{"ip":"34.38.237.247","total_events":130,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"99+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 99 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,510 bytes sent","bytes_sent":16510,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-07T05:09:49","last_seen":"2026-09-24T08:02:23","events_24h":3,"events_7d":27,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"247.237.38.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":8},{"port":2049,"proto":"tcp","label":"NFS","count":7},{"port":443,"proto":"tcp","label":"HTTPS","count":7},{"port":5433,"proto":"tcp","label":"","count":4},{"port":8873,"proto":"tcp","label":"","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":502,"proto":"tcp","label":"","count":2},{"port":12469,"proto":"tcp","label":"","count":2},{"port":8106,"proto":"tcp","label":"","count":2},{"port":5432,"proto":"tcp","label":"Postgres","count":2},{"port":9200,"proto":"tcp","label":"Elastic","count":2},{"port":1023,"proto":"tcp","label":"","count":1},{"port":20080,"proto":"tcp","label":"","count":1},{"port":54813,"proto":"tcp","label":"","count":1},{"port":30698,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030106130100060f0303e8779223b0a6acd4481101c272f7578b19bea1a48ba3a91c27cef6cc39bbeaf020c4886c6c02600db774745f625c8d32405b3e8fdc728ac01081a4100b69b708ab0048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c064d6a6ec985a5d41412e525d85f10c9195cd2f55a226056ea474b65c2a719a559ec9060d5ee266b7e6c104c571db811101b1adb3927f9151981c39119c2c1c10a4c06bd6b6d840b071a3a49de69109407f3a2409fab57d20fbb107643e7c4aa44db83dd5d9714c5064b5675e4dba5b50245e23ccaa58c04c596bb6c23c2be81877a1f5678bb13cff94cd662b3ee6e198df8b16ea5a7a66f51649dccad03869ddb490a3d5692719c64141b5bd88998b4c2822a1af698b03aef342f32a2275f0c734dac2993aa2ab832f39eabd42854d987b292f807d6d567cfb70c187103882861e1ee0b76bc97366764332846df6c4b6170b186913b46c8a2631c73afa280a245a25fb4906030c3699d6b3a2d40435a6aad756b6045a0c1bb03e0b065c95c47fbb876310c691d2074c2a09a73d7c67a03232ea470b618cab56541f97d8293d681314f76a1e363f30c78866d1c630187dda9216a20c40993b0cc73475d212acbd772041f972d316b6083bb367f01f31060858c8172d2c9b20528e9ad93c8e651e96e065fbb45ac376c2d2ec891fa27a04703638b52e8f0971e2103c06b09d9e0c827d35808ff442b810b4e01003c0874321042ed1b41a8750b9ea4327b94422e2801f7ac36f6eb58476f920ee3cbdcb58cf9d3b00985bcac641a549292304051ce6a13c0b8206104ccb6a417d9f75bfd78167c98bb0ccaa56e5849db99253ee482d11a1a40e46b577706db295452031c017d6c7415274ee66617310a4d3f039233b1882c5848eaa86848bcd52c762b3496e4e382a0ab498c2bb4525e42797d9274423ab5ebc80c3b127927b16ac1538364a371ed06802f32ed5d79794a2c0c9d5217304a3fe344228a5b29e06533d4a72e3481611ac4512f19b2b419cfc815a65437dea520d4af059b3736dcb79219f1cbac3f16eaad2b115064b2de248410b57d339159a779d03097935274982e316bac290a0611dcce34abef60dc86b4187629e7278a680127a542c5e11d7888b047d7ec44acba2a1b59aa9a7d5825af4440f55964b95cdf8ccb3d4e690916a6dcc31cace50c8070c5a2f893d4444ce479c32878974d2c80e1763643cda05ce78020df05d6a861abf3c3fa3b29848fc51bf063da5b08e9107467122724839007b02a545b37097b6ae1c631ad4d0bffdf24c49973b47f6b94e6b91eb31730a467ed0b2bfdca746199a8844eb82ca0b9f02a3289afc847201a8e6ac89508a924837480321aa7b319469e66cbe4576eaf5bbcaa21398b83e7d617edb70bba55c196e55574d334f29737c96c17c4fdc29da5c6aaecc8c7e959241d20d34b472666a20c49bc851e50a28324ec0420761f379a8494a9e6581333692ebe77f2cd513d25b7b84ea5a009bc394248a48871affea7e04cb8b4795c2f19b4ba9c2a8e9510ee8098c5dd586b45480da321ee8cc6bf1679224366423655aced547c9208b3bb4449b8157460531bc3c9e79f34d8dd62a46901211018db15b06e81ba4c027c37491395c284499739f566b5d35448436ac67ed8106a558c18995845fd6b9e7a573b1f8794b75334a445950c0ccdb919762eb89fc0905ec16a55a3a2c22417227da258b07702d660fa022c7115c3246e925c1a1265e7585005cfb4b23abe829c1564f672d62dbc3f120d3f8199aeaa4c1311162078722308ef71a2e43f8a2218a0f42842f320d127d27e95b5f4d389d37f0a2970e001d00205e22c659c409f9a60e4dc3a7529d421f6dd9b845c66cf9baeded1f3948f03e68001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":302,"a11cun050_0000004f_0d8a8ff5":177},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":177}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0","python-requests/2.32.5"],"timeline":