{"ip":"52.180.154.81","data_as_of":"2026-10-26T12:34:22+00:00","observed":true,"total_events":13,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"574 bytes sent","bytes_sent":574,"session_seconds":1,"persistent":false},"basis":"combined"},"first_seen":"2026-10-13T17:05:09","last_seen":"2026-10-26T04:02:10","events_24h":2,"events_7d":8,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":1194,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-20T13:37:58","last_seen":"2026-10-20T13:37:58","recent":[{"timestamp":"2026-10-20T13:37:58","port":1194,"src_port":48354,"proto":"udp","app_proto":"","app_protocol":"","summary":"8\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\n","payload_hex":"3801000000000000000a","sni":"","session":"b990fb68-174d-44eb-8501-671137f14edb","bytes_in":10,"source_verified":false}]},"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-18T04:48:18","last_seen":"2026-10-18T04:48:18","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":7473,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":5986,"proto":"tcp","label":"","count":2,"sessions":0},{"port":17990,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7077,"proto":"tcp","label":"","count":2,"sessions":0},{"port":520,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1930,"proto":"tcp","label":"","count":1,"sessions":0},{"port":10911,"proto":"tcp","label":"","count":1,"sessions":0},{"port":194,"proto":"tcp","label":"","count":1,"sessions":0},{"port":389,"proto":"tcp","label":"LDAP","count":1,"sessions":0},{"port":7777,"proto":"tcp","label":"Oracle","count":1,"sessions":0},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":1,"sessions":0},{"port":7473,"proto":"tcp","label":"HTTP","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea030311c0202d6cc1bd3a71cac7dfd32c86a5ac76101d0a6a0c4d6f2726092a5de13e206501ddf6b2540a80f0ff750925f40dc21f47a22f66af93830fc758417c81cfa20026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d002020c3239c8dfd4bb4be4dac68dfc37d6df2c4a0f3de223cdfb5bb7341","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3303,"b11cun040_00040016_aa48e2c8":5564},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-10-13","count":1,"sessions":0},{"date":"2026-10-14","count":1,"sessions":0},{"date":"2026-10-17","count":1,"sessions":0},{"date":"2026-10-18","count":0,"sessions":1},{"date":"2026-10-19","count":3,"sessions":0},{"date":"2026-10-20","count":2,"sessions":0},{"date":"2026-10-23","count":1,"sessions":0},{"date":"2026-10-24","count":1,"sessions":0},{"date":"2026-10-25","count":1,"sessions":0},{"date":"2026-10-26","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-26T04:02:10","port":17990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_17990\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31373939300a","method":"","user_agent":"","ja3":"","session":"83fad613-943b-4a6a-aa5b-e05653bc087c","seq":1,"duration_ms":90,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"69a7980084b38b31","strings":["MGLNDD_<HONEYPOT>_17990"]}},{"timestamp":"2026-10-26T04:02:09","port":17990,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"5816544a-b0b3-40d1-9b8b-12af2739c0c9","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-10-25T05:54:33","port":5269,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5269\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353236390a","method":"","user_agent":"","ja3":"","session":"678a6798-d510-4285-a200-43600dc3e482","seq":1,"duration_ms":75,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"680f85abd1c8c06b","strings":["MGLNDD_<HONEYPOT>_5269"]}},{"timestamp":"2026-10-24T02:18:23","port":194,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_194\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3139340a","method":"","user_agent":"","ja3":"","session":"ab7cd24d-c7f3-42dd-8afe-197fc6223b06","seq":1,"duration_ms":74,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"c88322ee70272854","strings":["MGLNDD_<HONEYPOT>_194"]}},{"timestamp":"2026-10-23T16:55:38","port":520,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_520\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f3532300a","method":"","user_agent":"","ja3":"","session":"065fb2e4-97f9-4f53-8c3f-a05341d86030","seq":1,"duration_ms":90,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"83084d3add49c508","strings":["MGLNDD_<HONEYPOT>_520"]}},{"timestamp":"2026-10-20T01:46:46","port":5986,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_5986\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f353938360a","method":"","user_agent":"","ja3":"","session":"45f1bb37-3edf-4711-88b4-f18b487f41f0","seq":1,"duration_ms":88,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"45c8b82d7c68fec9","strings":["MGLNDD_<HONEYPOT>_5986"]}},{"timestamp":"2026-10-20T01:46:46","port":5986,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5986\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938360d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"9242771f-308c-41b8-9e63-826e3b700cf0","seq":1,"duration_ms":101,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-10-19T18:43:08","port":1930,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_1930\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f313933300a","method":"","user_agent":"","ja3":"","session":"2de4783f-2610-4b70-ac57-1d05e7355f52","seq":1,"duration_ms":78,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"935d77ae593e8ec2","strings":["MGLNDD_<HONEYPOT>_1930"]}},{"timestamp":"2026-10-19T09:17:15","port":7077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_7077\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f373037370a","method":"","user_agent":"","ja3":"","session":"a3f08232-13e0-48e4-bf6c-ba6647c7bf72","seq":1,"duration_ms":75,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"6c07ea497ceb0b73","strings":["MGLNDD_<HONEYPOT>_7077"]}},{"timestamp":"2026-10-19T09:17:15","port":7077,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"18ac760c-afe0-492e-b454-c05d07b1d0c8","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/browser/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5986","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}