{"ip":"34.156.142.35","data_as_of":"2026-10-25T04:40:42+00:00","observed":true,"total_events":26,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["26 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,326 bytes sent","bytes_sent":1326,"session_seconds":6,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T02:48:01","last_seen":"2026-10-09T07:56:38","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"35.142.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":389,"proto":"tcp","label":"LDAP","count":14},{"port":636,"proto":"tcp","label":"LDAPS","count":8},{"port":445,"proto":"tcp","label":"SMB","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651","t13i781000_ab95583b6d39_d41ae481755e"],"tls_client_hello":"16030105c4010005c00303300914ac9f6f65fdb6398b47a131b8d1c9d24dbe3295703177b91969ff6ee96720c47506c63e21f4c8f4f1875d88d1ec9acaf6d5a625dc5669230bf61bc6939eee0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c055c13c1f063ac76cc55fd11275a98e1704baf3a73955d0c7fa442c79c1218a469f9410ac5295bf2732860df89c1b7b2660706a4c11104fd3711969a678aa92ee1aac68f3a092ca22ca883c1ca73b90f2b175c226f392cb8f131958f076422628ee46202a33581263049727233aa00e3a73af0a24c17f5992a0d7787554b2d4378d7723c4f812113044418659b28781a0bd24610b9368043c8c0f030025bc40d575411e0887756aa54634cb3b862578491b1e803597e1a3ff6207c9142bfcecb147c8a90fe17e8ea316f9962aab394ccdc18da65aca2169b94c972a17651eb8b67255db02cd5ca09a0135a0fb5e9fb305610302b595c3ce8698d61a08b0ac4555247b199a01ed56bcf4a5874ebb4e8677bd01c7a077a813df739ef20a7b4bc3105efa1d99a7adee7232feb28c9169298eba680b5016396532330901c1e87e3c13b788718b62172bbe596e7ec847ceea35cf01aa46437823166ee021ac6aa77600a4004886390d6a36389633f2dc414b695193e04a2cbca3e41159d651b68411c25964a0f9e5930b286a7bb6a462b54cb761546a1278ae2318f4d6479515c38866ac6e5b4e81410bf5339652bc1ce8d6b4cec29a7ad836aff9cb770470dbc7bbf1d7a915399f02e8816691565d153667f330d2faa67f021c288514fe643017d16f57dcbbfab8cca7e498b3e608cf9c86fbec178aa2220e686cbdd379631342aae6a33250b72744c2c967ae6674c7506143e5815139637549e80131269adcb379788c254515686ba652813938b8257f06faab2539545ae4909f014210a2377c3b67768a2f83b6105fc097f9b5a3f883bfe663c6aa75a1a3bc4abb45b609ea0881f0186a727f7f7877f63200bc45a64e8216f820598581503657b59121c3b8314109ca497a264b180b179426bf52f3217e74bbbf389f6660802c3ccbdf58cc9d54073a480dabc8bab9f721fd5c3a3c2836dd007e2a8a68d820bbd9d26e49183a0812079fbca789d433655264fdd20d277235b3c17353694a2bc2ab38d2a716fbbad654c997555fa92a8de8bb9037375fbf268ade09076d13306869ca3e2313333b0f4637be0ed9126ad4040863a10da36ac1801e45baa4adb127154aa194a70dbf01a6518ac5c09741d169770a626dbac3cfc4a3c2f8e6860fd7a69bbc3b1289967e4c581b709182a330661aae2a35bc612762635067c1d12edc6341de53a8bbf013fc6a5572430783604689b13ad4db5872f78e9c44811964a3e4142af705162092a7cc74710e221b0d796bad5a808362a37d39563c418f732ba12c1c0ece84914bc16927b3c5117a5e8a54a4da298dd6617addb8a9d6642e4a3289ee62b94157391a71a50b7921eb75be6672611e19773d7b770e070b5b7724565009d7f53f8092310642be5a1212315616d4a78c8e2465a83661e4a7b43168c8338a32086927b2988f55fbc5422909becb44d120c54e672c88f14e5edb9532ca13f5c528bc460c9f71968f449b8e36b2eb9bb912f919b7b1968b096bc950a4767c95f287432fe562618808d50383182599f94501d39573a97cae8b82219af61079c88127b97772ca455f431dd53c8b084596e89232ca99396bec54f2f261baac05b01a2b6da976fa010141878b4b91c13cc6b946329f39e8626db204e8696254515727a8a0858d731252235d317717954b2892bbb49e5a08335546c724d3481fb336a207870929001d0020731252235d317717954b2892bbb49e5a08335546c724d3481fb336a2","tls_ja3":["b3e88a126e6e0179ae465227a52f60ad","9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34","b10cun000_00000000_334359b9"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2721,"b11cun030_00040012_13ee3d34":5365,"b10cun000_00000000_334359b9":2532,"t13i781000_ab95583b6d39_d41ae481755e":611},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