[{"date":"2026-08-07","count":2},{"date":"2026-08-09","count":14},{"date":"2026-08-11","count":10},{"date":"2026-08-31","count":1},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":1},{"date":"2026-09-04","count":13},{"date":"2026-09-05","count":10},{"date":"2026-09-06","count":10},{"date":"2026-09-10","count":14},{"date":"2026-09-11","count":1},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":3},{"date":"2026-09-14","count":16},{"date":"2026-09-16","count":2},{"date":"2026-09-17","count":2},{"date":"2026-09-18","count":10},{"date":"2026-09-21","count":11},{"date":"2026-09-22","count":3},{"date":"2026-09-24","count":3}],"recent_events":[{"timestamp":"2026-09-24T08:02:23","port":8702,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201:8702\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a383730320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"2b7a2a44-5a19-4dab-bb61-4e2c96a26b7c","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-24T07:47:31","port":853,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:853\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3835330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"701cbecf-aa07-4942-b3df-8c29666eb8b6","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-24T07:31:15","port":8198,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8198\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383139380d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"91e7f3be-07a1-41f5-a7dc-20bf207d6edf","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-22T10:57:13","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0003�B`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0005M�I\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028038d42600000000000000002000186a3054d88490000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"65e4906a-016b-425e-8563-61db450ea3c2","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-22T00:39:31","port":5433,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"539b54cc-679c-4bf4-9c5a-7ade8bbf9291","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":13},{"timestamp":"2026-09-22T00:17:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"185.228.81.201\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"d18b223ce817c861b7829130500395c2","session":"8db90939-e0c2-4c7e-88f9-2e9e11c3747a","seq":1,"duration_ms":100,"bytes_in":145,"bytes_out":78},{"timestamp":"2026-09-21T23:05:58","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"9b0ede19-c9eb-4695-96ca-320d0ee07b8b","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":13,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-21T23:05:28","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"18709c89-bfe3-43d1-9c1a-adb55e35c938","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":13,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-21T21:31:44","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0003�B`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0005M�I\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028038d42600000000000000002000186a3054d88490000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"921f8a44-0f0e-4705-b361-4c77a3a76086","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-09-21T20:02:23","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000E�SMBr\u0000\u0000\u0000\u0000\u0018\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\"\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"00000045ff534d4272000000001801c8000000000000000000000000ffff000000000000002200024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"925f56cb-6009-4670-b98d-43318a0369dc","seq":1,"duration_ms":100,"bytes_in":73,"bytes_out":13,"enriched":{"digest":"12cfb855292c0a4d","strings":["SMBr","NT LM 0.12","SMB 2.002","SMB 2.???"]}}],"http_methods":[{"method":"GET","count":103}],"distinct_ports_total":99,"top_paths":[{"path":"/","count":103,"ports":92}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":2}],"top_alpns":[{"value":"http/1.1","count":7}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"185.228.81.201:8702","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-24T13:42:29.943967+00:00"}