{"ip":"34.140.134.245","total_events":70,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"53+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 53 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,663 bytes sent","bytes_sent":9663,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-02T08:12:21","last_seen":"2026-09-23T13:23:01","events_24h":11,"events_7d":24,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"245.134.140.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":6},{"port":10554,"proto":"tcp","label":"","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":139,"proto":"tcp","label":"SMB","count":2},{"port":5433,"proto":"tcp","label":"","count":2},{"port":8873,"proto":"tcp","label":"","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":2},{"port":6080,"proto":"tcp","label":"","count":2},{"port":873,"proto":"tcp","label":"Rsync","count":2},{"port":5560,"proto":"tcp","label":"","count":1},{"port":4848,"proto":"tcp","label":"","count":1},{"port":44158,"proto":"tcp","label":"","count":1},{"port":12446,"proto":"tcp","label":"","count":1},{"port":4531,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030106130100060f0303df720acc6988fd848859304f5a804a4f5287c86ca2ec872aa783ebf8260f473d206f0771a1c8936f6af74c29da565b4dac709596b7b35471f6e774e22fd5415a370048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c016349c48054939f44d529cc74139218be5214773778ce6131e28202d26a51d6b333e766b0ef258b2f861d2c26379fc05abc78f405b5406468d945cb5e3f9300057608a32c901c83dfd5c6a2f70c15b7a65cee6188096475de0b34df936a4606a4153482da228fc2c29b3863b6d41a3cf2a52ad9a92c9030bd917c1f2798c26fbb27ca24149840ac5e82c5126b7910119f49cc88b0bc6bea404b151a152e45419f68093f14de96b5ffa4c464675a57dfbb977c144b0dcc08837308c050170c35e9b31ac6c00b877c6ca9f126e3294cc332b96922c7f95779f81c498c21990f776906ab0222c7b909e5284415267657693abda0e91c2c730a491930116a07c594ce581d17baf55a992ca9ccb071c0bac84752fd0551899cfa90894e73380347c921f55794ba0603215be89bab61d35cc678a0f4096c049c291d8f946cef093ef541a1d2c61d2ec4467b8c6e1385e549c68a683cdbd352aee057daf5c08e51ccefea0b00bc68285aa56851303571807a53b6fb083c12de08bb873350a38cb359a87fab11ebbf783d3a1cf72fa876b18c76acb4af335c1e3a90d197324b5ba99e3603b94330f2239c628d0417fb34511c434bcf4c8a3ec26028124572c5b19d197d7b062bda5c973753fcd8a34c1b7b7d00774ef98cb0387291c6142ad999002475da1830c2609666ca21308258588b3acd0b14e45ba3a7e14b6610356916865f0ec30b6d4762da3a56561588299859d281ce041980958315b67a9b08089fc2c67a2b7b35ac0175df1a196a736448aabd3d2a174445499da0a89dabc9577cabdf7544014cfed1983a70c355bdb4aae55c8f1cc1ed14bb58e319f71b28403ab5bff848fc708b6487a5128c2908c280c0934ac3e648d331a7ced0a6437895636a6c5c853aeb275ace79a27b6db3e197b2967b63fbbdbb723771fbfb37d6d59bf3daa2e6119240372c95bd14b611872b81836b1906c3a9a6b45c7286bd7baa0177d39f866a42363cf797a6de527022457a552bb25a2c3a770190184551f860087d685b18c8a353898cff32a5925aaa794a87d68c5d38b828f09810622193b9bae516c10dca07aa92190956539ddd1ad3eec1921b646e85367bb4224b290571bfc5ce9394759c63dbda1c8a05a8855387b75fa7a3e126550867b2dc83f6fb4be361c448ce6abf5ab0e3b420172842573b3be01e58469a0ac175c55820624ebdc66a85944de15205269bd99db3c1993bee9b8077c0c25d5046bb9a977eb33737b1811238a7a8574cf8b0423f5dcc8410b63972463ad06963df0bc29e0a8a5496c20825643d34b144791f8e0bb541cc4537c6f3b7a3864eb2625056a28f78df0146c53725f23accb5bcc3424d89bc9c17268b0a92b724c45484f966c9e0aa81a0ff26d2070272f49352f364b67c0bafd14cdcf504e041c6a89d874ea44132c68c5956b6901cb8d9b074c9bd30d232c8b9ebc9005f72578037cb4f1c4d89084796cc568186408e15f482654f6a11be9dc554388281a12671bc29602f88b6d0b6ef972c13103aa832b44086748fc593ed444ab69cc179705a5d7f4a6b3d37116458676a9b519db6eabb198dab528e677aad2f5bbe82b3bd53a9bbcbc746c314272f4362625af92ce289ed71aecb3ca65dd655d5bc496f99a55a0925c4d6ee5e1ffac7b8b2238c8e104a8593e38635d3a85c0a66e10a4d369158a8258fe99f36e6a9ef431032e001d002064be8b0626f1a4ba514371099e8baf09575f401abd7ca2efb2aa91bd292f4d72001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":296,"a11cun050_0000004f_0d8a8ff5":84},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":87}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0","python-requests/2.32.5"],"timeline":[{"date":"2026-09-02","count":4},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":3},{"date":"2026-09-05","count":9},{"date":"2026-09-09","count":4},