{"ip":"48.217.82.68","observed":true,"total_events":30,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"19+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 19 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,294 bytes sent","bytes_sent":1294,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-16T16:17:18","last_seen":"2026-10-13T01:49:01","events_24h":0,"events_7d":13,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":4200,"proto":"tcp","label":"","count":2},{"port":989,"proto":"tcp","label":"","count":2},{"port":8581,"proto":"tcp","label":"","count":2},{"port":102,"proto":"tcp","label":"","count":2},{"port":7199,"proto":"tcp","label":"","count":2},{"port":631,"proto":"tcp","label":"IPP","count":2},{"port":502,"proto":"tcp","label":"","count":2},{"port":3000,"proto":"tcp","label":"Web-alt","count":2},{"port":7337,"proto":"tcp","label":"","count":2},{"port":9001,"proto":"tcp","label":"Tor","count":2},{"port":11742,"proto":"tcp","label":"","count":2},{"port":2077,"proto":"tcp","label":"","count":1},{"port":6379,"proto":"tcp","label":"Redis","count":1},{"port":9080,"proto":"tcp","label":"","count":1},{"port":5901,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq060_00050816_84d4cebf","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"b11cuq060_00050816_84d4cebf":334,"b11cun040_00040016_aa48e2c8":5475},"akin_families":{"b11cuq060_00050816_84d4cebf":{"head":"b11cuq060_00050816_84d4cebf","shapes":4,"ips":333}},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-09-16","count":2},{"date":"2026-09-24","count":1},{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":2},{"date":"2026-09-30","count":3},{"date":"2026-10-01","count":1},{"date":"2026-10-06","count":6},{"date":"2026-10-08","count":3},{"date":"2026-10-09","count":5},{"date":"2026-10-10","count":3},{"date":"2026-10-13","count":2}],"recent_events":[{"timestamp":"2026-10-13T01:49:01","port":11742,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0017�$\u0000\u0000\u0000�|P\u0003\u00003�6��\n\u0002\u0002e-�\u0005���\u0002�\u0000\u0004q\u001e.[","payload_hex":"000117e824000000c57c500300338c36afca0a0202652dde<HONEYPOT>02c20004711e2e5b","method":"","user_agent":"","ja3":"","session":"9b247f07-98fb-49f4-95b5-873a73d2be96","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":12},{"timestamp":"2026-10-13T01:49:01","port":11742,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_11742\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31313734320a","method":"","user_agent":"","ja3":"","session":"2c8c27ef-c43d-4618-979a-61be3cf4cce6","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":12,"enriched":{"digest":"7018c03c00043b98","strings":["MGLNDD_<HONEYPOT>_11742"]}},{"timestamp":"2026-10-10T15:19:16","port":6379,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"info\n","payload_hex":"696e666f0a","method":"","user_agent":"","ja3":"","session":"f30d09c7-a769-4fca-876a-e130fc99f9e7","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":5,"enriched":{"digest":"886ead46232ac934","strings":["info"]}},{"timestamp":"2026-10-10T08:30:08","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"6d6d81f5-d93b-4068-ba37-e22d438a2369","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-10-10T08:30:08","port":989,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_989\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3938390a","method":"","user_agent":"","ja3":"","session":"6b6196fd-df87-4d65-b664-84fa231c0685","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"25b5023164b356a8","strings":["MGLNDD_<HONEYPOT>_989"]}},{"timestamp":"2026-10-09T22:09:00","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7199\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373139390a","method":"","user_agent":"","ja3":"","session":"b831acd5-fc0b-4cf1-8c44-6b19d20373d4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"89d34933f5b8c511","strings":["MGLNDD_<HONEYPOT>_7199"]}},{"timestamp":"2026-10-09T22:08:59","port":7199,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e17ece3d-19af-439c-9eea-2a60f1a6ed06","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-10-09T16:10:26","port":3351,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_3351\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f333335310a","method":"","user_agent":"","ja3":"","session":"4612d76b-fcd5-4738-b171-b7412f290530","seq":1,"duration_ms":63,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"aa5283422704de78","strings":["MGLNDD_<HONEYPOT>_3351"]}},{"timestamp":"2026-10-09T16:07:15","port":20,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_20\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f32300a","method":"","user_agent":"","ja3":"","session":"90d736ec-a165-4a32-98c5-d0813fe1cdff","seq":1,"duration_ms":63,"bytes_in":23,"bytes_out":12,"enriched":{"digest":"40b085a52b2d8565","strings":["MGLNDD_<HONEYPOT>_20"]}},{"timestamp":"2026-10-09T00:09:51","port":9001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9001\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393030310a","method":"","user_agent":"","ja3":"","session":"a6d4ebdf-14d9-435d-a9b5-a7c16a0cb70f","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"a2d160dae56ecaa7","strings":["MGLNDD_<HONEYPOT>_9001"]}}],"http_methods":[{"method":"GET","count":4},{"method":"POST","count":1}],"distinct_ports_total":19,"top_paths":[{"path":"/","count":3,"ports":3},{"path":"/ipp","count":1,"ports":1},{"path":"/v1/submissions","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-15T04:41:03.436843+00:00"}