{"ip":"207.175.237.35","data_as_of":"2026-10-25T12:03:07+00:00","observed":true,"total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,015 bytes sent","bytes_sent":1015,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T02:52:26","last_seen":"2026-10-09T03:39:50","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"35.237.175.207.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303cee8d0398f6de41cd05ab6e10728a1a8cf93460c134114e9f3eedd10ee6f5658203a674db485227034e48cd622a497527d68c1e63e03ed2fc6790adae516e09b550032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0ac407a0b7119a604c8c55040dec3b5a452ad0838ac32730e17e52b4e975b3a715cabe6708b15811aa773c7a5742ab72ec7236b000d3753931dc5173a77fac8c6366cd0097bdb4177d6739ac1663b1113a399c832d4c40d32e75bde8c612b85a9eb8c1f5df0658cf08a2be16aecf646d8a44a4d65b0cabb0525842cbb6a1c81b63c4843068409aabd50b424fbcaf4304c028683e391910e45705bb09ba85813afcac306a7bfe448b4b2945e610c13af15cb90c4549f40903d411213d5a94c2023d48a55530827de017e7d7354b942c368ea7d6eb811e32b64f4e9483bcc357cf71fafe2c73e435149569e3b1a5ea6278d18b600f1a903b5b05c462264aa294d30a540588b957c62b0299b6d6cb80e34d1ab019ca0e6f7bd1f65622d200ac2852841f555fefb6c45126b06ac90ccf570c7db942464cbae0046ed274d9b0073a5419e3691130fe66f15b35dd00569f7721098442a3786328c84216a05cdb74620678aa6ec97239fc452e0f7193d8067252c53bfb1819fd95957177c6bb559cf825da7d231cbe0c91c736bef519b2542011d8826488061dc715420240d48d497bf76ab513ca5f7f110114b758be49e770b3a3fb401de32ba088580580b01f6d35f2ada3435670ec5b81af8858aa7c742f766037477ac8df6c1fd37025aecb8e22c7e1b3c6cf61a9054b1880452b82f7462aba3cd2d5a2b26735dae994bb3c291fc0c078496395414032fecb1c1365057630c002c1b04a88a88b78602304dace25e7b660569215f5061cc4347110af47837549e1b95a9776c4ead27648ab9b8453bcbd3f464f7c4527bfa2d30039ba6d354fbaa20e82c9e92a30bc961badf1407a3d4267f0caba5d348aad2ae7ec81074401412c0693dc49180379bf9416c3fdc7f00588f545391c971ccdc7032aa3287fecba610f8c081b34fe1225922234bf366952ab55f4515a2ea226eb5e395e26c0784f32f85c1b69b53a4c81c4d55ec4772b3c1a7759840652b24e653072b1646835aaa714b771b354bf5bf20b134b9d89c3f1c6c3d3212b9c2b9907caa41ab0d5bc34950c0855ab542e4263a2bfc496ec252bd852704312fc7e80849fc638b408d3513b334ab07e4456fd64333cb3c9ac31306b93c46c4926c2ab139fc317b1a8c82c5a19579239569690e82658139b09e834b6933176cf50cc845ac82b806601c257a97232366e7cc23d029fc3989e1d7269d87ba67f6b06b5245316697ec071bb96ba16595b5e4376c30d634b7fa24152906b248910273649fc62c828968b04450c2f095593b095392918824736ca8590f902c59ca1a02150467d8449c720f65024f4c94778695b667306e793a3f06326adfc3815a3488662195578439ee5c855d08965b8968c45cb1b82b5756745c829945798046caf8a81f6004550abc0886146a52c5082c6e94568afdeb1459169d91a18107643911e30b24ab4dbcaa3a8bb57d08439a32b4bb5d102ad56b9a01322a10e47e2763c4b9f24aaf1035242a4dd11054bc9557ff7a84abe73b38733ea46566776026980a78c2147494919d01c4576f1684ca0143a8160536ab7a52e855e1e20c2c551b82111cf3260ea12bc154a569fb11a6493161e2828e4be4628f97c942f8965e42b942168be640801619008093be586f777340dfa29251dcd9fb7bdce210d346e425e9ab0874f21b8aa882af3cc2e69cd76d7deead666419bead1428001d0020e210d346e425e9ab0874f21b8aa882af3cc2e69cd76d7deead666419","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":20}],"recent_events":[{"timestamp":"2026-10-09T03:39:50","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"000b755d-f6a2-4397-a30e-7b9d8f8bd792","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T03:39:50","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c8952ebc-1e1a-4b2c-befb-06422f96ffa1","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T03:39:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"78101fed-70d7-4404-b6ad-a213a0cc494a","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-09T03:39:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006z9BZuW","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100067a39425a7557","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"86a96a54-81e0-4648-a516-3d53aabc8d8b","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"71a53f52289d7f81","strings":["adminclient-5","z9BZuW"]}},{"timestamp":"2026-10-09T03:39:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"49bb791e-1bc7-42d8-829e-7f72a1cf8ee2","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-09T03:39:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"deb91455-2128-4f30-8a54-86bcc3ad2600","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-09T03:39:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\r\np\u000e`2\u0002\u0001\u0003\u0004\u0017cn=anbhhipkbayelnbihrnf�\u0014anbhhipkbayelnbihrnf","payload_hex":"303a02040d0a700e60320201030417636e3d616e62686869706b626179656c6e626968726e668014616e62686869706b626179656c6e626968726e66","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"038cff44-c54f-47f4-978c-e8f24a08ceb2","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"67dd7270e1ef2fa6","strings":["cn=anbhhipkbayelnbihrnf","anbhhipkbayelnbihrnf"]}},{"timestamp":"2026-10-09T03:39:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"016427b8-9ecc-493a-b35a-5c827ad6ab5b","seq":1,"duration_ms":196,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-10-09T03:39:47","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"1e4d058b-f368-4b74-af77-6726a9c6cde3","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":20},{"timestamp":"2026-10-09T03:39:47","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"8b6cd392-3b74-4b8b-ad07-7187781284ee","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}