{"ip":"34.140.139.238","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,010 bytes sent","bytes_sent":1010,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T03:55:50","last_seen":"2026-09-28T06:20:15","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"238.139.140.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303520a72584d66d91ba33898303156e63fdd5622d8795be422a7d439624e97d52f20923c3165299bce9d618b15eb16513261f218dd8dbcf400d5b8159499287c7d8a0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c04d655dd0a949e7945b0186140a3843fc5a9bb546c3b4603d4475a262b77b9c3c8c99a8ae8a40012c4ba684835cfc34bdb3564011582e6c131161a10294136cabe2916a873b007839d5aa84f9420462082de49342e4d34ac5b522b28c2916c178df17c03652a34d381816bc07a1466c84c937fffa8a489c15156215bb9c6b611a21914132e52bc8a7118ff46419fa0054092b5714e02d04ab26cb74a2a0727f24727d0ed44059d040d490c0db7aa7e61050da5a4e5f00ba61d1116135663c5a0759561f5e2b0ec9c70fe3a0ac81c20d6244cd2657a05d3035ca612c4715bab02914e2f9c3ff842cb4e93b0beb55eae48347e56796abc50736347bf69b407c4e33eb85caf30a622628759743c82811b7f4c1b85c3a9ca0111dc11e4ce0ce345b0583e15c46d89493b98c459a1b95cba90e9726fc3351be450c1b66997cbbb851f617b7885736e1cd48d96554e55c43fc4f13e798c6c67e5e78b42e27ae7e9958789a05777b217653b3165393ec02b986a3109c9b1218464a7a36286ca960e309bc043437c3d300e0c19a67d3c7e0e5278390c21829094bfbc982949c656391e1fa0a349c14178896fa0296ed98c2eba74f6814c9dd2b29b5c24dbeb312ee304ebbd1c64752978d19bf5a54b55c711331d58506755485523fca394421645ad0197bb5a7177945bf2d9a4006d31d47c8c2545a21890c4f09ab2da06bcd86e3686aeb1b21188aa4050056045e203b6d039bbba91a611e5c7f90d6751e34bd870c86b2a9caccb38af02531cdd62538c688881663c9394ab00cb6d81b6d2791baefabc291251ca9963cccf055fcc64bcacc328b280c9081b26b3ba2ba88943780571373133214c88f30cbcf11383b11cc9e992ed7f2a7c2bb88c470c2b5f5750bc97cf04467aa0c551e7392c06866b2d1a1303c5b838c1dfcfc5bc4b28246165c23c2a6598abd23e98371a815bde214af8b80b175bf46a9bf8e7960686372e38781ddb01a4e7b4dc941797f027307600971669f2cd0c734c78b723603866b5e1b42b706b0a359eac77438908e1b7c919c4f49b80b60a170fda59af216309e5173c4bb95d3aa54f4007e4a138bd02b1cee1c55435b9eeaf968aad3c81787c879ab74d228946d26bb5fd79f4005197fd6b670c1125c3187af1045aaf69761404112d71567eb91f81a42dc914230da1c76d2ca90db401583502006c7ae25acc3834e9d6c9b95232427b287bebb0ef60796ef574ade05a6fa8670a737c98cbbc816883f86d3232249b644aac309c0cf084683a8aa2ad323bfb83c249f93377c0029bcb058febbc6b8485cf0a108ab5b22f4a93b1de4114ceaa1490c935b91124a3140cddb0cb4c261a281b96f937023684942150dcb6a42aed44da768c1506906db111c29730dfee60dc966cc8ea778b4e40d311a794952ae11111818906252514aee999bef867b44c49f7132adee59253d780b3ccc8fa704298ad230fcb367fa423b922735f28796ea3c8aa0b82d2b0b604fb36b619a9f57b4643c50ca4016baeab6bf543c7a8e4b87f1e9643bd03fe704278dc9a22803cddb21129da4c8a1f9855be4649b7015740048aaf01b97248002bb75b836b04c328199e5a6fff3b9d688ca55b0059cd5279fbbfc03b7e04fcfd5c6d16ec4ee2c2b110ea9b8f0f74324d7b7ebd51fbe5c691c76c416b239526149cf8aae389c679f08861b1093ac6c921d16627418001d0020be5c691c76c416b239526149cf8aae389c679f08861b1093ac6c921d","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2002,"b11cun030_00040012_13ee3d34":5052},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-28","count":20}],"recent_events":[{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9a35b25b-9d84-4a4a-b18d-dae0c88923b5","seq":1,"duration_ms":109,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004'tb�`2\u0002\u0001\u0003\u0004\u0017cn=cchrufxzqlwrjlekdwco�\u0014cchrufxzqlwrjlekdwco","payload_hex":"303a02042774629560320201030417636e3d636368727566787a716c77726a6c656b6477636f8014636368727566787a716c77726a6c656b6477636f","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"bbeadd83-bcc2-4e4b-a14a-2cdb92279778","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"ab1e373e32756e94","strings":["cn=cchrufxzqlwrjlekdwco","cchrufxzqlwrjlekdwco"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f53e5ee1-2133-42bb-9ee3-fa7b37e0633a","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006EfmXBI","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000645666d584249","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"5e99c508-0c8c-443d-a5b4-0c6f63c6d546","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"dee5232e1c9d3774","strings":["adminclient-5","EfmXBI"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"736a8bdf-55d6-43ee-a2f2-3f901261904d","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"07deccc4-8066-4eb3-a52b-56756fa1d0e5","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T06:20:15","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9a57b5e1-ba86-4f39-ab1f-0a8e87d8ada0","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T06:20:14","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"ac944b99-f5ae-4b5e-a9f6-1e2c7ec98a80","seq":1,"duration_ms":8,"bytes_in":191,"bytes_out":34},{"timestamp":"2026-09-28T06:20:14","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"689d510c-d17f-4bfd-8f87-25ac8ed6f62f","seq":1,"duration_ms":108,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-28T06:20:14","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"78a5d94c-e5b3-417a-ae17-c7485b5abf5b","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:990","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-02T21:48:52.865209+00:00"}