{"ip":"34.38.234.81","total_events":27,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["27 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,460 bytes sent","bytes_sent":1460,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T04:23:58","last_seen":"2026-09-24T06:45:55","events_24h":0,"events_7d":27,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"81.234.38.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":110,"proto":"tcp","label":"POP3","count":27}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303cf3be89e1c9dcb241abbc40b0a3df75cacdeb776655f0b0a3fa8a474e27f57032069c6d3ac66ce4bf688378a31cb2d2c1dd447fc30e6f25c106d9f1a50796e63b60032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0030120bc3b66e7d149997b6b883576f02b49bab66f6d757ea8cc88b29b3c7eea12e7742be0e3a22934309e1a8d12a3a4d9c23cc90888fec87908bc36cae8c0fe56a15fa15de54b8bd7b5c3222237a4c926abea0ad36b230edc206210cbee3786854827c6366df9260755f6058b5b809decc353e817fa14a795b3c07c47a2d0c3c0e92588aac7a1dc837218321270761c1a2b9ac98b9431ea1d75c67906745621867fb56121b4d40561954c8310a2a2e55d1e119227b83f2d65cfe4cb7c6b9164009514a15a893de61bdda097b8502f7d6baa2d990ccf8c9a4e0c7355d093b103884171343c807963694aabea3952399903dc0193193efb7659a1f9387f0a79eb2a85c78354eb433cf014300e833670a0ad680258c716836e87c9189247943182d98546a6e1c80d6a0e38490b80d777ad8c55f958629978b4e3101801ca6107f927a9b0ae6f8b984148004e8792a929296994b64428509e1c02142c2dc9431ea59c2a2e6b6dbb5437bf3339048514d8caabd216a92082168aa5bc86101619541b26ea71003324ea785a2bc15c4e79a6903a2afac71431434b8da6000a92cd8b37a947f604ecb69b559b7160a018421bc186ecb034f480b18123cb761ed58a39f7f5653525937c36a9bc2817c44091955cbaf72c2cd4b1bd42e779ded72347b32e9011caffc13778e026532754a22cb9e6e908cadb87d2a82ca6a004f958758beb40c493678c80b2cf1c382551b889fc0b8f026c4ce3b5dc0b6da5b256158925381a4ad2ca34bce3502c766bc188ad576486b3f12ee1f7b7b36960b45903e193b7fee61314f5491b834a3984511672ceb4cc0d42ea5beff6b26d5003a7f6962e780cb8d4ba73f5471f898f762777d0a64a89d876a8e8874fc4111303530ae2c2c3ea5e378c14df292ef971029c7775ee1157ce650340c5adbacb015c443dc05cc3b0a2b7405406eefb4e2db1afc6183f6c290c17b56adb916db2867c0b18c71d773fc975c092a4b95641c4a7392cbc883f6c50ac4a7baa71fba22bf87ba55018a589ab0c9657d26abcb5a553c23871193360489097531a810ca16f9b907b9b0601d6c3a9708134d159a64b8a681d99cc51471e4901770e8a7f07e9a415f6abe768c62e781b25775978cc9920f0c566bb19b48239523452ff0a1d3d80a3f63231f1991586816b70283ade8c7ad6fb7f3d1785ec27860008309f47b9a9f94ecbba447333ca1aa055207c5a1bec257893413aeb6b935c074033220396375da43a7c4b05f6090f5c31aebfe315d92698b50461347ace5bd827405918bec8a482684c9a36154ef6cd4954c920721de50ab49a500bc0881e15bab95b300c1e936c73025d8e3746d6a795b45055f69a6824a7c9a94a72b8dc9a9e0acbd8538575c1bc2bf82b88146f21ea95110640ee42731339b3e3b301d566884ceb961bab9c259a56e2fb1ad36a023285939677cfa59c8c08d64c566b9c5fe64830d0300f264f76a69a6be580f10886125c723e7c8eeaeb2188943d81dab60d8a0d1b423b32e646bf8c0dd5f5035f33abafd6b61c52c002c2206c69c23cec2c55033cf7b6978955509d212aa6eabfad5679f6da5359979ca2a6747aa73363362739c06cb4e7a665ab0c673f687bdc4ad3e73f22371848ab58e80aec1d36d1bd8aec1c2da1ed50c15b8774e2df8c69a1ff26545b74e1e3435a2afde0e2265d3609f56450d0b929fbf865001d002074e2df8c69a1ff26545b74e1e3435a2afde0e2265d3609f56450d0b9","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1874,"a11cun030_0000004c_13ee3d34":2672},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":2,"ips":2672}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":27}],"recent_events":[{"timestamp":"2026-09-24T06:45:55","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"53112b78-5993-4d98-b80c-048cd0c6ff02","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-24T06:45:55","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"de245d81-dde1-4162-a864-0210e1b82487","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:45:55","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f1d5d373-5d3f-47fa-9b8c-d7c883f4d006","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:45:54","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004t\r>i`2\u0002\u0001\u0003\u0004\u0017cn=seuxvpsmzgkznkwdzrkw�\u0014seuxvpsmzgkznkwdzrkw","payload_hex":"303a0204740d3e6960320201030417636e3d736575787670736d7a676b7a6e6b77647a726b778014736575787670736d7a676b7a6e6b77647a726b77","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4de5bd00-1761-48bd-b690-f4b8c6d19643","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"5bd5d0677eed7ad6","strings":[">i`2","cn=seuxvpsmzgkznkwdzrkw","seuxvpsmzgkznkwdzrkw"]}},{"timestamp":"2026-09-24T06:45:54","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"14691d34-dde1-4eec-9ec2-9a634e8d1b40","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-24T06:45:54","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006rMt5QU","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006724d74355155","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"96f2de45-999e-4713-9fdb-21e7d3329d76","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"a00ee498bcd959cd","strings":["adminclient-5","rMt5QU"]}},{"timestamp":"2026-09-24T06:45:53","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2a450247-5f8c-4d90-88dc-1e0a0a7a2f63","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-24T06:45:53","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2689c89c-4868-4324-bdfc-cfeb45b30430","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-24T06:45:52","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"4c282a5d-91e4-4b1b-b9e4-d0f47f144bac","seq":1,"duration_ms":94,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-09-24T04:28:50","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u00061TqZ4V","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100063154715a3456","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"872fb8fd-679d-424c-b910-9649f4d1c4a7","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"7b5025730aeb51b7","strings":["adminclient-5","1TqZ4V"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T01:06:40.758421+00:00"}