{"ip":"104.199.111.106","total_events":24,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["24 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,771 bytes sent","bytes_sent":1771,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-24T03:29:00","last_seen":"2026-09-24T09:37:37","events_24h":24,"events_7d":24,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"106.111.199.104.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":636,"proto":"tcp","label":"LDAPS","count":18},{"port":445,"proto":"tcp","label":"SMB","count":4},{"port":389,"proto":"tcp","label":"LDAP","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i781000_ab95583b6d39_d41ae481755e","t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c0030393c8be655ecc3f134c9a300bedbf6128af7264237e0ec12ae9cd484158c9a9da20fda2607199cc6905fdef1a5fbf40037224540161acd62cd68a7da691d4ea1e380032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0ec3c01cbc07cfab592c35091fe924a209c765eb13d70856691974865a819d3c12770a2b23b84a2e699940b5443e82448bce05cc8731b4fb9976eb2aa8c3325a878626d786fa0a39a40ca3f671152969777ba75199048a22452920b5ba2d6290eed607a7073981fbbac20881d5d766af8385c04215572b685fa0671342b69ed975dcce66fa26c3769bc98e41b790eec91985304b30369cbc18dce5c1aaef7b9ef98669503cd65f65088624c093621e32951979543c840b6081986b27c9bc1776b27ab96f10930dfa6b2f628b94f079847e3177f018ee58a2db82c6d97f93b6eebcbe422034a310730d85a3efa3fd613c998259c3e72214f319f04b553908b2515141c1e898531f21aab7a47ff24c77f3a996aeb1defa3b0ca2394a80a856da9081070c00127a803ca1d4b316a0d821202a04c09555f1423a2a985aff1e40d09a296cf05340d65061886ba88bc64bab692b101acd77b8fc0580bd3505e6a12893a162276f9831aca7d6abcafd08c74311210a35873b04b50d5d08922f748df9863b604611acbaa5cc89e43c83901a2c916f1bc394133326261ac4a26f4f15f1c4800fd92a96645c8faf5b19307b29d9484b4f6c7a22451221a08f1b9103e93c8a3e33935605884e132d8432f9857412048a6a8669a2cf8663b2977df449fe6945c0752a5b0d4946bec48ef48961cb39f51d25512a2a6bc886123d65637167767fc771ca854867825253a754135385257b7a8e89c686b9ba8190cb5a072e896267c64b1e8a3a5d3caa8a99a3ee127553d9a72c3b0c7b5ca684e872620e1920f592cd29abe9374cb2594573336b8f60924bc475732633de74a182daa38aa607c2fd58016445d67725045bb65c64943fbe54bb3a9c41aa102cba15d06c320ed829db90741e101adbd0299c8f1b6ac480d7cba0e37772db7a441bc234435262efa8230f1534082c5ab8a308cc7a1a4519a3b655c2bf008969cbb0f31c7ce35a98093609e6806b97710c139413450b8003b722af8951bd6d5393860ca2c4c8e3bdc918a114b05c911e7e85a9aea08b3e655f64926d1e53e4745971c895fd38c6e84e34623591b812905bb75766137a54c717f3720885950c3415cafd463492cf7a04f2ccb79981a552705e7f2454abc8d33f970fd30cbc1c06100bca9ce38a3a4a87986c7542e5c3da3a34969f92d91979112c9abd509badbd144d7924d7ce293822c248ce2c7a8984868c875896c23bcf3caf2829f8964bd4da16eba3aa8cadb31ff05ce2086ae6f1c23b9e26f277721d197470a866a55e3392b520719724930b30b4a47458191224a8c3f534b0ca2674888c81419a6cddbf3a61171961d9c480edb37513c8e805a20df5a84cbc571181133d0289a6ba5a856f81a4ba27f79536cb54ac5bcd5892af764cbb0c63fe2b8530c9141ca97404a1c102cb6e3927250954e2a73598db6c79915b5ee7801a17564ad273df19372d3c1c49d196af70317b7cc6440394dcdab1e28d02bd525755cc0cc704c9220448da0b70a533650d88a6220e1a90ba34934f66fec34274494566ce629d24930c45533a5112e411ca6ff4b6db5db697c1c47928041b00896f2dbb4ae93a37c4a6a78d117bc83a6172a60693832573e1acad7f2734acb3dad509087ed7ed97bef64c50719ea72090363750accee8f610c60bf7e8f93f251d153cff036f61169cb36717d9a9ec051691bd1248e32001d00208f610c60bf7e8f93f251d153cff036f61169cb36717d9a9ec051691b","tls_ja3":["b3e88a126e6e0179ae465227a52f60ad","9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34","a10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i781000_ab95583b6d39_d41ae481755e":301,"t13i250900_b78ed14e2fd0_e7c285222651":1961,"a11cun030_0000004c_13ee3d34":2230,"a10lun000_00000000_334359b9":320},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2232}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":24}],"recent_events":[{"timestamp":"2026-09-24T09:37:37","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0013333333333333337\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0002","payload_hex":"00000066fe534d4240000000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000001333333333333333333333333333333700000000000000000202","method":"","user_agent":"","ja3":"","session":"217c1ddb-ef97-4ff3-936b-fdd74aa87ffa","