{"ip":"34.130.162.84","total_events":98,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["98 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 17,878 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,878 bytes sent","bytes_sent":17878,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-01T03:05:07","last_seen":"2026-09-02T04:44:07","events_24h":0,"events_7d":0,"geo":{"country_code":"CA","country_name":"Canada","region":"Ontario","city":"Toronto","lat":43.709,"lon":-79.4057,"asn":396982,"org":"Google LLC"},"source_domain":"84.162.130.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":4434,"proto":"tcp","label":"","count":98}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1712h1_ab0a1bf427ad_ecd0401ec68b"],"tls_client_hello":"","tls_ja3":["63df4a17564841f603a2c87addad697c"]},"fingerprint_peers":{"t13i1712h1_ab0a1bf427ad_ecd0401ec68b":15},"user_agents":["Python/3.11 aiohttp/3.14.3"],"timeline":[{"date":"2026-09-01","count":70},{"date":"2026-09-02","count":28}],"recent_events":[{"timestamp":"2026-09-02T04:44:07","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/identities?include_credential=password&include_credential=oidc&include_credential=totp&include_credential=lookup_secret&include_credential=webauthn&include_credential=code&include_credential=passkey","summary":"","payload_hex":"474554202f61646d696e2f6964656e7469746965733f696e636c7564655f63726564656e7469616c3d70617373776f726426696e636c7564655f63726564656e7469616c3d6f69646326696e636c7564655f63726564656e7469616c3d746f747026696e636c7564655f63726564656e7469616c3d6c6f6f6b75705f73656372657426696e636c7564655f63726564656e7469616c3d776562617574686e26696e636c7564655f63726564656e7469616c3d636f646526696e636c7564655f63726564656e7469616c3d706173736b657920485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"ed501ffe-fa99-47fd-bc9c-7ec3d9943944","seq":1,"duration_ms":446,"bytes_in":342,"bytes_out":78},{"timestamp":"2026-09-02T04:44:07","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/health/ready","summary":"","payload_hex":"474554202f6865616c74682f726561647920485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"21304ceb-6e0b-4259-99f8-b7495715bc24","seq":1,"duration_ms":449,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-02T04:44:07","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"1b8bf00f-da48-42eb-9bf6-9374fb0dfc9b","seq":1,"duration_ms":454,"bytes_in":145,"bytes_out":78},{"timestamp":"2026-09-02T04:44:07","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/schemas","summary":"","payload_hex":"474554202f736368656d617320485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"9f421d78-da22-41bb-9d15-b81b8ed9b49f","seq":1,"duration_ms":628,"bytes_in":145,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/sessions?expand=identity&expand=devices","summary":"","payload_hex":"474554202f61646d696e2f73657373696f6e733f657870616e643d6964656e7469747926657870616e643d6465766963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"cf1dc47e-6f4b-498c-8f58-54f72621b610","seq":1,"duration_ms":1272,"bytes_in":183,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/courier/messages","summary":"","payload_hex":"474554202f61646d696e2f636f75726965722f6d6573736167657320485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"2377a975-96f9-4c61-88cc-bfc8dff5c9e8","seq":1,"duration_ms":1271,"bytes_in":160,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/health/alive","summary":"","payload_hex":"474554202f6865616c74682f616c69766520485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"c2728e2f-95b8-4a88-b1e8-053f7c052452","seq":1,"duration_ms":1271,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/identities?include_credential=password&include_credential=oidc&include_credential=totp&include_credential=lookup_secret&include_credential=webauthn&include_credential=code&include_credential=passkey","summary":"","payload_hex":"474554202f61646d696e2f6964656e7469746965733f696e636c7564655f63726564656e7469616c3d70617373776f726426696e636c7564655f63726564656e7469616c3d6f69646326696e636c7564655f63726564656e7469616c3d746f747026696e636c7564655f63726564656e7469616c3d6c6f6f6b75705f73656372657426696e636c7564655f63726564656e7469616c3d776562617574686e26696e636c7564655f63726564656e7469616c3d636f646526696e636c7564655f63726564656e7469616c3d706173736b657920485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"cdeda83b-e562-4d24-a640-30514fdf751b","seq":1,"duration_ms":1363,"bytes_in":342,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/health/ready","summary":"","payload_hex":"474554202f6865616c74682f726561647920485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"b835648f-847e-45e4-81cd-11b057d87b6e","seq":1,"duration_ms":1400,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-02T04:44:06","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, br, zstd\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Python/3.11 aiohttp/3.14.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/admin/sessions?expand=identity&expand=devices","summary":"","payload_hex":"474554202f61646d696e2f73657373696f6e733f657870616e643d6964656e7469747926657870616e643d6465766963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062722c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31312061696f687474702f332e31342e330d0a0d0a","method":"GET","user_agent":"Python/3.11 aiohttp/3.14.3","ja3":"63df4a17564841f603a2c87addad697c","session":"a7e26f21-91f5-4675-96c7-4cbe063becdf","seq":1,"duration_ms":1431,"bytes_in":183,"bytes_out":78}],"http_methods":[{"method":"GET","count":98}],"distinct_ports_total":1,"top_paths":[{"path":"/schemas","count":14,"ports":1},{"path":"/version","count":14,"ports":1},{"path":"/health/ready","count":14,"ports":1},{"path":"/health/alive","count":14,"ports":1},{"path":"/admin/courier/messages","count":14,"ports":1},{"path":"/admin/identities?include_credential=password&include_credential=oidc&include_credential=totp&include_credential=lookup_secret&include_credential=webauthn&include_credential=code&include_credential=passkey","count":14,"ports":1},{"path":"/admin/sessions?expand=identity&expand=devices","count":14,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":49}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br, zstd","notable":false},{"name":"Host","value":"<HONEYPOT>:4434","notable":false},{"name":"User-Agent","value":"Python/3.11 aiohttp/3.14.3","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-21T21:50:28.567331+00:00"}