{"ip":"34.156.193.123","total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,525 bytes sent","bytes_sent":1525,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T03:30:24","last_seen":"2026-09-23T07:28:38","events_24h":0,"events_7d":30,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"123.193.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":30}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303248602131cf62bdbd9eb6265c1055a6248a0203f43edc31971db248f1f533574204c03b69bc0878891e70a844f2d1521575b561901f488ea52d9f221ec0bd56fd30032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0adc6b94a82026e3041b6539b36f8bda88b6aa8861292648a7d75480003c170696f3a6502161937742b700ed8a1d53b0900176aaed61f48f0014b836840899e93e241ab269c03e33b94e4454213873e66746ff1b326d43acd355454f5b638d12fb2a3af2a404f53fa972a13ca7bb598f84990affb9d14b117a6a3b480121ad6c72940c061abba4e0b06b0d1c4cc220c3bcf835d0b853a87b2ad6836bae2b7725e269e3765055a0a01d43b5df296cef52c360ac28d79eb74c8c803fb03b35d34169f9b2b97555d79735e2eb9bd4c7c8187165d9707b72b26630784bb35ec5961e681d4f7c5b35a40bf3b84f83041242b73259867074022e1e86b0caa516564b566f8a62071a33cc59d55f02b49cc0b44169b74424b37130a178bca0ce48e0c753de7e776626781e28a78660c13d3b5b4533983c7371e0509642f280a55174a08b4cf053146deda5c3ed23de5f7c35c0a317cec3b32a0ce5afb86a6995004298708b33aafe00ab59c7dd135c87b13a0f5e21b3d31393b82a75911623bc39c83f8b6841c2c53620a5f597b91414306a8ac8868764d2bad8495207ba888d7f8444f613aca83cffff5b2aa28a54b252aa0a8a01de9693ea15cf8b8c5ec8815af906b92b1855c58c985a5c212f12278819835e26b7224198af262e5147ea63306d47380048ab364212bc0a1aaecf862d546add863497ada84ffc919720018b37a68aabab59e04677f755659808c67831402d49b35178cd6889d4b62b8efa32aff06b8fe761d1b9467c2db749d27cb7bc95166d6afaeec8badfb6dfd4046d15b9b323391ffe7617cb6bb2558a172fa17e056897a8c860d694d1eb9c0f609cc4f9947c1f1aa2073352556cbbe525297672f9aac3383378cc712536f58811ff2210b568673d2c259920e1ce6c32d7965945b3e8af750dba8705ac1480b082dd1b292dd72653a694ee30840b2d54bc891b7d31127c31a2db81711ff229bc42b3c0f3027ab3649b61528126020295617cb6550573b8277ab6807e0c210019480a619ffe3884b7354a831b9f9b8cdd9b9a5da1218ca70b255b026978c61ce628c64957650865a6a9c4fd5f94211c121db161c81144a97106bfa2234c42bbd73a64960dac2775b68115a95c4bca269c120114820ffd3b83357a92ffb36112a40f99635b85a8367005ceaf79c863c46ea2302ce677e3d6352af22afcc422e19e180c778506fd260faa251ed971e3b4259f0461a5a992f31758e47e934f94555fa36056aac8ca6e47c4eb02e6d380566063fd0264b4e83316732a7b4242d88846f90eb327b20cdb1a25d01c1062aa4590446a892fbbee4f833b4511501e7b938e35e3a8c19fbca3c7ca9bbc7c1aca884ac4f47aa613a576b0b43a84c2825f5349b665ff9b40a7fd85dcc985d1bf176d6396acec64489408218811a483930688a303b039f5667247fa25fbb969c91499cdb0916290149207bae9a0069cf2b93bd0507fa30490c3244457635691c35e6cc22a4038d10f1bd632ab72be8a1f8493f026a6590541561074caeb1c9691565cdda18da033be93c5cd9e3427a122a9ca05c0665a64f581c96194473d50bde729a8a5012407c2334fcb14577a04f9880d966ac76ea929d6882f1343fc13fff568a8214c3bdfc232af796f8dcfd2de402dfe908f2436e813ea2a84ee99993ed53c8a5ec2cd66a8d897126c60e3c2ae26cb48b31edff6aec2078001d0020a84ee99993ed53c8a5ec2cd66a8d897126c60e3c2ae26cb48b31edff","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1961,"a11cun030_0000004c_13ee3d34":2234},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2234}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":30}],"recent_events":[{"timestamp":"2026-09-23T07:28:38","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9f646144-2c8c-4bbd-9c32-02a5aecff84c","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T07:28:38","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7a021216-81dc-48a0-87dc-554558cd5d11","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T07:28:37","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"64315a32-854b-4002-9d55-0681e12c5000","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-23T07:28:37","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006SiH3r5","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006536948337235","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"0f73630f-c899-46ee-8714-e47c89c85cea","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"8bdd272374f39e2e","strings":["adminclient-5","SiH3r5"]}},{"timestamp":"2026-09-23T07:28:37","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a9c128f6-ca18-4f58-98d6-631f2178d042","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-23T07:28:36","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"62397ec3-e153-4c7a-ac2f-e904863b3a9e","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-23T07:28:36","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004,�/2`2\u0002\u0001\u0003\u0004\u0017cn=sipvwucdjdqonrpvleej�\u0014sipvwucdjdqonrpvleej","payload_hex":"303a02042cdb2f3260320201030417636e3d73697076777563646a64716f6e7270766c65656a801473697076777563646a64716f6e7270766c65656a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6fee3a73-e600-467b-8d15-3339e1117007","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"1052f02071deddf2","strings":["/2`2","cn=sipvwucdjdqonrpvleej","sipvwucdjdqonrpvleej"]}},{"timestamp":"2026-09-23T07:28:36","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"310a583b-e97f-47e6-97c0-784deaee9350","seq":1,"duration_ms":195,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-09-23T07:28:35","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"192.3.118.146:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"b349e058-0709-4229-ad83-ed283318664a","seq":1,"duration_ms":95,"bytes_in":191,"bytes_out":20},{"timestamp":"2026-09-23T07:28:35","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3afe95cc-f12e-4020-91d3-e7b779f7e9e6","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":1},{"value":"192.3.118.146","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"192.3.118.146:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T13:42:29.837185+00:00"}