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":23},{"date":"2026-09-17","count":1},{"date":"2026-09-18","count":3},{"date":"2026-09-21","count":6},{"date":"2026-09-22","count":3},{"date":"2026-09-23","count":11}],"recent_events":[{"timestamp":"2026-09-23T13:23:01","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"162a3a4b-7d45-480b-9404-0d29ceb59e49","seq":1,"duration_ms":100,"bytes_in":143,"bytes_out":79},{"timestamp":"2026-09-23T13:04:35","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":";\u0001\u0000\u0000��\u000f\u001c\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000����\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.0\u0000\u0003env\u00002\u0000\u0000\u0000\u0003container\u0000\"\u0000\u0000\u0000\u0002orchestrator\u0000\u000b\u0000\u0000\u0000kubernetes\u0000\u0000\u0000\u0000\u0000","payload_hex":"3b010000e5bb0f1c00000000d40700000000000061646d696e2e24636d640000000000ffffffff140100001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ef00000003647269766572002d000000026e616d65000a00000050794d6f6e676f7c63000276657273696f6e0007000000342e31332e320000036f730054000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0009000000362e31322e38352b000002706c6174666f726d001800000043507974686f6e20332e31332e31342e66696e616c2e300003656e76003200000003636f6e7461696e65720022000000026f7263686573747261746f72000b0000006b756265726e657465730000000000","method":"","user_agent":"","ja3":"","session":"56e46967-ba28-47e1-9663-2676182cea0d","seq":1,"duration_ms":100,"bytes_in":315,"bytes_out":14,"enriched":{"digest":"9f5d1d3c1c081554","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo|c","version","4.13.2","type"]}},{"timestamp":"2026-09-23T12:57:24","port":5560,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:5560\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353536300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"c339ca27-b0a4-4ad3-8b65-5c75146acd31","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-09-23T12:56:19","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"a2d4729d-9d84-4d45-8e7f-db86e09e94b8","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":79},{"timestamp":"2026-09-23T11:49:36","port":4531,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4531\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343533310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"79a1c094-0c85-4a43-a9e9-e7dd49fba772","seq":1,"duration_ms":101,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-09-23T11:05:43","port":32764,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:32764\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a33323736340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"0d70cd3c-9f8e-4f17-9c2d-5e8909c68404","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-23T10:01:11","port":8191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8191\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383139310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"5cdce363-3ae3-483f-b5ad-b04ed52aa294","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":79},{"timestamp":"2026-09-23T10:00:21","port":3193,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3193\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333139330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"ac0c04cd-faec-426e-96c0-03a507109123","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-09-23T09:30:26","port":14147,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:14147\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a31343134370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"0a68c5b5-f786-4299-8e4b-61749d734840","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-23T08:50:16","port":10554,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:10554\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a31303535340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"24aa158b-3308-4e72-804a-579ab79dd3c9","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79}],"http_methods":[{"method":"GET","count":59}],"distinct_ports_total":53,"top_paths":[{"path":"/","count":59,"ports":47}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":5}],"top_alpns":[{"value":"http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-23T13:36:48.390440+00:00"}