{"ip":"23.251.128.193","total_events":25,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["25 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,124 bytes sent","bytes_sent":1124,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-28T02:22:48","last_seen":"2026-09-28T08:46:07","events_24h":0,"events_7d":25,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"193.128.251.23.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":636,"proto":"tcp","label":"LDAPS","count":18},{"port":389,"proto":"tcp","label":"LDAP","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i781000_ab95583b6d39_d41ae481755e","t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303f2f3cc875cc2db29de0e1087987afab8efc624948ae0c38e5c8f63b07f11f8df20559e35e45c99fec37b38f2b85890ecbc4c6a55dd137cc506075af615bc4407360032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0cc1bc11132171735bc0c374be24c66fc0931b8713dbc570741b55128a425267a14df97653ac6b7ebebcd3a8231456421f24c72a67766a1d2cabc461376a85583999de59866ecf14de5549c1c747e77a8889213154309a753e52a932616f780aedca804a923a73409cb0919bef2a71b67dc1593cbc2a8756a55043040a8979403570135688036860f26b4cdf2b5ab051cb8b2955067b43e9843300467fa59630f97b4ea037b5317b688f71ae5cc4506677774a9bf9f129e9fe85abe132588d39302db4b912a9b49b928a439c40668110db47f00510302cbcfae7a2c9501b32167794548aefdf4bc22095bd871cef0b104d4767702d36027f858c3db61885c068da39e8820cb4e48794b186ebad763cd66551cf32b10e373401c44461625a7db9a9a344679936df7aa2d168230f9f693ddd153c524ca70c7a631cb1ca2851ed38027ceaba97ac44a01b2a5293a1f8497cc69b0bc667c290d976722e83de1480db607787e08cf54b1345c562a6ca9ca8963416da4a85180baf1a74a95b111726367f6fb941f60a4567694583c63c7bb8a01e9bf0fc24bf864483483c792149ab572a5e59424aae8b2f3610ad40c7598a59b3ae69ce539c56ce308917b1db55c5f3fc2a4c16c964d5b1960f9627381a78de5b5b0516c579bb7b345bbbd9296f3855cb7f9935cd14e8fe4bfdd394d74b12fbbf2b302d76ca3f718da15343b66c8dc23c57c47902e589c373c8f6c260777869908842d73fa07bad1cd3b3a1028bc1da901aa63490f8a67808ca46e8bd71c0562a480897db1b7bcca69852ea9a48d06b6df222f00830491814b1c5309fba9849df2a7ed82a3e2971b9ea4592b4b6cbe2c14fd0b4c8c8920a5b78a62f50efa35af1241b38d90257ae1cd7a277d299b7b2923af6ecca966c63126526557094d4e71bdcba50cad7c5955e2bd29aaa46d7a76a00059b73a4dcf39a624b623d21109e08301a7fa42401a54c6e8970003bb75a940efe09e3c20a8fcc6b0f6e9becdf940f4980ca658af862a8c8b4138f8b45fb879598d14c639f6582c13024b8b750feca33f82b16b804e445220d1a25bd3837d35f8020df9ad932c6b0b80be7bf2ad12098a66da578581c9bc45cd98c2314afc620c115922089847b1813c333145cbc885c619f4b83c713c74a7f9234665612ad0abec725fea2c758042832ea583d02b719a69855b263808b745cdd5a4e6db5a82fabc6c87af0d1508cd8003d98c4227ec3705621b217a23c0c18f052a89cc197fd767168a3c121f23ce8964ab65685ef6e144aac5330f59045bba9c35739af985c9796b3b8a8b77856143a2d277858c1035f105a12447c79b2828ea3e34034a71304b25a462f8f1bc0f009e760a2582c48e5e5299e9f069db195ef6b34457a94a55d7090f8870b6685f1801997ad6441cd920944460aba659a277463591c8e7e904e22a2d3e7a53c8da33e031a48f5401b5b75023730f5e9b9ab4e4bed0561133c88097d38d04fbbcd2542a572cbd544983dcc92d71bb48dc75b148356f72e98d1fc44fa8b2a2471c2154915b9a78942791181a659e998007ae625e6ea64a08f49754f29ef0595c98719eeabb0037a5c3d13735df9478c0644a6730394e62961ce500df9b7e25b745b51b6c8fa6883074d7f6b3efdf1379979adcb22ca601e561ada3aee1399999f11b8192b69fe6532d18688937101c0298c080bd53fb3f27001d002061ada3aee1399999f11b8192b69fe6532d18688937101c0298c080bd","tls_ja3":["b3e88a126e6e0179ae465227a52f60ad","9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34","a10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i781000_ab95583b6d39_d41ae481755e":306,"a11cun030_0000004c_13ee3d34":2692,"a10lun000_00000000_334359b9":800,"t13i250900_b78ed14e2fd0_e7c285222651":1894},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-28","count":25}],"recent_events":[{"timestamp":"2026-09-28T08:46:07","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004w4��`2\u0002\u0001\u0003\u0004\u0017cn=wskxchdvdkkuinhtkwhp�\u0014wskxchdvdkkuinhtkwhp","payload_hex":"303a0204773492ad60320201030417636e3d77736b7863686476646b6b75696e68746b776870801477736b7863686476646b6b75696e68746b776870","