{"ip":"34.156.235.148","data_as_of":"2026-10-25T12:03:46+00:00","observed":true,"total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,518 bytes sent","bytes_sent":1518,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-06-17T07:32:28","last_seen":"2026-10-10T03:21:56","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"148.235.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20},{"port":21,"proto":"tcp","label":"FTP","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303600941e02795d04ce102663d7f7d7ad8cb642e97dd0810011a8cf652bc80ed612088c8298788940cd39131aa8164fc4384d7cdcd3701a8c32585365d9345d2c5f20032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c04e63255c27c72db19d90d64452287a0062523d6bb27371939fb8b9b387736d411cefc1cea21c6cea64cbee06b70c6b00e6ec598a18294b323e07e05ab3c076d2591de6d35c10ea81535836fff30998504da6523d1d4c19d648142d75770251800c35b69d67b4fc0bc631442a144387bc4800c5058c2508a2b631a095e588fcc6c467d37b546649c5714bd593091b9bac5a56776c988ea6e03cab11082a39cf33c016f1036ad1460e2518916f22506d19461e9b25a5888446731e0ac147fab24a14b594ccf9a6e6828cf5e30f94093fe633585f2013a87c141b46b8f040c70ff52390b3067e3816d0e8266ef83af891000a55b25e2769a4c27659170a6266ad3830234f833039e1377551b06a8485688689053b4e62a679c8dbacfb919ba7693c4242c1ac17cfc3d399e0ba3ae33302d6f26b8ee5041a3a89e31a4af0409e9b455fd331bdacdc1968900940417c7842bad15726fab937b7d7b656c118c74168c6027d0ff65f95fc9eb1739716593b6f05ac65a0bfa5528ecaf7ae226404695726e009749fc8addcd05a13587653217d21b820d003ca3b80b001d84203bb05d81040114c5c013b45fe27b8ce665696d32b18c00961b52f920c6c5f2577661ca315d76136f09f98798b3664cb6faa92fe7b4124ea1262a1423693b438f00a6b7b820ccc5fdbaa1c106023b673a2a4f8aa171c0a0307292781ada6041027e27b8da3320b712671908d82c5cd987bb8b8292fcda86f851228ac202262d71d9d3a715a19517f9bcc48ba46b6260076e9b5f50529461c151218a1950b88659bb7380b9c03c239a969c6d419358c8b1811a0319f8a9a170275a0d93fdfb83319649f4c6c31d91208a865ad67ca76ab380ca7d931b51aabc1e34d41d0b374a3c1549798cbb461c81a375b6a5894265d8ee4878101b209202149404a80c8ba0f61c65f57b4b0f9c9379c3d871a15b84a75ba106ade1c66f49210dbc21d1cf1cd47370b48d48d6a5c9009e840087b530e6c710144adef3051a3c6a1a6142202a02d658324a93a36eafba66062718c1c76be930d81e560897b47b5f7bcd77b04c4a64581462ece63a820bb7281a28249457722c63601785d85f69435501bf6c99b71ac7a5a66553395aee293b887161f1752027812b4e3f56cf6950b0d49161682be45242bc68a3fc782205c32cb95bc1030f7a4af2965a4c51b5d563aa4c15155d74af3f147b2562217b150c88706ed23378bb4b7c0c8b675b13000c61cf98c85e8a5794434a253e74899678a6cba1782a31b91359befec39ddd3b32ec65d15b7b7b0696ec513caec24ae09423dde75274388ace6bb7341984aade94fe165cdc92a1fd5eb81f1290df931acb18419b40659f61458c01709a48b16da7c6d2a3719a8ba74278a72d396056a37c4aa6c7ce668004fd2b24bf4833e491bc3a8c24062157ff4162bf3239a83b1861c51d03a210c712d3683069602a5221c09c0815ac0699839247848b159bfb607e0951155002cf9595d3d23851b5ace59680b45c5a9655bb90723c168b5cd99a2408b2451c4e45b030445b6f701b2120b229cb1912ccdf4d15e549aa7d3b09fcfac9cb08c6ba375c6a3a36a7b8a23d3937a1665a4c4753a08a7682baaac67ea6f1e071b91ca310ecefe94b530085eb71a9622745e4476ebe9427228893706f50e30b541d4c44dda24448beb7677c996a48c500328a8a05683d015001d002028893706f50e30b541d4c44dda24448beb7677c996a48c500328a8a0","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-10","count":20}],"recent_events":[{"timestamp":"2026-10-10T03:21:56","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"0893c0c7-c932-4658-b7b0-7a2312b38012","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-10T03:21:55","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006kk1DcV","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100066b6b31446356","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e6137726-33ab-4536-893d-ee395e1de6db","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"affcb368caa99838","strings":["adminclient-5","kk1DcV"]}},{"timestamp":"2026-10-10T03:21:55","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c43d8d77-b045-4601-bc53-7456c797f9e0","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-10T03:21:55","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ba6d904b-19cd-474b-aaad-9e39683f2608","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-10T03:21:54","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004uf۔`2\u0002\u0001\u0003\u0004\u0017cn=odryxsgodvkmznxptkei�\u0014odryxsgodvkmznxptkei","payload_hex":"303a02047566db9460320201030417636e3d6f6472797873676f64766b6d7a6e7870746b656980146f6472797873676f64766b6d7a6e7870746b6569","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cc2b7ce5-68fd-4971-be02-dbc331915c1b","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"84238218974c1239","strings":["cn=odryxsgodvkmznxptkei","odryxsgodvkmznxptkei"]}},{"timestamp":"2026-10-10T03:21:54","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f2718e79-0eba-4073-991a-912356ee03a7","seq":1,"duration_ms":195,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-10-10T03:21:54","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"22453ef7-8788-4d44-b4a2-8a7e52f0483e","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-10T03:21:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"452cbf82-9d68-46bd-b5a2-6a8874797e4a","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-10T03:21:53","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f07cfec0-419d-4499-9050-be68438c926f","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-10T03:21:52","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"dc644ceb-b33e-4c5c-a5c1-c04a7ef4244e","seq":1,"duration_ms":94,"bytes_in":190,"bytes_out":20}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":3,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}