{"ip":"40.124.117.28","total_events":31,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 19 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,682 bytes sent","bytes_sent":2682,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-15T17:47:30","last_seen":"2026-10-06T10:56:14","events_24h":1,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"San Antonio","lat":29.4227,"lon":-98.4927,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"netbios","events":1}],"ports":[{"port":137,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T21:29:22","last_seen":"2026-10-06T21:29:22","recent":[{"timestamp":"2026-10-06T21:29:22","port":137,"src_port":41759,"proto":"udp","app_proto":"netbios","app_protocol":"netbios","summary":"NetBIOS node status query *","payload_hex":"e5d80000000100000000000020434b4141414141414141414141414141414141414141414141414141414141410000210001","sni":"","session":"b3eccfa3-edf9-4aa6-8d34-08e1d36b6bac","bytes_in":50,"source_verified":false,"enriched":{"digest":"5e140ecfd11c0972","strings":["NetBIOS node status query *"]}}]},"top_ports":[{"port":4200,"proto":"tcp","label":"","count":2},{"port":1443,"proto":"tcp","label":"","count":2},{"port":5985,"proto":"tcp","label":"","count":2},{"port":8192,"proto":"tcp","label":"","count":2},{"port":435,"proto":"tcp","label":"","count":2},{"port":18480,"proto":"tcp","label":"","count":2},{"port":3389,"proto":"tcp","label":"RDP","count":2},{"port":8001,"proto":"tcp","label":"","count":2},{"port":502,"proto":"tcp","label":"","count":2},{"port":8022,"proto":"tcp","label":"","count":2},{"port":631,"proto":"tcp","label":"IPP","count":2},{"port":7199,"proto":"tcp","label":"","count":2},{"port":8098,"proto":"tcp","label":"","count":1},{"port":28015,"proto":"tcp","label":"","count":1},{"port":3128,"proto":"tcp","label":"HTTP-proxy","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"e54ef3ec27fe1fea7ab64d3fa05359fd":568,"b11cun040_00040016_aa48e2c8":6102,"b11cuq060_00050816_84d4cebf":342},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":4,"ips":341}},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-15","count":2},{"date":"2026-09-18","count":1},{"date":"2026-09-20","count":3},{"date":"2026-09-25","count":8},{"date":"2026-09-27","count":5},{"date":"2026-09-28","count":2},{"date":"2026-09-29","count":4},{"date":"2026-10-02","count":1},{"date":"2026-10-03","count":4},{"date":"2026-10-06","count":1}],"recent_events":[{"timestamp":"2026-10-06T10:56:14","port":3128,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3128\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333132380a","method":"","user_agent":"","ja3":"","session":"367e2b07-a50e-416a-84c9-f8b731a36482","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"f2dd72b325ce9695","strings":["MGLNDD_<HONEYPOT>_3128"]}},{"timestamp":"2026-10-03T19:50:49","port":8001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8001\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"c308e8d9-6450-4314-bc58-b0a819fd5f41","seq":1,"duration_ms":101,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-10-03T19:50:49","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383030310a","method":"","user_agent":"","ja3":"","session":"58737f1a-3206-429d-b547-73c5f1ed7495","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"3ed69731b6b303f2","strings":["MGLNDD_<HONEYPOT>_8001"]}},{"timestamp":"2026-10-03T16:34:51","port":8192,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9c02362a-34f8-4d23-bb8b-2bd418f07224","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-03T16:34:51","port":8192,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_8192\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f383139320a","method":"","user_agent":"","ja3":"","session":"04b3d9e1-17bf-4d99-820d-c41b9072816b","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"f53fc1d1ca0d8cb9","strings":["MGLNDD_<HONEYPOT>_8192"]}},{"timestamp":"2026-10-02T09:33:51","port":8098,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8098\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/stats","summary":"","payload_hex":"474554202f737461747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383039380d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"052bf110-9950-49cc-8fc4-b14817b3758e","seq":1,"duration_ms":101,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-09-29T10:20:18","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"03bb41f3-d143-4e3d-a2e7-7b702ee0b4b0","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-29T10:20:18","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7199\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373139390a","method":"","user_agent":"","ja3":"","session":"03ba0d2f-d7ba-421a-8c96-ba2539f087e9","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"89d34933f5b8c511","strings":["MGLNDD_<HONEYPOT>_7199"]}},{"timestamp":"2026-09-29T09:44:02","port":4200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4200\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"02c60ba2-0126-4a87-8525-5238454b3dc7","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-09-29T09:44:02","port":4200,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4200\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f343230300a","method":"","user_agent":"","ja3":"","session":"075cd4b4-6c91-4571-9898-46f16ee5f501","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"399b514ef4dfabfb","strings":["MGLNDD_<HONEYPOT>_4200"]}}],"http_methods":[{"method":"GET","count":6},{"method":"POST","count":1}],"distinct_ports_total":19,"top_paths":[{"path":"/","count":5,"ports":5},{"path":"/ipp","count":1,"ports":1},{"path":"/stats","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-07T00:27:38.051858+00:00"}