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"675a37cf-a086-42bb-bf42-74cce2cb854d","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":14,"enriched":{"digest":"12c79c1d0ea80d26","strings":["cn=wskxchdvdkkuinhtkwhp","wskxchdvdkkuinhtkwhp"]}},{"timestamp":"2026-09-28T08:46:07","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:636\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3633360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"1759cb09-69f6-43fc-af9f-9eece6725a56","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":79},{"timestamp":"2026-09-28T03:51:52","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0003\u0004\u0000�\u0000","payload_hex":"300c020101600702010304008000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"624f80f0-1d7f-4dea-8a0b-002142212bff","seq":1,"duration_ms":195,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-09-28T03:51:52","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0%\u0002\u0001\u0003c \u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001\u0000\u0001\u0001\u0000�\u000bobjectclass0\u0000","payload_hex":"3025020103632004000a01000a0100020100020100010100870b6f626a656374636c6173733000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"5e3502d1-8e11-423d-9a84-444957f3b740","seq":1,"duration_ms":195,"bytes_in":39,"bytes_out":14,"enriched":{"digest":"17376caef90cd8c5","strings":["objectclass0"]}},{"timestamp":"2026-09-28T03:51:46","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000i\u0001\u0000\u0000e\u0003\u0003U\u001c��random1random2random3random4\u0000\u0000\f\u0000/\u0000\n\u0000\u0013\u00009\u0000\u0004\u0000�\u0001\u0000\u00000\u0000\r\u0000,\u0000*\u0000\u0001\u0000\u0003\u0000\u0002\u0006\u0001\u0006\u0003\u0006\u0002\u0002\u0001\u0002\u0003\u0002\u0002\u0003\u0001\u0003\u0003\u0003\u0002\u0004\u0001\u0004\u0003\u0004\u0002\u0001\u0001\u0001\u0003\u0001\u0002\u0005\u0001\u0005\u0003\u0005\u0002","payload_hex":"1603000069010000650303551ca7e472616e646f6d3172616e646f6d3272616e646f6d3372616e646f6d3400000c002f000a00130039000400ff01000030000d002c002a000100030002060106030602020102030202030103030302040104030402010101030102050105030502","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"d7d5b50d-fdaa-4733-80ea-9561ce0a4ddf","seq":1,"duration_ms":195,"bytes_in":110,"bytes_out":14,"enriched":{"digest":"53bb04b2d6c97881","label":"TLS/SSL","strings":["random1random2random3random4"]}},{"timestamp":"2026-09-28T03:51:41","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G���,���`~�\u0000��{�Ֆ�w����<=�o�\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000","payload_hex":"16030000530100004f03003f47d7f7ba2ceeeab2607ef300fd827bb9d596c8779be6c4db3c3ddb6fef106e00002800160013000a006600050004006500640063006200610060001500120009001400110008000600030100","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"e7ed0fa5-09d7-4922-8920-209ef261b780","seq":1,"duration_ms":195,"bytes_in":88,"bytes_out":14,"enriched":{"digest":"28bd7217cbe4629c","label":"TLS/SSL","strings":["edcba`"]}},{"timestamp":"2026-09-28T03:51:36","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"c271898c-5d4a-4971-85df-1deb95a5b9c8","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-09-28T03:51:31","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"971d854e-ccb6-4edf-8852-bd625f588899","seq":1,"duration_ms":195,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-09-28T03:51:26","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000�\u0000","payload_hex":"300c020101600702010204008000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"f0c1d327-e9eb-4476-814c-9c03613545d8","seq":1,"duration_ms":195,"bytes_in":14,"bytes_out":14},{"timestamp":"2026-09-28T03:51:20","port":636,"proto":"tcp","app_proto":"tls","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"bf699589-8e44-4be1-af0f-a805e9cd1d0e","seq":1,"duration_ms":6101,"bytes_in":51,"bytes_out":14,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":5,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:636","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T03:43:47.465883+00:00"}