{"ip":"34.26.12.70","total_events":269,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"190+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 190 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"63,158 bytes sent","bytes_sent":63158,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T00:12:57","last_seen":"2026-09-27T00:13:02","events_24h":0,"events_7d":269,"geo":{"country_code":"US","country_name":"United States","region":"South Carolina","city":"North Charleston","lat":32.8608,"lon":-79.9746,"asn":396982,"org":"Google LLC"},"source_domain":"70.12.26.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":4},{"port":6380,"proto":"tcp","label":"","count":4},{"port":8099,"proto":"tcp","label":"","count":2},{"port":28017,"proto":"tcp","label":"","count":2},{"port":9990,"proto":"tcp","label":"","count":2},{"port":8086,"proto":"tcp","label":"InfluxDB","count":2},{"port":8030,"proto":"tcp","label":"","count":2},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":2},{"port":5900,"proto":"tcp","label":"VNC","count":2},{"port":34567,"proto":"tcp","label":"","count":2},{"port":6000,"proto":"tcp","label":"X11","count":2},{"port":10001,"proto":"tcp","label":"","count":2},{"port":8787,"proto":"tcp","label":"","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":2},{"port":8554,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ea010000e603038dfc4e934a18075f431be2c8fea4fa17f5239a46e5d46bb01f884fce05282762202bf97899868da946e3bda7808ea4f5b24dd91a5afb3acc1ddbc303ece8dfdfc50026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a13011302130301000077000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b00050403040303003300260024001d00206cf06cd76644113c3e06b0b8ecb653096fc9aa156a9a29c32223d32ea4627b3b","tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"http_akin":["b11cun050_00060013_3ef9a8f6"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3153,"b11cun050_00060013_3ef9a8f6":658},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:47.0) Gecko/20100101 Firefox/47.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36 Vivaldi/2.6.1566.49","Mozilla/5.0 (Linux; Android 7.1.2; Redmi 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36","WebCopier v4.6","Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.81 Mobile/15E148 Safari/605.1","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2876.0 Safari/537.36","Opera/9.80 (X11; Linux x86_64; U; pl) Presto/2.7.62 Version/11.00","Mozilla/5.0 (Linux; Android 9; Pixel 2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36"],"timeline":[{"date":"2026-09-27","count":269}],"recent_events":[{"timestamp":"2026-09-27T00:13:02","port":8448,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8448\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420322e323b20656e2d63613b2047542d50313030304d204275696c642f46524f594f29204170706c655765624b69742f3533332e3120284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e30204d6f62696c65205361666172692f3533332e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1","ja3":"19e29534fd49dd27d09234e639c4057e","session":"c525f274-1259-4d6d-a0c9-663486ee420a","seq":1,"duration_ms":100,"bytes_in":258,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e3029204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34322e302e323331312e313335205361666172692f3533372e333620456467652f31322e31303234300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240","ja3":"19e29534fd49dd27d09234e639c4057e","session":"1ddb0697-9861-4939-bfbf-77d872896301","seq":1,"duration_ms":100,"bytes_in":240,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8686,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8686\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383638360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37332e302e333638332e3836205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"125e4dc4-cd66-4386-aeaf-af41f6e00c69","seq":1,"duration_ms":100,"bytes_in":231,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8787,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8787\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383738370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37352e302e333737302e313432205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"4dab933e-01b7-4adf-9505-058d873dde9f","seq":1,"duration_ms":103,"bytes_in":225,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8800,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8800\",\"user-agent\":\"Mozilla/5.0 (X11; CrOS aarch64 12239.67.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.102 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383830300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b2043724f5320616172636836342031323233392e36372e3029204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313032205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; CrOS aarch64 12239.67.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.102 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"260122a1-ba69-4dcc-9e11-fa04b2c77945","seq":1,"duration_ms":100,"bytes_in":239,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8898,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8898\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 8.1.0; CPH1823 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420382e312e303b2043504831383233204275696c642f4f313130313929204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36392e302e333439372e313030204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 8.1.0; CPH1823 Build/O11019) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"97b93862-fcc0-4575-9b7e-e1c7b0f4dfa9","seq":1,"duration_ms":102,"bytes_in":260,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":8900,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8900\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; Pixel XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383930300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20506978656c20584c29204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313131204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; Pixel XL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"aafca52d-52d7-485a-b9dd-543f789c8ff4","seq":1,"duration_ms":100,"bytes_in":244,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":9004,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9004\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20534e452d4c583129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e3839204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; SNE-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"da0b2e75-e68d-4fcb-86cf-f6616190afbb","seq":1,"duration_ms":101,"bytes_in":242,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":9003,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9003\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3879.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37382e302e333837392e30205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3879.0 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"070ad09f-4522-4220-9ffb-7f08accdbb9b","seq":1,"duration_ms":103,"bytes_in":231,"bytes_out":76},{"timestamp":"2026-09-27T00:13:02","port":9007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9007\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.14\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31305f3529204170706c655765624b69742f3630322e322e313420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31302e302e31205361666172692f3630322e322e31340d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.14","ja3":"19e29534fd49dd27d09234e639c4057e","session":"9df3f00e-5180-4a20-8919-66cff0df46e3","seq":1,"duration_ms":101,"bytes_in":242,"bytes_out":76}],"http_methods":[{"method":"GET","count":269}],"distinct_ports_total":190,"top_paths":[{"path":"/","count":269,"ports":190}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8448","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Linux; U; Android 2.2; en-ca; GT-P1000M Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T16:09:51.591315+00:00"}