{"ip":"34.156.137.115","total_events":71,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"56+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 56 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,314 bytes sent","bytes_sent":9314,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T03:38:21","last_seen":"2026-09-29T08:32:02","events_24h":15,"events_7d":47,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"115.137.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":139,"proto":"tcp","label":"SMB","count":4},{"port":8873,"proto":"tcp","label":"","count":3},{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":9200,"proto":"tcp","label":"Elastic","count":2},{"port":5433,"proto":"tcp","label":"","count":2},{"port":2049,"proto":"tcp","label":"NFS","count":2},{"port":445,"proto":"tcp","label":"SMB","count":2},{"port":8200,"proto":"tcp","label":"","count":2},{"port":873,"proto":"tcp","label":"Rsync","count":2},{"port":743,"proto":"tcp","label":"","count":2},{"port":10031,"proto":"tcp","label":"","count":1},{"port":44305,"proto":"tcp","label":"","count":1},{"port":5596,"proto":"tcp","label":"","count":1},{"port":18019,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_00000049_54d07b6d","a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"a11cun030_00000049_54d07b6d":2571,"a11cun050_0000004f_0d8a8ff5":519},"akin_families":{"a11cun030_00000049_54d07b6d":{"head":"a11cun030_00000049_54d07b6d","shapes":3,"ips":2570},"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":520}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0"],"timeline":[{"date":"2026-09-17","count":1},{"date":"2026-09-20","count":11},{"date":"2026-09-21","count":11},{"date":"2026-09-22","count":4},{"date":"2026-09-23","count":1},{"date":"2026-09-26","count":3},{"date":"2026-09-27","count":18},{"date":"2026-09-28","count":18},{"date":"2026-09-29","count":4}],"recent_events":[{"timestamp":"2026-09-29T08:32:02","port":8873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"e2201956-a588-4456-b87d-7a22a4173f95","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":14,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-09-29T07:07:10","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"2497f3aa-4d2a-44bf-b7c9-853a22f8577c","seq":1,"duration_ms":104,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-29T07:06:39","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"3b471f81-33e3-4112-bacf-24484a6b67f1","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":14,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-29T05:23:01","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D DFCODBDHDFCODBDIDDCODBDDDCCACACA\u0000 FHEJEOEEEPFHFDCACACACACACACACAAA\u0000","payload_hex":"81000044204446434f444244484446434f444244494444434f44424444444343414341434100204648454a454f454545504648464443414341434143414341434143414341414100","method":"","user_agent":"","ja3":"","session":"135abb1e-e69b-4bcc-93a8-40525563cd7e","seq":1,"duration_ms":101,"bytes_in":72,"bytes_out":14,"enriched":{"digest":"a40ee987a6a91a6d","strings":["D DFCODBDHDFCODBDIDDCODBDDDCCACACA","FHEJEOEEEPFHFDCACACACACACACACAAA","D DFCODBDHDFCODBDIDDCODBDDDCCACACA FHEJEOEEEPFHFDCACACACACACACACAAA"]}},{"timestamp":"2026-09-28T16:45:55","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"466df452-b49d-4d4c-95be-3818d0063799","seq":1,"duration_ms":101,"bytes_in":144,"bytes_out":79},{"timestamp":"2026-09-28T12:53:04","port":41800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:41800\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34313830300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"e890080d-0437-4813-910d-1fe1049ca674","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-28T12:50:44","port":10031,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:10031\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303033310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"0b137c3f-d6bb-45d2-bc35-c554a2d632f9","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-28T12:48:16","port":7780,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:7780\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373738300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"66ad4b3e-cd95-4056-8a6d-418a8cdf2bb6","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-09-28T12:40:44","port":16000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:16000\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363030300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"c0a40140-e565-4043-afa9-c5fc5c220268","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-28T11:56:54","port":221,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:221\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3232310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"7f1d0d4b-44ef-4316-bfb3-5a5a7231c510","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":79}],"http_methods":[{"method":"GET","count":51}],"distinct_ports_total":56,"top_paths":[{"path":"/","count":51,"ports":47}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-29T09:15:54.299423+00:00"}