{"ip":"34.156.162.14","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,017 bytes sent","bytes_sent":1017,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T03:12:10","last_seen":"2026-09-29T04:19:53","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"14.162.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c0030392fa060feee55894332d5b882b6dc8dc244910236308f0d5eb494d8a73b5b59a20402126d39c3c0e8e1377a736a58c2217c0972aeb5eb5596ad86efbd53e36123c0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c05571a388c7cf2e7c9720dcb2b399877001ab0c0255fd0450f379283169a89b1bc07063c8b7979ddd206b937213ed97b144734b1912538b982e92e08dd972c86a5b840d855907e7c3074ac2b485856d21c090cabce6a460def50168ab9593682eb2558680236baaf83c1b869b78411c265640b87a4cafc53d909130d006bee63968b4b835c1c75883a91d60b53108d8ae95376fe01358cf6b32c4b38187039e5dcc2a0470b77855b8a9a9ccb3410b40abcb9dc22a1a8132a5653ba0f3a9c6b856704a32f7c794027548964c63941365ca99a98238acc792696be887ae193304142cf312a87c524dca0150c0c622685176c045a4c326c0049394ed8730f64823775b2b62796cfd3b0d7deb1a628498a461beed0a9a1d472e0655a1d22a96ea91723288a558c944278760c63a716a306cdbb6af5010708b41b575d55333f71235ebce2532a2f7945187666f3246b897d571c24a3888c342004c3200a578586622bfa66bcef2a2e69c085ab5043a96aad5c09960b6ca8c609723413e84c4a5e870a355f8cb5a0a13ab1c11486b61db5bbf8690796373663c697c8035518d0bc9f646ad1224c81ee75d25d8c9d31c964269965f86b20fbc0a91fc13c2f5008e999adfb13d6a4156f70628a348912390af2a359d7ba553bea4891a219dd827605a3946c59b1195e2339a9c8df0e5554619c8929b69b6085aefbc68e7c16f69223662023c186841e7e7abf525ad48c73d0bc9099f9a991e129f3f2108aeecc54d2308ac58aa1ef2931407a616802a0b000d7e6c9a95c068abb8a2100c1a9fdb0f4e956e6322aa5705ab3bf1abb7ab6f7d4c331e730fdd38a208a3a2214344059719c3f647278833d2d5925c029d86a126c219439520bb9f7325e50449f7876b55a0757e386255da86bb90c9e5b1b5a0f4a967d6049047a9e11b9d78f9ae31d5a1801452e4a9a0abfc77af72c067178570ba7309b9999b613fbcf134266215983306ec254fc4525004c26974a6bf20a83aa788b899691cbb1455c338c1cab075e95c46ec5611d6e68c16671e6464c0896478a81ac5d8d37c138848c2825eaa1a3973c26f43831ef1ea4d2dea2719c09cb3f15bd5f1baf2ecab11048a46dc9917d23239cab37ceac37a34911ca81bf0a7a90e056319c073dc4255803304244b7eb93222c2949198631009307239f85c2b896aa50a24cb386ef1327dc0b2a7f86c61ede503e4e16ec5b1b7b01112a43bc6d7bc4d832c55ba073943d2a75ae3a933ea06ae2961f9c3445386c0dda82d65788bef4015d3a062e088c42e81adf4c1029ef3c4522665b63b367b25b57854322de0cff6605320697e27c471d13c5313d70cfd6aca2e00722b7349c4436609826e05484ec17b0ea4789c82d8876ef33e2b4bbeff17089c9063c1b43f39f22545760cc76a25a6182184139c920753bae099fc5ca57f2839684c3d1828065e5abfed309e8e4408585b625857c656e4b9aecbc4813accb080af42e117f388800bc140a1900572c73818927b88d3bc65a96633482f135a069dd7079f72142a37b67849012667a35c577da9f7557aa938bed76eadcb3bccc31214603b40f927056c0ca51a4e37fa912d8528a9792c161684f93b9a1477c98d61115288a37cc2e1e91946606ce70c22e994aa3f3069f63ef89abdc432b6fe1bf5a5f1ccb866c425f96576bdf693d7cdbba831a5f9c015b4863a6cc1990462001d00201bf5a5f1ccb866c425f96576bdf693d7cdbba831a5f9c015b4863a6c","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1928,"b11cun030_00040012_13ee3d34":5092},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":20}],"recent_events":[{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"25c3a0e0-74cb-450f-8c82-1ce214226a55","seq":1,"duration_ms":15,"bytes_in":192,"bytes_out":20},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e46128f6-a271-4a00-897e-1b36e077067d","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"46b6c5c4-8f4a-44bd-9940-605b117d5f0a","seq":1,"duration_ms":113,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\u001b.$�`2\u0002\u0001\u0003\u0004\u0017cn=dmrcoldzlmyeyktqmuyr�\u0014dmrcoldzlmyeyktqmuyr","payload_hex":"303a02041b2e249560320201030417636e3d646d72636f6c647a6c6d7965796b74716d7579728014646d72636f6c647a6c6d7965796b74716d757972","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e280cb03-a58a-4055-823f-caf97df37cf5","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"c4202440cfbe6f94","strings":["cn=dmrcoldzlmyeyktqmuyr","dmrcoldzlmyeyktqmuyr"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e3889cd3-bf20-47a9-b30b-d81cb0b3d650","seq":1,"duration_ms":116,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c3f9273f-66af-4849-b415-d9f374f1af55","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006FZjLBm","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006465a6a4c426d","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1d79ee03-960a-4dbe-a05a-a9f2f27ec0c0","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"301694c31481d54e","strings":["adminclient-5","FZjLBm"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a3286b23-05e5-4069-8a20-8c4b46320b33","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ca669e4a-80ea-4203-97e1-1512e66b04f7","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T04:19:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"646030d2-aa82-45ec-b03f-089faaf06ba4","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T10:48:57.436429+00:00"}