{"ip":"34.52.227.166","data_as_of":"2026-10-25T12:02:27+00:00","observed":true,"total_events":39,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["39 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,011 bytes sent","bytes_sent":2011,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T02:18:36","last_seen":"2026-10-09T05:53:11","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"166.227.52.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":30},{"port":110,"proto":"tcp","label":"POP3","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303183406620087ce2f1ece19c5ca0b8b4ea5de0395b49b89c738520d316363639f208e8b958627ad3ee7b55b77757a7272f5b452892b0bf971ce4e796ee97db553d50032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0b10c5d383263ab0b20af23a83bda1030aa35c7918c4fc4999c6cc8aed7517e512caf351814d84235fb90bd8ba1890316ddd300ee4a18142b7d84d6165d666d2a658850d74b9326703609d0be0cac8c015c92dac80dac227661961c5595b0955c0794c84932ccc8ec476f3102802516612019fc6abe74b83233642212011b1f5acc00cb6e743c9938f066bcfac90ca648e57b1ab2a1a0996a4e15c244f9a800bbf3a7e56b8bc89385be891da5d9be7c6853c3984843f256dd36a4ac64509a514485134f875c044a0c3cfc6a5fdbb104abd1893e086b404703b09763e7c6963529b562c4b91078aa723bc0f5870167a63abec18197e25bc4647882f23587d14dfcdaa1e9a079e589745eb81bb1ecc6b57a13697b2c7164bff4233911035bb541610a868a231807dfca136d4b57ac88338030c5ef63288528a0e2d1b9b8b91d0a8c12fd72a7490a5b0fdaae2087666bb8a4a4a6bbaff89da4c78d52836653d28a22c1abae90a9d4eb9e0cc67b4c06bf0197cb15d449d2745c374962a058c6be38bdf557cc11a6a5f7c0a666f26a3a72836f753f2d1a6f04a06656896ba3da2141415377c573704c95d4bb7f62c43c2a999855e052e2a51ec6a27e78649607393c618a915b902a09fc4e700577f7b8a15e77a16ae84bc71655b46bceee0813f7d23427b21fd2263f339b04401a97cfe809a5a46be6827db4db31ba954303945151e49591219219e3379ce22c7fd7874e946eb5fab497426b79d74c3309c084f587f19636d1f822b250118e72897f048d66d17d7b869326a92b1b172991057d9a203fc62629eef20e4042b60afc83c1d41dd3064c581457ba6185daf77485322e0ee7820716c1b1879a8a6327dc4ac3d81b4344985a3629bf578ac0fa631e9eb65661b463a40249f03662128b69b9e47230d437e03705d522a3933a6bac768e81e0160806281c9963369a687251a0ceeb3c43a721cb09c36494cf62046b0caac7f2c7632545b857c01e6e9588824781008a02dfbba37faa9da2b9b9377364c8511e3df821c8cac956a068234a22d8092c67c1495f8c7e48283500f8091ec81032dc2d80ea130a6b3c757800d15439f6954b844b81ce1279a4e46f3f1c8bf260be598184bd5901f0a3a53677360b2c78b60c4e92362d35f569474c11f75945b05486910315f35434f1d134039596dda7cbf4700db72926ba271716996b8a137dc71629119b376f308d662b56fe438d5332184ca07650c6041463cd8bdcae61954249f6af4ecc4dba13107eeb8456c75693725460bb781f535a8f959ab6884f4f17385efa959398a79da38d8076656cc1ba3e4c403c9a9240c64c6c1c48a84399b4916727f72d90775cb57286eb70257655b55310a71c8a317a63b0a084291996bafc2a6277cb48d6a9cb76b1a3ffc7544685a03696b837745b2bc8a7dcc684ffb79e13d34d9ce60ba6f49a61214a0dc03e3e4b57e95b6a9202550da66bf87aca5c4412f02231ef430af5017a185723c8d049ed173de9ca3ab5f8935fc7c5fc9847615c9c3cd5af934bb66d663e5df6a48830c298d644e478510be229ab532e5b9b9f361b47869a6c9e52c5c298465e0cac9aba2b8f014ac95c516b2608a0d952d760908e0c333e040a666228e15e9eecba222f59f8ee7680e90a2a8749e7aec782beda40097784be105948badf5c8572ddaf6fe66d2477eff51985287428959d6f284e001d002040097784be105948badf5c8572ddaf6fe66d2477eff5198528742895","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":39}],"recent_events":[{"timestamp":"2026-10-09T05:53:11","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u00067z0sBS","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006377a30734253","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"960cc16f-6a58-4d3a-acdb-55cbc127dd75","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"7d1d719e65c7deab","strings":["adminclient-5","7z0sBS"]}},{"timestamp":"2026-10-09T05:53:11","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c1a80d22-11b3-4122-a660-d05b5d88cc00","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-09T05:53:11","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9cfec936-0a62-44d3-8319-088458af99bf","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T05:53:11","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"04a76a3a-a20a-4862-90a4-a6ebbc998879","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T05:53:10","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"70019ca6-5b42-45a8-90b0-f4b344930817","seq":1,"duration_ms":195,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-10-09T05:53:10","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f2feb533-4c3f-4a43-a227-25c7797afad0","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-09T05:53:09","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f7099a4f-3e72-48dc-9851-99b5a46fc203","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-09T05:53:09","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"dd564098-e5b6-41cc-bd37-ad0c07bd54af","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-09T05:53:09","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004%���`2\u0002\u0001\u0003\u0004\u0017cn=djhqjmwviwrejokoajpe�\u0014djhqjmwviwrejokoajpe","payload_hex":"303a0204259a93a760320201030417636e3d646a68716a6d7776697772656a6f6b6f616a70658014646a68716a6d7776697772656a6f6b6f616a7065","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a53a6bd5-0105-4b47-b33a-4053f27e1b68","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"aafe9c80fb72aec5","strings":["cn=djhqjmwviwrejokoajpe","djhqjmwviwrejokoajpe"]}},{"timestamp":"2026-10-09T05:53:08","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"6f8fd693-4aed-43d8-9359-16759e359eb7","seq":1,"duration_ms":94,"bytes_in":191,"bytes_out":20}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}