{"ip":"40.119.43.33","total_events":25,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 19 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"938 bytes sent","bytes_sent":938,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T06:05:30","last_seen":"2026-10-03T11:56:28","events_24h":0,"events_7d":14,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5632,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T01:15:45","last_seen":"2026-10-06T01:15:45","recent":[{"timestamp":"2026-10-06T01:15:45","port":5632,"src_port":60304,"proto":"udp","app_proto":"","app_protocol":"","summary":"NQ\n","payload_hex":"4e510a","sni":"","session":"fe40bc5f-f893-4997-861b-bee2a700c869","bytes_in":3,"source_verified":false}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":5660,"proto":"tcp","label":"","count":2},{"port":8192,"proto":"tcp","label":"","count":2},{"port":5692,"proto":"tcp","label":"","count":2},{"port":4545,"proto":"tcp","label":"","count":2},{"port":1521,"proto":"tcp","label":"Oracle","count":2},{"port":49152,"proto":"tcp","label":"","count":1},{"port":7777,"proto":"tcp","label":"Oracle","count":1},{"port":5901,"proto":"tcp","label":"","count":1},{"port":1400,"proto":"tcp","label":"","count":1},{"port":15001,"proto":"tcp","label":"","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":7002,"proto":"tcp","label":"","count":1},{"port":554,"proto":"tcp","label":"","count":1},{"port":2404,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cun040_00040016_aa48e2c8":6105},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-17","count":2},{"date":"2026-09-20","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":4},{"date":"2026-09-23","count":1},{"date":"2026-09-24","count":1},{"date":"2026-09-28","count":1},{"date":"2026-09-30","count":5},{"date":"2026-10-01","count":4},{"date":"2026-10-02","count":3},{"date":"2026-10-03","count":2}],"recent_events":[{"timestamp":"2026-10-03T11:56:28","port":2404,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_2404\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f323430340a","method":"","user_agent":"","ja3":"","session":"284a3436-5378-4c24-a3a8-e5955c5ad2a1","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"ae4ae22b9c116465","strings":["MGLNDD_<HONEYPOT>_2404"]}},{"timestamp":"2026-10-03T01:11:01","port":7777,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7777\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373737370a","method":"","user_agent":"","ja3":"","session":"a65e754c-4998-4f40-983f-7090800fc68d","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"fe2ab216aca8db79","strings":["MGLNDD_<HONEYPOT>_7777"]}},{"timestamp":"2026-10-02T19:46:48","port":512,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_512\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3531320a","method":"","user_agent":"","ja3":"","session":"3fd47c25-8838-4476-9524-aab5d0099c9e","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":12,"enriched":{"digest":"2690491a0db0c66a","strings":["MGLNDD_<HONEYPOT>_512"]}},{"timestamp":"2026-10-02T03:23:41","port":5660,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"33466e08-9ce6-434f-a086-1bb863f0edb3","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-10-02T03:23:41","port":5660,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5660\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353636300a","method":"","user_agent":"","ja3":"","session":"b7471732-73b0-4dfb-9df9-deeeb9f4d1de","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"036d84c66a9858ee","strings":["MGLNDD_<HONEYPOT>_5660"]}},{"timestamp":"2026-10-01T11:45:10","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000m\u0000\u0000\u0001\u0000\u0000\u0000\u00018\u0001,\fA \u0000��\b\u0000\u0000\u0001\u0000\u00003\u0000:\u0000\u0000\b\u0000AA\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","payload_hex":"006d0000010000000138012c0c412000ffff7f08000001000033003a000008004141000000000000000000000000000000000000000000000000284445534352495054494f4e3d28434f4e4e4543545f444154413d284349443d2850524f4752414d3d7a677261623229292929","method":"","user_agent":"","ja3":"","session":"01386350-2d47-44bb-ad68-88256a3472e1","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":12,"enriched":{"digest":"30081fcac0a42ce3","strings":["(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))","AA(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=zgrab2))))"]}},{"timestamp":"2026-10-01T11:45:10","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1521\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313532310a","method":"","user_agent":"","ja3":"","session":"cf121a4c-5911-4c4a-a7fe-20eb6f86c0f7","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"7df169f8f64e78c9","strings":["MGLNDD_<HONEYPOT>_1521"]}},{"timestamp":"2026-10-01T10:46:49","port":264,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Q\u0000\u0000\u0000\u0000\u0000\u0000!","payload_hex":"5100000000000021","method":"","user_agent":"","ja3":"","session":"06d721e8-0776-4b46-9dbb-8c9e974dbf55","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":12},{"timestamp":"2026-10-01T01:19:43","port":554,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp:// RTSP/1.0\nCSeq:0\n","payload_hex":"4f5054494f4e5320727473703a2f2f20525453502f312e300a435365713a300a","method":"","user_agent":"","ja3":"","session":"f22063af-35d6-48c2-9aab-6120570d29b0","seq":1,"duration_ms":101,"bytes_in":32,"bytes_out":77,"enriched":{"digest":"c44e5f533d245277","label":"HTTP","strings":["OPTIONS rtsp:// RTSP/1.0","CSeq:0"]}},{"timestamp":"2026-09-30T14:52:28","port":1400,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1400\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313430300a","method":"","user_agent":"","ja3":"","session":"f744bdcf-7bf1-47be-9237-cc8e8b4509fb","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"6c961e28437e9eaf","strings":["MGLNDD_<HONEYPOT>_1400"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":19,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-06T22:52:43.023177+00:00"}