{"ip":"104.199.26.126","data_as_of":"2026-10-23T09:46:00+00:00","observed":true,"total_events":182,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"140+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 140 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 11 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) tried logins, none got in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"25,971 bytes sent","bytes_sent":25971,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-09-14T07:47:53","last_seen":"2026-10-22T14:29:45","events_24h":3,"events_7d":26,"interactive_sessions":11,"interactive_sessions_24h":1,"interactive_sessions_7d":11,"interactive_protocols":[{"protocol":"http","sessions":8},{"protocol":"smb","sessions":1}],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"126.26.199.104.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":11,"first_seen":"2026-10-16T13:31:48","last_seen":"2026-10-22T14:21:45","verdicts":[{"verdict":"scan","sessions":9},{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":7},{"persona":"smb@Windows Server 2019","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":5602,"sessions":1},{"protocol":"http","port":4250,"sessions":1},{"protocol":"http","port":5003,"sessions":1},{"protocol":"http","port":18108,"sessions":1},{"protocol":"http","port":9148,"sessions":1},{"protocol":"http","port":3151,"sessions":1},{"protocol":"http","port":7173,"sessions":1},{"protocol":"smb","port":445,"sessions":1},{"protocol":"tcp","port":990,"sessions":1},{"protocol":"http","port":24819,"sessions":1},{"protocol":"tcp","port":8873,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":9},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":10,"sessions":1},{"port":9200,"proto":"tcp","label":"Elastic","count":10,"sessions":0},{"port":5432,"proto":"tcp","label":"Postgres","count":5,"sessions":0},{"port":5433,"proto":"tcp","label":"","count":5,"sessions":0},{"port":2049,"proto":"tcp","label":"NFS","count":5,"sessions":0},{"port":8873,"proto":"tcp","label":"","count":4,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":4,"sessions":0},{"port":139,"proto":"tcp","label":"SMB","count":4,"sessions":0},{"port":27017,"proto":"tcp","label":"MongoDB","count":4,"sessions":0},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":2,"sessions":0},{"port":55550,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8575,"proto":"tcp","label":"","count":2,"sessions":0},{"port":56151,"proto":"tcp","label":"","count":2,"sessions":0},{"port":2016,"proto":"tcp","label":"","count":2,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030106130100060f0303c9e8341b63b61e8aa7552b9473176f7b6259347bee0466d706ba28877681fa04206a80b8fc89c50d9340ee004cb26b9d6c0806c4a2514200b12c74b9321f4c1d420048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c02646a2544b9c97f46248959f99f4b2e7020175c21b22d68f8db676f5e914efc05bfdac5022243ec7693697a5314a906a71c6b567f7a284f674da72af928363888063a26510312a920f9630b1566acdcc09620962e939870fa05ff9d46e30466fc743b77dc505cfc8a448dc8d46d7731a2792ea911437d9cc82523327ebc834778ccba241dfba5a90f527aed7a3edf903fe93045ff1a57c1c7c2496156fe080f028157ea0b6479b612d31b9dc52b096771877581c0596c3dd462de3611ef1647957050999555e2fb4397ae10f25ac65f22b96b977040c292f4aa70a851b943ea1b93b8c0061737e2c4670f1797088d83e285a79be052a499cc1ab75797098303beb439d16ae9968c980d6a9c1830ad7064c22656893db39c5203c25ba19cd6648d59c88acf7096b91b3127603a7cb2bc0d685cd770e6fe11609c2360a702381f513ef5612aea24d4b67cceaa84084887bd5f42141b0263931ab6ac926f1cb17712b75648b7b378551f6190be3288423ccb250629c55c90c12ea8be528339e8191c44c2747334fe497bdf9a04f4f970195a03974332038558ecee9243648739eec46a0c972c91a9ee9cccd37239fa575ab19246278785200d68863d1b3f996584a8387c127ac5c11a72f24a35d18b1248299df4976f593934ccc98ed1445416a0876601ebd490baad0cecbc4363bb4040bccc8fe725a8fa1a3428a7a3cc3c143d3231aa4693beca3382463bc1501c1b396bc332f51c2753f2646470c6a84e55407923d0534211d7a0a3d99351e6a77c1b43a1863ce572846a4857ba1fcbe7168b6194c6152633ed3826094443c54b3bfe8c284677a0e557c1f9246548561294a5bb56722055fbb0904ea2319198b06218655aa178ed3b9a86a7a3e89aeded0821aa5c0db35b644259521f87e549b59840786b2cc22906a9bb0ac70fc78b7832c6baee63d0c224e49058c90f89be03c093491261ec9c36806607f14115aa2003654be84902fbc213d8e31a6e09957b16a92459b0784b2ad22057e86d881b6e53a5a70aeaeb3772a0167d897bd77b404e4870358b58b80f570c0928f9df5a210ec5b48a907c5ec5f3c643e69b0722e021f3281ce2cab3cfc55baa2bb019bd6a16be08611a2a68bf47cb223b394d163c6166de131b45e92ca9de5665519214f33c468246866513625b609a516206dc7cf70b3b2c17953241966c548b338062fded69af6732f62c1bc0d03206b1ca7cc26071f8a0b02c70e348594546519fd78492ed378e5b2ca089252e56932eb928a92ab00e959c74ea278e3688d5fb65b33e812f8aa1e90b48056880d7442583b02b5bf49196b19b88d4a588226581f685d0f399e32179603c50cb9ca44613baa91a42f9c0a2ecde6161a0a748d5285ccc352585b7c4f64954829c314dc96dca586