{"ip":"34.156.55.204","data_as_of":"2026-10-25T12:03:45+00:00","observed":true,"total_events":38,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["38 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,989 bytes sent","bytes_sent":1989,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-10T02:34:35","last_seen":"2026-10-10T04:14:09","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"204.55.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20},{"port":110,"proto":"tcp","label":"POP3","count":18}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303f6fae63d7acbae0f77dc86aa85d3ab859e6b27f4072d8331d2248e0c3049d96820e1535147ec55412c98cf399f6f525bea3efcad8b542adee6279e35004af58d640032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0f500154892169e5700a95940d363292c955af4c072bda75d294b399eb5a3a65a7361a4a78b8a6336b91face191aec4883013338915b7ecfcc5d9614902b92027165e1d28224ea5c192e1a03cb1acb2209cf7b817c3d269e27a7cea4c3da32bc91d34641c2a7b93b455bef40673f2c14e13ba517663f60124735c8bc1d876421ac21e90a68f04157752822cb364a61446feb1b49f0c89d3400e6c0b6f5aac56e32847bda58233e23aed7820eaeb928b380c3514275877c21c16588acc6705cc8f0a5151ae1545d640a8f7a6af45c46c0145c8674cbb5ee167c8f517b89a6cd7b7193f62272a0bbf57bb3643794ab34074804b988f72658a1c05fb3ca11c2cc51c13a37f77533e085217a92064b6655ad4ccf06971e8a326b8a52416c98fd4f4199bc8ca45561ec049347f5628260765601099984117f2f37c36dc3a1a37c438d191a3db797ef01483d180287439991426f28692ec6347d33920fb72af29eacac6160ca718ab003c972bb94cd075216517cf1242c9c7d472739a1199d671628721ca59b545c73d78351a32e1af99467844a40d3aa5ad97e32893e5421fb7153900a165646807308476ba1820e22322d20ea4f3169e11332a088f7a125cb0a66f45c15113a5238e3653f260c65958cbfafa0ed9f0713e526e894b8deee49ffa9562ff54bc3741b50c1b13c5f869329bc8d23b8049a96a2664b9a5d259b9ec26f4e81214886e43bc2991dcc4d0e7bb06107c6c0829b2ec420f72056aba1eccba45c7300290a1829ba30e9e94cc5284722600403b260f94475990c12805c25128a416fa235bcf88ae7f9123d596c5db0556bee2cb8dd19c19077640724b85483857bb0a1fcab288657a0fcc594ac467ddd267f4453c6d54589f4b6c43f91a066239a778036af2a38b2c1f96115065066c9f8b1a851a4714abafb251090ec8b852f3a7809c7b1be014bf05512fc10aa370210bc2a8ef56cfe0d9a0f98b64bc102114964f19293f18639f5fcc814644ceaa2c53bba98b25cb3e724c88a18c7b1bfc6d23a07cb95b086dc26a1fdac08c09a2db852f217068437858ac4231ebd05f19d3528f22a52ad687ac5190b5d14b7dc00c53543c7b040dd02256e1c98de5939667a50b27278f92065d654c9d93c9a9bc68b17cd436210a4cdbc8022a6199de139ac99bc86a1bb2c94c5d3e5268f2b57b2565026a43509a5ba9c441a1352682eefccba36994ff6accf060ba604788398a353c76cc19d0b9af250a8672619e239c76147cefec479b19a2c10054dc4841f1f39f3aa8abb4c29ea395b5924970a8a90c9a0b98b0f949abb393b84a2ad73249badab0cd39134fc8293752233bf481fac2610a66c726f6b58d5355841b0ae09ccdd0a96283a99631419a20d275a6db08cd51c9b8ec2550591ad6653764137a75c8923daac3bd0b0ef7bc82207011fa5644db5932e20c4b71b1cd4248203150bba34443ade7121ac2bf611a70697a2150e487de21c1aec92bab25b40193138ef95a8cf18a9dec2dbf772df4aa1c207336a2e2c4fca63633c343442b481c643b7b70c119206991c5cbe98290b12c3693aa73e62b2aa6107a5a6a3ea98c197c3a7563c55491205213800899a7a5c9408eb506c7331ce974f7184bba87fe613d350fbe879659c266a29d60a845fe0473c4816660ec29a5e769334d911aa7371c8f97514a3f805e5aa185bc0374fcf12a53ad2c5f001d0020ec29a5e769334d911aa7371c8f97514a3f805e5aa185bc0374fcf12a","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-10","count":38}],"recent_events":[{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"b8142283-84bb-40ba-8f1a-7548397eb7bf","seq":1,"duration_ms":10,"bytes_in":191,"bytes_out":5},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"401d159d-1feb-45ab-9144-6bada4b94c5a","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c7a08286-ebe6-4ace-a925-1ef025fdbdd9","seq":1,"duration_ms":111,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004p�=s`2\u0002\u0001\u0003\u0004\u0017cn=rpkihzihevjmnyoutevf�\u0014rpkihzihevjmnyoutevf","payload_hex":"303a020470e03d7360320201030417636e3d72706b69687a696865766a6d6e796f7574657666801472706b69687a696865766a6d6e796f7574657666","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1c8a1805-bcf1-4f20-b60c-d1610dbfd419","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"b98d17e03ee2aeaa","strings":["=s`2","cn=rpkihzihevjmnyoutevf","rpkihzihevjmnyoutevf"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"962b577d-010b-4d20-b150-4b320b639e54","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006q0yUyf","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006713079557966","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a3658df8-0715-4d80-ae48-8040a4e37c85","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"9efeb79013ed5235","strings":["adminclient-5","q0yUyf"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"27040420-3d75-48e6-a86f-8a8537d3c9fe","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a1c67602-49ac-4a07-acb0-4d463696aa39","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-10T04:14:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b33e3a23-914a-49c5-98c7-5e9d8ed5b734","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-10T03:59:09","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6f6c98fd-9f77-4ca7-a6f1-3057f5427830","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}