{"ip":"34.34.177.236","total_events":121,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"97+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 97 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,265 bytes sent","bytes_sent":16265,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-01T08:48:45","last_seen":"2026-09-23T09:52:23","events_24h":9,"events_7d":51,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"236.177.34.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":139,"proto":"tcp","label":"SMB","count":5},{"port":873,"proto":"tcp","label":"Rsync","count":5},{"port":9200,"proto":"tcp","label":"Elastic","count":4},{"port":445,"proto":"tcp","label":"SMB","count":4},{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":8873,"proto":"tcp","label":"","count":3},{"port":9869,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":5432,"proto":"tcp","label":"Postgres","count":2},{"port":2049,"proto":"tcp","label":"NFS","count":2},{"port":8188,"proto":"tcp","label":"","count":1},{"port":6464,"proto":"tcp","label":"","count":1},{"port":5433,"proto":"tcp","label":"","count":1},{"port":19013,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":296,"a11cun050_0000004f_0d8a8ff5":84},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":86}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0","python-requests/2.32.5"],"timeline":[{"date":"2026-08-01","count":1},{"date":"2026-08-25","count":10},{"date":"2026-08-30","count":1},{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":9},{"date":"2026-09-02","count":9},{"date":"2026-09-10","count":22},{"date":"2026-09-11","count":2},{"date":"2026-09-12","count":1},{"date":"2026-09-15","count":10},{"date":"2026-09-16","count":4},{"date":"2026-09-18","count":12},{"date":"2026-09-19","count":17},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":9},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":9}],"recent_events":[{"timestamp":"2026-09-23T09:52:23","port":1167,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:1167\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313136370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"81e1398a-20cb-4a9b-9d44-825b082acc7d","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-23T09:51:35","port":9944,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9944\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393934340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"8b373142-265b-4a47-ab61-fefb6c76ebfa","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-23T09:44:51","port":8083,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8083\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"41e5b5fe-c351-483a-a57a-eb3de4ddd6f2","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-23T09:44:50","port":987,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:987\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3938370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"1142aab1-2328-4941-91c7-e161a9d81645","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":78},{"timestamp":"2026-09-23T09:43:29","port":3950,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:3950\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a333935300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"e110e2a8-19de-4968-a737-1f98933b3123","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-23T09:40:58","port":8384,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:8384\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a383338340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"42ab68ba-ccd9-4565-aa06-cfad57f25afc","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-23T08:55:06","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0003�B`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0005M�I\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028038d42600000000000000002000186a3054d88490000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"e88d86a0-f700-40cc-81b0-c62736e2ab90","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-23T08:52:30","port":3082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3082\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333038320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"74878982-61b4-46d3-8dd6-e1b080865305","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-23T08:47:23","port":9872,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:9872\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393837320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"db670aa2-08d2-4c6b-a96b-139fc9bb58a3","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-22T11:18:36","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D DBDIDFCODCDCDICODIDBCODCDADBCACA\u0000 FHEJEOEEEPFHFDCACACACACACACACAAA\u0000","payload_hex":"8100004420444244494446434f444344434449434f44494442434f4443444144424341434100204648454a454f454545504648464443414341434143414341434143414341414100","method":"","user_agent":"","ja3":"","session":"fe647d05-a235-4fe1-b6d3-2a959f61faca","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":13,"enriched":{"digest":"648036ca71f83905","strings":["D DBDIDFCODCDCDICODIDBCODCDADBCACA","FHEJEOEEEPFHFDCACACACACACACACAAA","D DBDIDFCODCDCDICODIDBCODCDADBCACA FHEJEOEEEPFHFDCACACACACACACACAAA"]}}],"http_methods":[{"method":"GET","count":96}],"distinct_ports_total":97,"top_paths":[{"path":"/","count":96,"ports":89}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":3}],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:1167","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-23T13:31:01.682182+00:00"}