833a834cd6108c949b8cf4bfddc98b8a9c820643aa149b7953d31d50016c6bf3307acb37ce94c45c77245d50a88182a7c4fc19660254cae99d64c25e213470f20c30154775424265f0259750a381e35587cb562eed3c6e40bba9445caa93a91a7d71022d29b180f86d47e224ef20c045277c69043c741aa77009045bccca76b4583f05a004f0632ce3125a90bc81a21a80ea91d0df95c8ce493c039c094a0a9348606d44ce5463c95fdc8745b8c2e25a08b573bcd8c174c7fcdd5beb5695fcad249810f9dc7bd859f22245a5a014d5446ea219001d0020dab7495eb8217a25af8c4b271e5026c0478bd758b490bd4faf60b975b4f20363001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["b11cun050_00040017_976354f0","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun050_00040017_976354f0":1239,"b11cun030_00040014_54d07b6d":3801,"t13i3612h1_bcee18a5b459_8537cf56674e":309},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1238},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3801}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0","python-requests/2.32.5"],"timeline":[{"date":"2026-09-14","count":4,"sessions":0},{"date":"2026-09-16","count":5,"sessions":0},{"date":"2026-09-18","count":15,"sessions":0},{"date":"2026-09-19","count":19,"sessions":0},{"date":"2026-09-20","count":1,"sessions":0},{"date":"2026-09-21","count":7,"sessions":0},{"date":"2026-09-22","count":6,"sessions":0},{"date":"2026-09-24","count":3,"sessions":0},{"date":"2026-09-25","count":11,"sessions":0},{"date":"2026-09-26","count":8,"sessions":0},{"date":"2026-09-27","count":1,"sessions":0},{"date":"2026-09-30","count":3,"sessions":0},{"date":"2026-10-01","count":4,"sessions":0},{"date":"2026-10-02","count":4,"sessions":0},{"date":"2026-10-05","count":4,"sessions":0},{"date":"2026-10-06","count":6,"sessions":0},{"date":"2026-10-07","count":8,"sessions":0},{"date":"2026-10-08","count":7,"sessions":0},{"date":"2026-10-11","count":31,"sessions":0},{"date":"2026-10-12","count":4,"sessions":0},{"date":"2026-10-14","count":5,"sessions":0},{"date":"2026-10-16","count":20,"sessions":9},{"date":"2026-10-17","count":3,"sessions":1},{"date":"2026-10-22","count":3,"sessions":1}],"recent_events":[{"timestamp":"2026-10-22T14:29:45","port":12174,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12174\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323137340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"b7a47b4c-dda3-47df-9286-26e1a67a7316","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-10-22T14:21:44","port":18108,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:18108\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31383130380d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"29e69ec2-d0f7-4976-9847-bb76cf892faa-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T14:21:02","port":12247,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12247\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323234370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"b10c125e-f187-462b-a19c-7457cb4477cb","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-10-22T14:20:43","port":16992,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:16992\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363939320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"93ac3005-595e-4db0-bede-de54881c3eab","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-10-17T06:28:30","port":873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"3133f9a8-16cd-49c5-8113-36ec268861b4","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-10-17T05:24:26","port":8873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"c1cb4a10-c74c-4cde-b8e2-f88fad1f924a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]},"interactive":true},{"timestamp":"2026-10-17T05:23:06","port":8873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"26b314e8-d02b-41c2-a35f-25d65fe72f73","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-10-17T04:11:52","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0003�B`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0005M�I\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028038d42600000000000000002000186a3054d88490000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"5fdc785a-256f-47c7-9670-5c0e50587ad0","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14},{"timestamp":"2026-10-16T20:01:23","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"05223165-baee-47f4-94b6-e5ad2471bbff","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":14},{"timestamp":"2026-10-16T19:01:44","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"7734d7d6-1f40-4e53-8341-c892d3b92c06","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}}],"http_methods":[{"method":"GET","count":151}],"distinct_ports_total":140,"top_paths":[{"path":"/","count":151,"ports":123}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:12174","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}