":26}],"recent_events":[{"timestamp":"2026-10-09T07:56:38","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"be3ddf55-6642-456d-ac82-5b86db7c5997","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":78},{"timestamp":"2026-10-09T07:56:37","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0013333333333333337\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0002","payload_hex":"00000066fe534d4240000000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000001333333333333333333333333333333700000000000000000202","method":"","user_agent":"","ja3":"","session":"7a4a7b68-30e7-4820-9e33-30a0d39dd5e5","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":13,"enriched":{"digest":"b8b1f8a40c33d940","strings":["SMB@","333333333333337"]}},{"timestamp":"2026-10-09T07:30:39","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G���,���`~�\u0000��{�Ֆ�w����<=�o�\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000","payload_hex":"16030000530100004f03003f47d7f7ba2ceeeab2607ef300fd827bb9d596c8779be6c4db3c3ddb6fef106e00002800160013000a006600050004006500640063006200610060001500120009001400110008000600030100","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"6493fd69-47ec-40c2-94d7-e6a32d5dcdba","seq":1,"duration_ms":195,"bytes_in":88,"bytes_out":13,"enriched":{"digest":"28bd7217cbe4629c","label":"TLS/SSL","strings":["edcba`"]}},{"timestamp":"2026-10-09T07:30:34","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"575cb520-970d-4c7d-9483-19d6eb505c9b","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-10-09T07:30:28","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"60a93af3-5af8-4e95-99d4-6bb155d14f8b","seq":1,"duration_ms":6101,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-10-09T07:30:17","port":389,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"12b90428-af80-4a8e-af74-c09132d53d35","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":78},{"timestamp":"2026-10-09T07:30:12","port":389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"6c8a21c6-f644-49c5-8715-81a7eced9bdb","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13},{"timestamp":"2026-10-09T07:30:07","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0\f\u0002\u0001\u0001`\u0007\u0002\u0001\u0002\u0004\u0000�\u0000","payload_hex":"300c020101600702010204008000","method":"","user_agent":"","ja3":"","session":"5e1484c3-e124-4864-a42d-bc005b4a33cd","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":13},{"timestamp":"2026-10-09T07:30:02","port":389,"proto":"tcp","app_proto":"","app_protocol":"ldap","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","method":"","user_agent":"","ja3":"","session":"e868d4ba-f418-4251-bae0-7b06e075dd9a","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-10-09T06:16:21","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0016\u0003\u0000\u0000S\u0001\u0000\u0000O\u0003\u0000?G���,���`~�\u0000��{�Ֆ�w����<=�o�\u0010n\u0000\u0000(\u0000\u0016\u0000\u0013\u0000\n\u0000f\u0000\u0005\u0000\u0004\u0000e\u0000d\u0000c\u0000b\u0000a\u0000`\u0000\u0015\u0000\u0012\u0000\t\u0000\u0014\u0000\u0011\u0000\b\u0000\u0006\u0000\u0003\u0001\u0000","payload_hex":"16030000530100004f03003f47d7f7ba2ceeeab2607ef300fd827bb9d596c8779be6c4db3c3ddb6fef106e00002800160013000a006600050004006500640063006200610060001500120009001400110008000600030100","method":"","user_agent":"","ja3":"b3e88a126e6e0179ae465227a52f60ad","session":"676c918b-4343-4daf-8501-c4ffd9356779","seq":1,"duration_ms":113,"bytes_in":88,"bytes_out":13,"enriched":{"digest":"28bd7217cbe4629c","label":"TLS/SSL","strings":["edcba`"]}}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":7,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:445","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}