{"ip":"23.251.138.102","total_events":19,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["19 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"977 bytes sent","bytes_sent":977,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T02:26:56","last_seen":"2026-09-28T07:38:22","events_24h":0,"events_7d":19,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"102.138.251.23.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":18},{"port":25,"proto":"tcp","label":"SMTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303df6f743d799d19be89b4617e6575636ce79c37c29457e3009b528024b2e52ac020426be1140bac9e8a26b29e6482da74af8b9f84f98e2848341f8fc7b49fa2ddda0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c084c0486777cce9f7811263ce869a6a9ae7c44bc9284057138e80cee1f27ac0096c5a12672cf23f23c4a7dd049a3d5497ec8792bad4436ab2263562cc8e906f390260b365451ed13eaecaa418f2b44d7466847ac0e4e8820db916cffabaeb244d39b6316a4679d93521980cb11572cf0538121055112f96c21884769c8631fca26e4481cc707764a3e927c022c9f3309ad023cfa4091ddf38c36635435be753e987cc03c010855a4ab60aca7624ac4f022c502b57dc6627eee5a1421694e11c0fbce08479ecba53403a93b11a3b4a73c6d16e9e2838f2330eb2c489c3a96808771d5ca83a51471be0048a08c84142358ae0a72781c28df2e223038bb3c1b5a0d44bba0ce7493fe78c6fe836e86a51991967563639ef58cd3a850a30b65f53d795389c3449eac35a42853484bb5903359ba1b3c0646a6999508da38ac9692522cbbdf458cbe3244cab509c57f6ba40f31ba7273af925a3ba5b25679501e9d797bb06b0072a59b82813e77ab99fe30705e254ebc5ce67566cc4217eada750ce147e81914cba058b69eb200994246d82ca796a78b0c61e9b1a52b90440b3aa8637f8ab3371007c34b383085bc08a03dd1858155bbc8028338320c8e86554e4829f1e4b828191b6b456472cbbcfacf349b7f1a882d9749e7a3f02302c6030961ac58fe1b864c9cb83be6a4c069ab97fdb01f02ccf5ff5c0e2cccbf73610f705be38ba43b59995d1fc4aa110bf5656927824b3bcd1c170113db7d317fda968ee56581e89640a7b29d16ba20b6319818663b071c717d162cbf88211a8a26c79a1aa84203d4874d49b4a38398ba40517ba9624d3197534f098b0e838bef055ef98876bfaab15ac0510e6a73c514d39c02b44b9c16e35320c673afe603207333cd32a6d1a4a2139f7494cd566e67067f0d87f5b007325878c9f50c60a0c04d9f5a9de71438df1cecc165975396a8bea1984a10f4d8632c132540beca807404d2b6926e72160e3933865a9a8b2fa0be5126d54458b626071086012eebbaf33e477ac163507435656a2089d55b07a887ca400355c80196dd03e63838731752a7eaa9e849302369a3403c28c29f39168506f43fbc39d5830e06198ba6541b8bc527f34bff0fa0b76ba713972c7c1d4b0c75c10ca5b5084757ef5475cea985f72aba3f28a78f90231daeca3e5450fbc14527097ba0ea147b1d17433d8224e0b45fdfc02446bc2d332817523c606f996ac552dc011350d053de618828a548e9901992d5827c38aa237f1c4a86282ea101ee09576951970272bb43fdbad389a809990c0a7bbbd2b6ca387454cb403002bb484bf453cd4fa8193aa8775b05f075a3ab2866237ac5a89028b12a91190fa88c4810b4b85826661c18ce3bfadaa32b8859dddd94c313cba5831b39af1b0f6292e0c1459237a0d28331fceb6219d76b3ac5024e9f99253b69d33c9a7a9152638f768dd4894a14c645a24bab154893bb9938bfb36911ba1bfc5427df71ca0087e29447107b9304e21261a7b30dce285f987308e6a283e014ea388c5478752e3ba0af7109b9049a4c9681efb872a118902cfd0c4951271bbb5b1d5eb944f689221b88c8397187e8833fbb0c030b2acea304fbec7ac4348c46d84cbea1988cb58ef65c40c16914beb8c2131a33e305f7595e53cce24663a36714435151ebd2c42f0295db1feca76236793cb79406839defdf540ec882f1809001d0020714435151ebd2c42f0295db1feca76236793cb79406839defdf540ec","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1899,"b11cun030_00040012_13ee3d34":5035},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-28","count":19}],"recent_events":[{"timestamp":"2026-09-28T07:38:22","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"475d04a9-593e-4d1d-a9e4-2f26e119b2e6","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":12,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-28T07:38:22","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b7ba4322-92b0-47c3-bd61-b471715265b8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":12,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T07:38:22","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4d91dedc-4c6b-42ba-a1dd-abc51fef8a79","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":12,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:23\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"3158f9b1-b556-4b12-8b5b-601f82fa6156","seq":1,"duration_ms":8,"bytes_in":190,"bytes_out":12},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"191dacf2-0539-432e-8ade-139835d39621","seq":1,"duration_ms":101,"bytes_in":57,"bytes_out":12,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d12c00e0-1155-4963-9199-f5e8f4d43f0b","seq":1,"duration_ms":109,"bytes_in":16,"bytes_out":12,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004$e��`2\u0002\u0001\u0003\u0004\u0017cn=ichdyxmwxcgontuuiord�\u0014ichdyxmwxcgontuuiord","payload_hex":"303a02042465fad860320201030417636e3d6963686479786d777863676f6e747575696f726480146963686479786d777863676f6e747575696f7264","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c70d2e0f-13f5-4651-bf9a-0e4d7ba885dd","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":12,"enriched":{"digest":"8e213962dfd4b647","strings":["cn=ichdyxmwxcgontuuiord","ichdyxmwxcgontuuiord"]}},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7240dc31-14b7-43fb-921a-2aea0d8056e2","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":12,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-28T07:38:21","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u000609zns0","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000630397a6e7330","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3be0f074-60b6-45ae-8eb7-fdd2597591be","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":12,"enriched":{"digest":"40a41e3313e30181","strings":["adminclient-5","09zns0"]}},{"timestamp":"2026-09-28T03:17:39","port":25,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO\r\n","payload_hex":"45484c4f0d0a","method":"","user_agent":"","ja3":"","session":"86221e6b-4eb0-41e5-a782-194f6bd8a46e","seq":1,"duration_ms":95,"bytes_in":6,"bytes_out":40,"enriched":{"digest":"87f781591201aca6","label":"SMTP","strings":["EHLO"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:23","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T20:53:18.816433+00:00"}