{"ip":"207.175.212.52","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,017 bytes sent","bytes_sent":1017,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T04:16:09","last_seen":"2026-09-30T05:50:06","events_24h":20,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"52.212.175.207.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003035db9b9f8d14c1bb0844d1d097eb883afb6bb5b5c9fa94a6a73428d13fb4a94e2203e4dd9e8eaa9ab8caeb8e3fad37f931e762972ae124ec85e167256be844841110032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c013a4638cb18a4a0c8ecfb155edb9c6c4bb41441ba70f4413d1fb12be87cba4f16e3db2b0a4243674d2b55af51e4a110601f371c1cc2310d280fb2478103bac1c706cd951a46ae223fc93c59606cf7aa031b922b1068a661cf75a1b97b5d3431dcef93b04054673704a1827331ac452d3190c354a1227faba87fa5de02972357a44baa5b2f3e6a4d4c54ac9e2129dd4a8cc35881087b885825670b02f45ec3ceb445d73e3898d6a7917e5b445b740ff3242d28c40eef42ce5960f2a39c3041c35ab2330531a805dc277f9733203ac637c1c1f3289752bd21258752f8c72421a451eda2b04bec1113bcca4c26aa9f52a1afd2a0b9fd0ad2ed058a899427a926a02bbb36ad2cd924b32d68c1fa9c9954bbb19a963cab9c343352b4933371ff1e85a6dfc961b5a3ac4312f37713a03334abc655ea0ba421fd1b3c3834c70e22ba8c837a678174c3acf8060c44da0069fac92849b5fdd5886a6e2a838ba350ca45261b2c59e15c3a8a1178ecc9390b436fd04cb951820b26ac58ad4c117317bb8993da0b23efeda57119b06b67118f1d8ad36313ea47608a669942c566caa4a325d95c6aa8a1ead35944b27a9ce8662ed59a3a8fc3da8b820e49c6df17171e9f809af9b02bb8717b1d2b00068841164159b140a89611cc5c5170e5b7f3fcbbe2d974735738489dc0445011317148f24b537af44877bd173c4496172888dae6033f7483596065504585311a60e2ec5cb28c08035ca825706b5443c4db774471ec241d8f750e5840683825b8d7b095a200964f311dae898c26a8895c9b397f633821326bb98b62f088357348cf9579738569b9f74a9559311bc63ac98e54672fc06ec8cbc2233b9c35423ed3520663283f7c42e81a56aced68c2416a120d12febdbae93b33ea240047671a71c33104a07c626d94d4e7303e77965f3c2c2d1b7091127a0bdd9a6417b25f2393dd4caa707cbb27d4bc0b0751e06f9a65d91bdd83ac30bd983861680f0a26e52b0b2fd87ab880894fcc333d7957506e77e0ba4827b564aae77c28f6084944abd0e1a348efc4f2f132195b86a1de1c91f9892ca0caf1b9790cc739e0904776cea0d2d557723458de06a213828b659b55e14222241627cbe13b9273ba22ca254c04480b9501263048e892a9858701d322945818202c6f37ffa303d33da6bc7a88278e7381a598a8d054d6b618df36b3d2eb0b6a9d7c17a30117238614bd75f1ce53525c1462a194344d64439098552aa8f375a8d6bc32de835139c125eb793100d88c7a5d7c099e65b4c66b02d1c85b3b24c9f916cb333a2de6b4bf23c88898919b40309e3e4bceed936e9c26cb593cbb921c2a05b4d29cbcf2668bc84a48526703b8167b3622ac5f1c2263e405a8b59a12e919cced90a8b552ed3a3342ee115a09489fbe5b3dee9779219b07a0a98f22622ee0300a6a287635ab576d212e1c14d28176aa63146afc6207ef63db6231b1cb71e88b54556c73d1797a110b64dee7a1eb06968e2a44c7f045e6702b8829693f0c6bd5c933690d1ac0d51220a349bd5e06fa327440aaa4c8147cb06d6a519fb6723ec7c94ec9f8263992c906720db85f91845a2994c9da9a057c355800aa0671b46911311b9779bd0ae38f95bf41c4e0142f9fdc6234099318cac93ebc7c65d6427453c9a2929591c1ccb3074dad1afeb1963ed4a1abfa372f3aa5c9084884dd628a2f67cabb461001d00201c1ccb3074dad1afeb1963ed4a1abfa372f3aa5c9084884dd628a2f6","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1926,"b11cun030_00040012_13ee3d34":5089},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":20}],"recent_events":[{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c284a3c8-0f37-467e-9383-786a4886cac1","seq":1,"duration_ms":116,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004p\u001c�`2\u0002\u0001\u0003\u0004\u0017cn=urwndikwiogwlksmnohp�\u0014urwndikwiogwlksmnohp","payload_hex":"303a02047f701cc260320201030417636e3d7572776e64696b77696f67776c6b736d6e6f687080147572776e64696b77696f67776c6b736d6e6f6870","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"afd0ace6-d8ed-4e9e-b88d-e2fecd44ae55","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"0bf314c7f476e882","strings":["cn=urwndikwiogwlksmnohp","urwndikwiogwlksmnohp"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a0d289e8-81f8-48ef-a6c4-b488d336968f","seq":1,"duration_ms":116,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"50bafb53-fc39-4671-b964-7710f9fced77","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006cdpmS6","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100066364706d5336","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"bac81d0a-2d8e-4266-a350-a4a0d1f14bb3","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"5c3c9e91e1d9984c","strings":["adminclient-5","cdpmS6"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"75b4cb8c-4b11-4230-ba20-d6640bbace8f","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"5810add7-1e1e-44d1-b924-192cad7826a7","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T05:50:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"94723460-fb48-405a-a637-50e28cc814fc","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T05:50:05","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"c3aa8aec-9809-4c89-9375-f312a45f5310","seq":1,"duration_ms":13,"bytes_in":192,"bytes_out":20},{"timestamp":"2026-09-30T05:50:05","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7f79d682-9f92-4fbc-b2df-0a4b9744bba8","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T09:59:41.454402+00:00"}