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":15,"enriched":{"digest":"b8b1f8a40c33d940","strings":["SMB@","333333333333337"]}},{"timestamp":"2026-09-24T09:37:37","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a3434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"63b21f3e-cd6a-4d47-9b4c-57fcb80bd8ab","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":80},{"timestamp":"2026-09-24T07:36:59","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:389\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3338390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"d067cc64-3e99-4b4d-acc5-07ed6a250f52","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":80},{"timestamp":"2026-09-24T07:36:58","port":389,"proto":"tcp","app_proto":"","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0:\u0002\u0004P��C`2\u0002\u0001\u0003\u0004\u0017cn=yrmxirefvlmxhwqtebjv�\u0014yrmxirefvlmxhwqtebjv","payload_hex":"303a020450eb994360320201030417636e3d79726d7869726566766c6d786877717465626a76801479726d7869726566766c6d786877717465626a76","method":"","user_agent":"","ja3":"","session":"298a07e5-0827-4145-9e0c-a28da85ab01a","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":15,"enriched":{"digest":"515c85ed906f1a85","strings":["cn=yrmxirefvlmxhwqtebjv","yrmxirefvlmxhwqtebjv"]}},{"timestamp":"2026-09-24T07:05:08","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"e615c1d6-ce96-4222-b9bc-57358c06fc98","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":80},{"timestamp":"2026-09-24T07:05:07","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0013333333333333337\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0002","payload_hex":"00000066fe534d4240000000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000001333333333333333333333333333333700000000000000000202","method":"","user_agent":"","ja3":"","session":"479e5bff-dc6a-454f-b094-926ab4f47abf","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":15,"enriched":{"digest":"b8b1f8a40c33d940","strings":["SMB@","333333333333337"]}},{"timestamp":"2026-09-24T04:28:47","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"080fdccf-131f-4f12-8d6e-c96ecf0a1cac","seq":1,"duration_ms":128,"bytes_in":14,"bytes_out":15},{"timestamp":"2026-09-24T04:28:47","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0%\u0002\u0001\u0001c \u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0001\u0001\u0000�\u000bobjectclass0\u0000","payload_hex":"3025020101632004000a01000a0100020100020100010100870b6f626a656374636c6173733000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"92c7bad7-368b-45e5-ba24-fa8ca59350b0","seq":1,"duration_ms":110,"bytes_in":39,"bytes_out":15,"enriched":{"digest":"35bead818e067cb6","strings":["objectclass0"]}},{"timestamp":"2026-09-24T04:28:42","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c��random1random2random3random4\u0000\u0000\f\u0000/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000�\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002","payload_hex":"1603000069010000650303551ca7e472616e646f6d3172616e646f6d3272616e646f6d3372616e646f6d3400000c002f000a00130039000400ff01000030000d002c002a000100030002060106030602020102030202030103030302040104030402010101030102050105030502","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"2d5eac1b-d4f4-497f-a12c-d373b306272a","seq":1,"duration_ms":110,"bytes_in":110,"bytes_out":15,"enriched":{"digest":"53bb04b2d6c97881","label":"TLS/SSL","strings":["random1random2random3random4"]}},{"timestamp":"2026-09-24T04:28:36","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G���,���`~�\u0000��{�Ֆ�w����<=�o�\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000","payload_hex":"16030000530100004f03003f47d7f7ba2ceeeab2607ef300fd827bb9d596c8779be6c4db3c3ddb6fef106e00002800160013000a006600050004006500640063006200610060001500120009001400110008000600030100","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"b43fb570-7200-431b-83d9-26cddea85ffb","seq":1,"duration_ms":110,"bytes_in":88,"bytes_out":15,"enriched":{"digest":"28bd7217cbe4629c","label":"TLS/SSL","strings":["edcba`"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":6,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"185.228.81.201:445","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-24T13:05:00.851243+00:00"}