{"ip":"34.22.113.210","total_events":37,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["37 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,969 bytes sent","bytes_sent":1969,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T03:35:18","last_seen":"2026-09-29T12:13:20","events_24h":37,"events_7d":37,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"210.113.22.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":110,"proto":"tcp","label":"POP3","count":27},{"port":143,"proto":"tcp","label":"IMAP","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003036f826b5838f071344231b68568b8546c69cbbaac88aeb1fb514695f532d0f32e20461fbaf3b2accaae146bfa20110bd1904e91b8b86765b53c528cfc46356bca260032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c03042a0b60441f5dc343b710ceebcaeb4b68a8a6943f7a309114415b54537d7783fd2e2cf774a1a4b57737f5b6f6576267d13bf0d564b46763c6328505acc529b33922dd7acbd93a59f39c1c265070b3186c6f64b4aa2cc73573e6850443193043ab3b5b993ac166921cba6c02ff01fd1f68b6185577691890d596aaaa9cb32f30f68fa97d9d8ba0e7bc04f699442f6002839ccc050aa50a598b2d57632e5ad8b370ddfc9c84b544475e691f5873303385460c63608f84c01474909bba3042830cb5493d9208c327a84b41c6fea088625e691e503710aa2c2038a98a5594ef48966a7d68f8fb097a3772d01a61b04d04af3010b4b7c2b00458586976d33a53e84d6b719d8ae7e86c9b40a08c8e29de364373cf517b78a421b949c35c80d29c186bcb0135538a0600a6166d3078838b2738b9d580c95295ba447555d4bb719636b956dc5808ea31b7683b423cab238eab30fa3bd1098550c2c0ceab66957caadc5e35e6d3307cfa72bda248ff3b15edd95c6da1801f6889493b2585dc6b2a9169519db5fe655119e5a8035a7b986a4717b769476674a59253a0b3ba4bd397cca28c83c0b226e64806ab9659446a8651c5c5b031c7d14311b4b357ab26f1c244b09acb23468002b4aa8bf0c03cb40acbc6159a7a31f43e322a9ac48fc96a5b30ac829192e8fd59ebbd43d067467b836959ce386767c3391e15b278b8275526c46b62943d211fd0b9666d7641632499706c29096b114179a807650045389c27967af2baa2fc97aaabb029dca58dc066a68fa32a8c9360ce535aaa51730d5b3ae869817ec1abf44597ff88def0122cdb61d066900c4b13dd413c5591acab8820591d933e67a64d9112bf36cc3cbe1aadc161521eb0c108cb2fed5a582828fe8f19f33ccacf49bcecad8065c83be07518502d14877215d36b611321899ce6543fc6b305d16020a49828ce7943eba0a9d33781e9a3b7a144be81a8649bab0f94aa5da3c40fb78960f370497a38c6c821818f6a0c980c879ec860efca5235ac82c397e3e39945c0858a2b0cea519598f88bf389216b8d85758c5c06313318e1b4f50aacde466a0ec313fb5677095c778082b0fc87acd81d26b45d6655aaa024b2492fb13304402b39fa395bbf04ac1582df38b3e8c899681c96a9deb2036e301594022d3f33006aa17319c966a49c9f8a4a6380a26f0f116160b0cc0620494584a41b7217d08b5f27412758609b556009d67030abbaf5d48026790be08c28b4e6a4605808817a40935016cad6b0c40c619bbe02810b315b430ca49c634886510dbf50a6248609d7b66bf0a0484a25c11a81db050bf22522b8bba64704415e04706893725eb89cee28b41c59b02c66003b4025f547831147a7ee9a10f36218a56466458b54d50365527c2c69afca561a2c627262e0c545f62117a9149778d15979de626962383186b6382297118949ee4a67a8e7b531bbc13eab1090eec181b9c7575d1338d977c9b7780dbd252f52b88b230735dd5a9ff0866d89624e46a7925453d2036c25081752cdc86517b85f7080a7ed40bdd1304d1dc45d0166bfe6130f0b87821b37c8b760aa0a8663a409b9bf47e2a883c3119588d33c447e74079493052845b4d4832770e6536bf402829d3d8acedd69f2208e1b72d33fbf34705b8bfc06da4aa27af62119581637eb1dfa2579c16c71789a0e71dfb8429b113bc9b3862aa0a001d0020aa27af62119581637eb1dfa2579c16c71789a0e71dfb8429b113bc9b","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1874,"a11cun030_0000004c_13ee3d34":2672},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":2,"ips":2672}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":37}],"recent_events":[{"timestamp":"2026-09-29T12:13:20","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"aed83af0-cf0d-4099-8c01-c79883ecc9d8","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T12:13:20","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4b22d2f3-af4b-40ff-a7bf-35d5977cb2e0","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T12:13:19","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"09651c69-65ba-4680-98a8-49384d758e95","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-29T12:13:19","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006r0Whck","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000672305768636b","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9069bc92-11bb-4424-99f1-d6a0630b3b15","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"3a9542bd086ff9c1","strings":["adminclient-5","r0Whck"]}},{"timestamp":"2026-09-29T12:13:19","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6403b151-f2c2-4ca7-aa20-e80f0e90c41c","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-29T12:13:18","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6e21960f-63a9-4bd7-8c1c-ebc562d36e96","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-29T12:13:18","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004Z\"):`2\u0002\u0001\u0003\u0004\u0017cn=nvcrdueonyyvogettqxq�\u0014nvcrdueonyyvogettqxq","payload_hex":"303a02045a22293a60320201030417636e3d6e7663726475656f6e7979766f6765747471787180146e7663726475656f6e7979766f67657474717871","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9175ee54-4849-45b6-bd31-9bbab6f78ed7","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"3368b97e3a041ed5","strings":["Z\"):`2","cn=nvcrdueonyyvogettqxq","nvcrdueonyyvogettqxq"]}},{"timestamp":"2026-09-29T12:13:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"735bde6f-80e5-4256-aac2-4964669e53b6","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-09-29T12:13:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"0464de2a-57ff-4337-80f2-15e408116db7","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-29T11:57:29","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"03eb81cf-5fae-4d30-80c7-5b0d4248e516","seq":1,"duration_ms":101,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T01:06:30.705857+00:00"}