{"ip":"34.140.112.237","data_as_of":"2026-10-25T12:03:15+00:00","observed":true,"total_events":38,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["38 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,990 bytes sent","bytes_sent":1990,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-11T06:30:28","last_seen":"2026-10-11T06:48:07","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"237.112.140.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":30},{"port":110,"proto":"tcp","label":"POP3","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303854b7cacfb44cbd0e125abe1405e4a2314997f1fcc68c4c126a43b4fa25918de209f5baf25be69ddc5334743526415dd5776b68fa9410a8917a5cfce49a3bd41b90032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c06d2a3e56160e98d7b1d1496973dcc35ea02c843b3533369dece77ed4905febe1c793bc10d5da7c2a83c5bc181ecdf3ccff3300961b8198fb00b9452d8847081c479fa0ea80d512b6572675ea0585b2e5c4a63753217021ea19c67c69938bb283f3585670aa691daacfc7344e8cc8a4755b2cd839cdaa8ccd9b6406078bccc30316697c58d68491d971bc21831508b6ad5e597aa8596916a3c64a6c70d369090996abb04147d2f2acd9c163b8c27e3072c4370159f7ba85ff1aaa001b7e0c054ffbfa5d53416ca1b816f5023f1525b879906643e417627129ccbb047e9772695255fbb211d0e09abbd2abf35ac545e04f5f89b1305a1a0a89c50a08a2a28238c8cb6e417b470eeaa357126c19560c7c8172714c3279f3784f1c58ed7a633bc0cf4c729a84da5d7f99200417a73dd836d44c54750c2bf24580ddd91937d8417f627c94b759e760641dcbbbdce99163b890bf3c57c543c4321a9526331a36dcba063b4a92a718cd92cbe5308a4aa3868e0cb1eafbb5851b01c208a98e23cef691236ce9c123b3114bd920ce03339fd01b2033c60b6920ecf735cdc7c3b5d7465ba26bd5b60de2bb0ab3e53f0c561a7db167c690c08cd91f01736180405efc606ee012c3889303e9d8327802caade43141523ec737740069a505d0c7f5d594f329775afcaf8c5a4beedac37e3256d7f47e143cc5616274dcc526cbb10e7fa830f59630eec2602f4594b94921da550bef662efc720b0fd5800255409dc851d26b5ff81695880b5a23c165b643b44a671f0923b5a8f303eda575a1aba412029080d2b302203f43b401b93a39cee2cea29cc9edb768be026a3de4214ad61cd64447c4fbc3feb2058f20a6a2b87325e57d5e40020397cdddb05dfc27a0bab1bc4cf4357c4b5db2f7bfabec1190b60be4c0a0a56524031700932388e400625d544daa11b22277cd7f8b3b10421d1a7ba582911676663619e7892da6877e1ca4e14745d1793296039e63cc561579c79c450adfb068f4f4cd71d28ff14b70811126f1ab650835042d633aa18cbc718611bac46cac74b17bc3229d683d5b379c20da83d9a1969f75239ff0792beb8236c81637541a82543d9db19c2cb15f720080bd34c098a0337ba4b5932965fa9ca6eeaa1d294276f508b6a0c923a101a9d4341eb7d820bfd381723678d5048c8a38648e1b841351494b139f87eb0dbfbc97056916cdc8b0e1a187e67c5af7e59dd0bba91df80664e9641791592ae61db72916f9640e063c40346badd53b974f97a1589b91ad34ba65545d30f8c4eedb5a91e34c2426b41a2806f4c021fa948962ca18fd724ac3a233aca108a61ca800a2386bc14164420f701a30b0047327b15966ba4c7717140517ae4d53792a3604a5e692b28916c40c9ce795be6ad2b73d417f67899b1e45c844d89ca38a9d7fc1bcee649957d00951b7a6d1815f69490757510e25c4686632b95fb7184a940f54b2394e984783328370468b00987b75bbc3a3d70f98466fdd0c619261c8bd22bd91071fec604ec87a67a0b3b70a391b7bf9678f410c064325da62a7fa1736ebe2ab024764e0d8881fb81151d9145e62822fd236ea5028114567391aa2b5fc08fd660aebb08dcb533130d326b6882800150d4e53582c6439e3dd5cff19a12e3d021fdb8d4699109f004593b5b4a696bdc4b92e758bbe7c60e6f551a5f4cb588e2c38e5cb93cf5c1e7a001d00204593b5b4a696bdc4b92e758bbe7c60e6f551a5f4cb588e2c38e5cb93","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-11","count":38}],"recent_events":[{"timestamp":"2026-10-11T06:48:07","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ac3ca6e8-85c5-4616-9189-d43bbe8d6d62","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-11T06:48:07","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006Mkf62W","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100064d6b66363257","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cd3b473e-2733-40b6-9ce5-ee4f0291e2d7","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"c8936b982c856859","strings":["adminclient-5","Mkf62W"]}},{"timestamp":"2026-10-11T06:48:07","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d2c7f3df-2a68-4164-a52e-8748e6054ef5","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-11T06:48:07","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c9472de9-25d3-4344-a864-e6d79fe4aae8","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-11T06:48:07","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"841ee9ff-621d-4d6a-8427-2f6d1a011827","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-11T06:48:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"9539693e-01eb-4b38-bc99-2b65b8ec9866","seq":1,"duration_ms":11,"bytes_in":191,"bytes_out":20},{"timestamp":"2026-10-11T06:48:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"8f3b35ed-1a78-4ed2-872c-3803aa053515","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-11T06:48:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b578c8f4-4a70-4d1a-bead-421395f1a96a","seq":1,"duration_ms":111,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-11T06:48:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004O���`2\u0002\u0001\u0003\u0004\u0017cn=ecdtzxmvanmxyrhlyrpd�\u0014ecdtzxmvanmxyrhlyrpd","payload_hex":"303a02044fbeb7a260320201030417636e3d656364747a786d76616e6d787972686c797270648014656364747a786d76616e6d787972686c79727064","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d223440a-f2b9-47ae-bf9f-d34cf6b4f5c9","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"768dfd6b6487ae51","strings":["cn=ecdtzxmvanmxyrhlyrpd","ecdtzxmvanmxyrhlyrpd"]}},{"timestamp":"2026-10-11T06:48:06","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"727520bb-d0b6-4eb3-be1b-c9dcdcb482bc","seq":1,"duration_ms":111,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}