{"ip":"104.199.44.9","total_events":36,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["36 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,948 bytes sent","bytes_sent":1948,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T03:04:22","last_seen":"2026-09-28T07:31:06","events_24h":0,"events_7d":36,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"9.44.199.104.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":110,"proto":"tcp","label":"POP3","count":36}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003030101cca57332ba912b456a38d917867d35ea65397fe3977f3ec0ed010208184820fd588dc8cafec6213788e8da54fdf0c29eeee869eac03a16fdbb8d5e36e1f5b40032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c051d334cc16c8ed87a3e410cd997468deac319381bea5f10763dc2c0c072054a560aeca3cab1810adc94ab20671523269307262632226cb55569de84760012b4c38a1767748cf98cb67c53306b7b4f367119836211b227ca734c9ae6c77a4265e756285b139983a8c0ef6a230d48a4acda0132e69b85eb69b13f05195f71f5ef6604d5359c1e7c735b731c4d948aad1996d156e90a8b83611a83de77a7c0cad0df6999c7cb6dfeb8e51832d84b77232558ee878ce980433df01a355101051f665c53a4a8627825a76c7cc051298334df11945d116a168d43859c49d15307c90886465f34acdd47a5ad23335642576d6a5ec509bf697c8de86595e2a3130218585a7bf0ef064b37570f50899451327fb3ac0bcb77e950505c1d5701d116890b6331911467c33c10c964f44b708315a498a878d27b3b8f3a455fcb0325b2c7d653720d8d1934d117d70536d5c33a50e8150d43438d76aa730d72e1bd9af7c547a9eb570bb7c4e106a236d862a030368c6ac48a96a1a87d98532e9231b7b1d87336999e41813a3be8a256b8e4b0b27a8bc8043859ff4b79e9b6b19d08e6ac47b10d191708c5d5293908936286a9c6f82d95c5e1b4228b5bb2df9231d26c537d4083d640553b128f90007181c5a633cbe08313c28f499d09c4467da3c34fc00f9e3447ad91c2b268295d240261cabe4573abbd1c5773c29d119cdb9f07b3c26ab8d176e82f246c2586b489684fb3364514cc68289bd57c2402c515f7317a2fcb984256ac108f00472facca1eb82628cb186a9c41eec8b18f34d872759ffc7a2cddb94e50c328dca805425220ed6ad0a7b4f5f83bf9fb042efd082d5f3acbec29650f97d186209fdeb934aa46017b37caaa5bba26322c657ac8a693f0a1828d5d0605723482e7145d6aa0b16a2bd8fecb10e505c62c5168da782ff6a5598222f08aa58303a58ca1b7f19a18e9a700ebdfa12cefbafa7260687109e6bf10e6c35aa942465e3a75218bb5ab0c437db2c75ec8452ead21a0a690254a556fe876515558c4d597d94c8ca17301c5ec63798fb9677103e0c60b2a9abb8fbaa99b46164ebd42067e658cb2a7e27b231e68ccc76cc090825a3a657261142b2e7c05c7c4411093b490d55c743588253187869c07095a374c30280d0d7a413e9cb66aaaed6c81f547246f6387ca1977bacfc7236581e51b918e827b48899885190a77cab8bc03a36637c7500faa8e6e9389faa2b8600092d08b68421a033d8819d460a870c492b58605638c76a749cd814ba46b02013a9134e95c258f44e56cc25ffbcb9463207b13aca3e594821b96fa24c91add4474440158d58b65ec29e93275637c29414116d32573834a491fbf815a7e06f7c959b7f0a39619aaa71bb9973524bb989680967c7d3d086529476096b42cbc0925bbcac01f0898be451b59c5bd9810eb42965aba7a2c4f0c60b092e315c90a416035d3160786c835887867e42a9d4aa409c879fd76a0641a2bdcb5cc1a410600a759c00e16ad05b4345a138a8c15c58eb88fc29cb6c5ab484c89f8e0ba1f04b60683a060286ab5e2804974226f5021aba3a63b2070fae0b82ccca5866e2a2e4fa5ba585ca4759a636544345a4a1cef9500afba818b3d8d830b706c38bad3e724988b6c54e622b16d57da2da34ffd4797b5ee6811da441713e3eb15d8013899e32e467c789f0b9287a5941eee93f96a921d0ae49001d00201da441713e3eb15d8013899e32e467c789f0b9287a5941eee93f96a9","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1874,"a11cun030_0000004c_13ee3d34":2672},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":2,"ips":2672}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-28","count":36}],"recent_events":[{"timestamp":"2026-09-28T07:31:06","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006wDFVaU","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006774446566155","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4ec40c8f-007f-4932-be7c-c03712eb8843","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"78cfdeabcc959a88","strings":["adminclient-5","wDFVaU"]}},{"timestamp":"2026-09-28T07:31:06","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4879eda5-c976-4a49-b745-6e1db37c11bf","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-28T07:31:06","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"46dfe94b-8164-43d2-9036-a9b973863fa0","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T07:31:06","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"78f784bf-5eca-44c9-8dfa-f3893cc469b7","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T07:31:05","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004[�9�`2\u0002\u0001\u0003\u0004\u0017cn=uqoijtxmoffbyoquculg�\u0014uqoijtxmoffbyoquculg","payload_hex":"303a02045b96399260320201030417636e3d75716f696a74786d6f666662796f717563756c67801475716f696a74786d6f666662796f717563756c67","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"27948687-b939-474b-a671-59a144b7b600","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"626a04b5bae73b0f","strings":["cn=uqoijtxmoffbyoquculg","uqoijtxmoffbyoquculg"]}},{"timestamp":"2026-09-28T07:31:05","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"709d5b8c-2672-4540-82e1-687d9c1b5f1d","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-28T07:31:04","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"af4e3291-b64b-489f-8600-d28c4ab8fcf7","seq":1,"duration_ms":101,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-28T07:31:04","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7d3a5a69-481c-4b4e-ab6e-b952aff94123","seq":1,"duration_ms":194,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-28T07:31:03","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"bdb8d133-9367-41a5-bd7e-6a7406a8db9d","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-09-28T07:28:08","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4410fb4e-bb95-4751-a9ba-6df6f499626d","seq":1,"duration_ms":108,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":4,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T01:06:22.502429+00:00"}