{"ip":"40.67.173.253","observed":true,"total_events":20,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"15+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 15 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"758 bytes sent","bytes_sent":758,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-22T06:59:27","last_seen":"2026-10-10T08:28:31","events_24h":0,"events_7d":2,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":102,"proto":"tcp","label":"","count":2},{"port":6666,"proto":"tcp","label":"","count":2},{"port":993,"proto":"tcp","label":"IMAPS","count":2},{"port":162,"proto":"tcp","label":"SNMP","count":2},{"port":989,"proto":"tcp","label":"","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":1},{"port":2000,"proto":"tcp","label":"","count":1},{"port":1666,"proto":"tcp","label":"","count":1},{"port":8181,"proto":"tcp","label":"","count":1},{"port":28015,"proto":"tcp","label":"","count":1},{"port":1723,"proto":"tcp","label":"PPTP","count":1},{"port":636,"proto":"tcp","label":"LDAPS","count":1},{"port":6667,"proto":"tcp","label":"IRC","count":1},{"port":115,"proto":"tcp","label":"","count":1},{"port":5357,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea0303313c4c0be82d4de9c55427b19fff77b866930fdb2a51d4ec141913ae4ba563702091f444de0647a039c9a452cdbe69eda63b4354c40596b8aaa6f5cd7756d402710026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d0020d70273f329aa20df444b734c7fc6f19b116b78b394e4a456c1aa8dd4","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2990,"b11cun040_00040016_aa48e2c8":5475},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":3},{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":1},{"date":"2026-09-30","count":1},{"date":"2026-10-02","count":1},{"date":"2026-10-03","count":1},{"date":"2026-10-05","count":3},{"date":"2026-10-07","count":2},{"date":"2026-10-10","count":2}],"recent_events":[{"timestamp":"2026-10-10T08:28:31","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e2b7c172-56c3-47a5-9059-6f258765c37e","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-10T08:28:31","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_989\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938390a","method":"","user_agent":"","ja3":"","session":"61a9f981-c03a-48d8-9eee-40f06c5d06ef","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"25b5023164b356a8","strings":["MGLNDD_<HONEYPOT>_989"]}},{"timestamp":"2026-10-07T10:10:15","port":162,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"dd2e3c5f-99c6-421c-86ea-be3ad7d1499f","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-07T10:10:15","port":162,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_162\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3136320a","method":"","user_agent":"","ja3":"","session":"47559dc3-50d7-437e-bd36-b1dd014e836d","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"bc661b870a67c30a","strings":["MGLNDD_<HONEYPOT>_162"]}},{"timestamp":"2026-10-05T12:16:18","port":115,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_115\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3131350a","method":"","user_agent":"","ja3":"","session":"3d540817-0bfd-4776-a6d4-47f11d0a3fce","seq":1,"duration_ms":101,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"7f5ab1dee1c728d8","strings":["MGLNDD_<HONEYPOT>_115"]}},{"timestamp":"2026-10-05T11:46:16","port":28015,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L\u0012e�","payload_hex":"4c1265af","method":"","user_agent":"","ja3":"","session":"d83f66a6-408c-4e13-a1df-50324730d17e","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-10-05T03:34:55","port":1666,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0013\u0013\u0000\u0000\u0000func\u0000\t\u0000\u0000\u0000user-help\u0000","payload_hex":"131300000066756e630009000000757365722d68656c7000","method":"","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"656addcb-b254-4d2e-bb69-7ae3d7ae89c7","seq":1,"duration_ms":100,"bytes_in":24,"bytes_out":13,"enriched":{"digest":"2a1ba182a37dbed7","strings":["func","user-help"]}},{"timestamp":"2026-10-03T16:28:54","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000'\u0000\u0000\u0000\u0001buildinfo\u0000\u0000\u0000\u0000\u0000\u0000\u0000�?\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000","payload_hex":"3c0000000200000000000000dd070000000000000027000000016275696c64696e666f00000000000000f03f02246462000600000061646d696e0000","method":"","user_agent":"","ja3":"","session":"efc7911f-c63e-4544-86ae-587b070da98b","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":13,"enriched":{"digest":"6371344753a04bc5","strings":["buildinfo","admin"]}},{"timestamp":"2026-10-02T19:15:08","port":636,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_636\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3633360a","method":"","user_agent":"","ja3":"","session":"65f74b18-dd32-43fd-988c-5cac42427846","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"00aac3421c152ab8","strings":["MGLNDD_<HONEYPOT>_636"]}},{"timestamp":"2026-09-30T00:13:13","port":1723,"proto":"tcp","app_proto":"","app_protocol":"pptp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001��\u0001\u0000local\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ixia\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d00010000010000000000000100000001ffff01006c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000069786961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"7605ff72-6448-4468-881d-9e6d05e52c6f","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"e6496ea510190464","strings":["local","ixia","localixia"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":15,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T04:41:10.941434+00:00"}