{"ip":"104.155.24.112","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,009 bytes sent","bytes_sent":1009,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T06:18:50","last_seen":"2026-10-01T07:38:09","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"112.24.155.104.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c0030334b608f0bcc25919477a9b5aafd263361595fa2ffdc2120dd11183344626c514206f336dd888bedb77628af9aa5b026d6e565aa6f9045db8067c8008f7fde36db00032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c084c712b5a74416e31ed0ac6ebb955f02b58329c66e59a63d1a8026b9c1a03632135fa97dbba94d0137a99bfc4303a58f0cca6c718214fc06ad59342344cc49a9b7c549232490c6ad0a450003367bcd415538c93d9baa98f3b9c9020a8561089e062b2ebb7336396735a78a44c1415e66d5147973336635c5190c2d65f341fb986786c6c6680014e6983af47179f6d356121547e34653b4516f58762abe5160cdd7aacc25bce6fb532be1b7ab5611a2db1143c7333829a57359c1687543276c09f1ac4ba529185bd36ae3f665bfc7984dd54877033fa8ab3a2515a9aa827244c356bbc915b83245eec0b04b799a12c67e7c984cf42c9ee61a4f5729995bb41c39e70fe50bcba829103576a816043eca17b92e20c34aa8cd1825928c5a127099794c0c4b60f1c5e5b137de9618f97ccd8142386ec50ee8106862f63824f083ff7c622f6899a6407c60542130babbaf6205e3965e9e3257375647407523b1f9b924a090057302c6d3657ad151888645cde938ae46837e573e1ab069c1e93e1e609642246b08b027b2724ebd175cd2c96a86523024d264adeb0974cb308a674cb648331de227a6a91ec3109d9e9a82f6dcac1edcbb8ad72ddb550b545c951db7436cab0f20c42921d42541ab36638a15ffec4d703641b0da8f9858166c89b44ee6410e53842563b16c2c145992060975badbbba0edb9739a651bdaf335a5f1560fa34cc327bb6fe9cfd82b57e7d517191b43d051c2d6e9782d4ca589e31852356ecdec76ebe64d006623e47ca182e27055724508828cf5b99cc9c2c8f935aa2193b3c1e06e2486bf62482a8eb2023351b3f3929fd48484523a47d9320f8b6c6738b7be16f51a2abb254ec890e958b97e380a42a936a8d089055aa79f9557cdb10b16814a344b7569091f7ae20ed118230516752be9c0159198215208e351bce8c282facb5654031075b60b971587ba922344e374a70794cf33908f8b6d7074b7b9981448b3042cd5234d38580a781c0ee6221d0230f3aa5ab244bba0e0b339ac407cd7ab9b45bed5508944c91cb2502f893c4be6e2b57dd89c9ce11600da6782815d80f55295674f1454839ae16c923049c7c7493f1929502937ad2cbf36674c1347b72b69acb42002112263c3491a1d96cebdc57e52354e0a73116a1140bc453cb8643d52e2262b444f7b84a838a23431b448c5d32bf23117a4ba575d7294764767e997601ec3967a5656a4071be9f41fd93025005db5281c98a653bc7838bbc3b1825b7269f230ab90a0999909babd070629ec5912a4ad4dd119240c41589067c3006a3605c57271942369084e38328a5359cf8212661842b16b8a3597310060aefbe253ad905b9d604d2e2889f592c95256157e436e429a2415160a5a55805a142f47916a1e82466c1a20af3320ece9814fb18a53e56bd4199733a0b4a7b795cf974fb768520764061c84342d0cc37130615271778243b8127005a76c0758855024a19064ba27eac704e1a85780a4c7e01397ebe82b59a9b2e9f90564c47ddd5c5e9c9170c8c1b8e6441417a965ad0b3c8e7b6b9c3751fe69b8b1aa307f45c704886476152d5f380611a26cf746206208cd6d355f19008f95b239ed81016eb44af9ce197ea5c95fec71f73a4eb1061e222add5135daaef02371d0d8f636ef1c03f1dbc8e78f3df2ec22d69a918b69667556f736baa70d015ac0f3efded1857345001d0020f1dbc8e78f3df2ec22d69a918b69667556f736baa70d015ac0f3efde","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2002,"b11cun030_00040012_13ee3d34":5052},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-01","count":20}],"recent_events":[{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"64ee8cee-f95e-4667-8cf4-e096a2012b1e","seq":1,"duration_ms":10,"bytes_in":191,"bytes_out":34},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"baf44dc3-3541-4d8b-9db7-8e8a08ccc35a","seq":1,"duration_ms":111,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3686ab49-d04c-425f-a2b3-91f96ea113dc","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"40664852-9c99-40fb-9a59-0ccf725d8365","seq":1,"duration_ms":110,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004N.��`2\u0002\u0001\u0003\u0004\u0017cn=pjkrwobciyndshmgjkje�\u0014pjkrwobciyndshmgjkje","payload_hex":"303a02044e2efd8260320201030417636e3d706a6b72776f626369796e6473686d676a6b6a658014706a6b72776f626369796e6473686d676a6b6a65","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ee8500c1-53ed-419a-8db3-f08efce4981e","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"617fe2af16eab453","strings":["cn=pjkrwobciyndshmgjkje","pjkrwobciyndshmgjkje"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"de545726-fcdb-44bd-9c58-eaeb617fc073","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006DsaKUS","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100064473614b5553","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"52cdfe06-ffeb-44b6-b96a-a20bd66a5161","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"d97b1de0df280793","strings":["adminclient-5","DsaKUS"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f9a7fde0-e53e-4b53-8e8d-a72f5601dd34","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4a312cc0-c32d-4760-b649-692619cde5fc","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-01T07:38:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"00770ada-061e-45db-af6f-113168c94e5d","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:990","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-02T21:48:40.912773+00:00"}