{"ip":"34.52.167.166","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,010 bytes sent","bytes_sent":1010,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T03:31:38","last_seen":"2026-09-29T03:59:58","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"166.167.52.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003030cacf1c0dd34a7a07586ab165519ba841c58d0f4dd15e3c62143d4934e32677c207d648ab99eceaa16e7a64dc9fd7d566c12ba385a73cfbe5fccbaf78acb29e0300032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0cc90715ec2c067d1abc4d10e6fd24f7174185ae0a41957366a60c188401088d446084983888b639ebc3f9e66acdfa66b04a92c796b0c2fb9a154bb5e270479bb844912e188ad34be2509457de969ead7823c01022742782c867680207acfc42de1504498731198d3210da324a202c007922e12a3383f4ca71378b35ad717ae812a73818d5c274d951458ff7a0d555b4567d4525eb261d96bbf55c008ddd11a07853d92154f0b640d53dc599b2c80ed50c8b0d9b157c164fee177c239711c26a6bcd22fe873ae2be6b96d7b3c3a307ef0883801b741866ca656aa8ed9c30ae610663192b6a15b10e35587aa18657e6394f372ae2a057bf13c90c3c925c8c06920c36cb679c78049c33ffc8c7315b82576cda69abfb6cc8b6b296ee9b542154447b2f457f3d1b340dc919c11692faacbffd6752ae818a5cc1c002590cc53a27b33184342430edb8a871257c5a8595e072acd109d31553054e48ac75a2ed653c6238652e7f38fe7b9aa1c030f81045ab30b1f902bb6cfc3812e5b739d77895923bfa38bcb26e8a10d4a48858cab180ccd0fa17b03bc4dcc7c590cd672f4539a4d348d0268479565368231c65c2069a338a4351b015f670709dcb984f5aa30889d5ba6a997dc8e3d09abe8e0b65e27820470cb91d36d4e8885135c59ddc8107d604ea0980206d0465128037b17b58197cbefc2b8a306b1c9a84b799540671c51a17b2276db85211bbc86908d2bb706ef49ac1895b8c4a165e9ea48673a87aad590ca2942aee42ea00c40e1d5c1bb043b61284dce484bdeb9bd8bc1c77fb50265c098ecab0a29071b13106848b697e8d155ac473ac4b0898a7892b8243161cbcb533475fe2a413825aba350c79723bc0e301e43aaae856c210d874f082783c6317be4143de5981031732fea7ba4ab3bbb4a1cb5c80c549aa7ab44c664beac9ac4612787046bcf27aabc9b2cf90c0ecdcc5308306b7ce2123f0b94e3f9beec1bb686a5209a509fb53a8311971d84401e0fb0c50f09bc1470b8cf641a0eaa5792019f1aab5b23a8857530c4468c12f71cb0f771aa3c1bc22bf00882c9a609f5b0d4d3bb192531179cc5950b1d97482e2296628bd9ae89e939d6a362eab696963806b2b2154aab9c6cd2cba2831131a74d5dc072b5ea3ed116acbae4753646a8a8a5ab41c57d9fe741c5e926d0764e5d9374386a7b98fc9fda0b2cff05692f0063c37b323a7b637bd2c820767fb40a694b169bfa068b08f45b6df38cc117535df273385646d41b60aa93bee2430aa8166537311dc033564bb22036c30f17c0046023ad92d464c7828b0ad9a7be582e1b2a9698e3927d70b8c244ba76923c2ee098dc7aa7e91926772a218c42233a678018eb896ca176b39019478964ffb3a39f451aba528117294c8ed9a1416b4384c9c01b89a616075395191686b0b3c3e333577c9a0adb261155202a883df7c15460e13a02428982a24e12a84cfe8ca3fac00303e22ca537c6312144e350176ef81e2dbabd677ac3f6096ea8d9ad4e429c94422e8188cde300a70348b22c156647b047c6085a4dd83099aa1acb363507a502f0b863c22724e3d2825aa4980eb49e728911675234bd7373d92b717d83c2da773fff17cf9974cae097f859cbbd99430061fb4ef627312c7fc9e6211bcff10fdb29f93a620c14f557f64b7ccb6d677edb6e22ba91b7033f07b9882a137447fc8e5e3bd116001d00200c14f557f64b7ccb6d677edb6e22ba91b7033f07b9882a137447fc8e","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2002,"b11cun030_00040012_13ee3d34":5052},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":20}],"recent_events":[{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"d310d576-20c6-49b9-ae51-6e48c5b0742a","seq":1,"duration_ms":10,"bytes_in":191,"bytes_out":34},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f5b1cd09-aae3-49ba-a97e-767ec13a4f61","seq":1,"duration_ms":111,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e2f786bf-9446-40e1-abb1-b18f4a1ee485","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2a65b49f-ef12-4cd8-b130-1dabe4b071be","seq":1,"duration_ms":111,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\u0015S�o`2\u0002\u0001\u0003\u0004\u0017cn=imuleirpyroiwmjmezjr�\u0014imuleirpyroiwmjmezjr","payload_hex":"303a02041553b46f60320201030417636e3d696d756c6569727079726f69776d6a6d657a6a728014696d756c6569727079726f69776d6a6d657a6a72","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ed62ac4e-bb1a-47e9-98f0-015e6a46e8e5","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"9ac389b707112d7a","strings":["cn=imuleirpyroiwmjmezjr","imuleirpyroiwmjmezjr"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a730dd08-0b21-450f-878f-37ce2b910f26","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006cwkGBc","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000663776b474263","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"148e1789-e8d0-4401-90d5-242bb83c1283","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"71e102feaeed7286","strings":["adminclient-5","cwkGBc"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2dec8f2d-1eb1-4416-b3f5-26630d517e2d","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1b726e6a-be40-489a-873f-e4f11ac1d270","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T03:59:58","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d8c84d9e-1f26-4755-9959-33ee6150aaeb","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:990","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-02T21:47:26.113752+00:00"}