"tcp","label":"","count":1},{"port":10443,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-19","count":2},{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-26","count":2},{"date":"2026-10-04","count":3}],"recent_events":[{"timestamp":"2026-10-04T17:02:24","port":15001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_15001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31353030310a","method":"","user_agent":"","ja3":"","session":"06812e24-67ba-4e22-bcf5-2864afdfda03","seq":1,"duration_ms":100,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"7ebbbbbbb1a3d25f","strings":["MGLNDD_<HONEYPOT>_15001"]}},{"timestamp":"2026-10-04T07:16:36","port":9990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393939300a","method":"","user_agent":"","ja3":"","session":"672e863b-ab99-46ae-af83-a05994273f55","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"9d0f9a64e3b3ca3f","strings":["MGLNDD_<HONEYPOT>_9990"]}},{"timestamp":"2026-10-04T02:17:02","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323138310a","method":"","user_agent":"","ja3":"","session":"26a15a12-9c70-49c8-825c-5314b5ef1289","seq":1,"duration_ms":101,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"a40f382094844108","strings":["MGLNDD_<HONEYPOT>_2181"]}},{"timestamp":"2026-09-26T20:40:08","port":10443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_10443\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31303434330a","method":"","user_agent":"","ja3":"","session":"83ec9f9c-40a5-4fa8-a821-1b0136cab457","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"aa1ae86abe07091c","strings":["MGLNDD_<HONEYPOT>_10443"]}},{"timestamp":"2026-09-26T16:37:40","port":27018,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_27018\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32373031380a","method":"","user_agent":"","ja3":"","session":"542483b7-4dbc-40f4-bf20-26e53c92d43f","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"cd0ef6ab115b9376","strings":["MGLNDD_<HONEYPOT>_27018"]}},{"timestamp":"2026-09-24T16:01:44","port":5093,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5093\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353039330a","method":"","user_agent":"","ja3":"","session":"ca157966-e5a7-40d0-99d5-35ae7ba32f08","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"986eaa946b6ab9c1","strings":["MGLNDD_<HONEYPOT>_5093"]}},{"timestamp":"2026-09-23T12:56:04","port":8181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8181\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383138310a","method":"","user_agent":"","ja3":"","session":"14379274-7d29-492e-93a7-d1efe35ffb26","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"2f59c79da2fc8a42","strings":["MGLNDD_<HONEYPOT>_8181"]}},{"timestamp":"2026-09-19T18:26:46","port":1433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1433\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313433330a","method":"","user_agent":"","ja3":"","session":"12ea41cd-8b0d-4989-8607-edbef84de0e4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"1cd1e6467fdbf487","strings":["MGLNDD_<HONEYPOT>_1433"]}},{"timestamp":"2026-09-19T13:28:38","port":8086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8086\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038360a","method":"","user_agent":"","ja3":"","session":"57aabeba-e07f-4dd4-aa32-d4e92d4a4f5f","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"d593dd6d23410c6f","strings":["MGLNDD_<HONEYPOT>_8086"]}},{"timestamp":"2026-09-17T10:29:55","port":8086,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8086\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383038360a","method":"","user_agent":"","ja3":"","session":"e21e6237-5585-4c5e-a2c5-15aa6a3fb5ae","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"d593dd6d23410c6f","strings":["MGLNDD_<HONEYPOT>_8086"]}}],"http_methods":[],"distinct_ports_total":10,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-07T02:48:08.772441+00:00"}