{"ip":"34.62.59.98","data_as_of":"2026-10-24T03:00:49+00:00","observed":true,"total_events":72,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"87+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 87 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 32 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) tried logins, none got in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,011 bytes sent","bytes_sent":14011,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-10T16:52:43","last_seen":"2026-10-23T21:22:23","events_24h":2,"events_7d":61,"interactive_sessions":32,"interactive_sessions_24h":2,"interactive_sessions_7d":32,"interactive_protocols":[{"protocol":"http","sessions":26},{"protocol":"postgres","sessions":2},{"protocol":"smb","sessions":1}],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"98.59.62.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":32,"first_seen":"2026-10-19T14:54:44","last_seen":"2026-10-23T21:03:49","verdicts":[{"verdict":"scan","sessions":27},{"verdict":"unknown","sessions":4},{"verdict":"credential","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":5},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":2},{"persona":"postgres@16.2","sessions":1},{"persona":"smb@Windows Server 2019","sessions":1},{"persona":"postgres@12.18","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":9400,"sessions":2},{"protocol":"http","port":8700,"sessions":2},{"protocol":"http","port":10071,"sessions":2},{"protocol":"http","port":9200,"sessions":2},{"protocol":"http","port":21268,"sessions":1},{"protocol":"http","port":8482,"sessions":1},{"protocol":"postgres","port":5433,"sessions":1},{"protocol":"http","port":18034,"sessions":1},{"protocol":"http","port":7080,"sessions":1},{"protocol":"postgres","port":5432,"sessions":1},{"protocol":"http","port":12424,"sessions":1},{"protocol":"http","port":8053,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":27},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":4,"sessions":1},{"port":873,"proto":"tcp","label":"Rsync","count":3,"sessions":1},{"port":9236,"proto":"tcp","label":"","count":2,"sessions":0},{"port":139,"proto":"tcp","label":"SMB","count":2,"sessions":0},{"port":8700,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":10071,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":9400,"proto":"tcp","label":"HTTP","count":0,"sessions":2},{"port":9200,"proto":"tcp","label":"Elastic","count":0,"sessions":2},{"port":8065,"proto":"tcp","label":"","count":1,"sessions":0},{"port":12185,"proto":"tcp","label":"","count":1,"sessions":0},{"port":11920,"proto":"tcp","label":"","count":1,"sessions":0},{"port":10150,"proto":"tcp","label":"","count":1,"sessions":0},{"port":21254,"proto":"tcp","label":"","count":1,"sessions":0},{"port":10324,"proto":"tcp","label":"","count":1,"sessions":0},{"port":5901,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun050_00040017_976354f0":1246},"akin_families":{},"user_agents":["python-requests/2.34.2"],"timeline":[{"date":"2026-10-10","count":5,"sessions":0},{"date":"2026-10-12","count":6,"sessions":0},{"date":"2026-10-18","count":2,"sessions":0},{"date":"2026-10-19","count":9,"sessions":4},{"date":"2026-10-20","count":18,"sessions":8},{"date":"2026-10-21","count":3,"sessions":1},{"date":"2026-10-22","count":27,"sessions":17},{"date":"2026-10-23","count":2,"sessions":2}],"recent_events":[{"timestamp":"2026-10-23T21:22:23","port":873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"a7f2dd51-01d2-4cd4-a018-eb0823cffbab","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":11,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-10-23T19:40:01","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"cfe4a162-d969-4c26-8a57-84ba9e4d4099","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":76},{"timestamp":"2026-10-23T19:33:59","port":5432,"proto":"tcp","app_proto":"postgres","app_protocol":"postgres","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000?\u0000\u0003\u0000\u0000user\u0000postgres\u0000database\u0000postgres\u0000client_encoding\u0000utf-8\u0000\u0000","payload_hex":"0000003f000300007573657200706f73746772657300646174616261736500706f73746772657300636c69656e745f656e636f64696e67007574662d380000","method":"","user_agent":"","ja3":"","session":"ea0dc9ef-6e5f-4d91-8d46-08a9d2c11e46-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3049a06db9d24bd9","strings":["user","postgres","database","client_encoding","utf-8","userpostgresdatabasepostgresclient_encodingutf-8"]},"interactive":true},{"timestamp":"2026-10-23T19:33:59","port":5432,"proto":"tcp","app_proto":"postgres","app_protocol":"postgres","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"ea0dc9ef-6e5f-4d91-8d46-08a9d2c11e46-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T14:45:25","port":47990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:47990\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34373939300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"4fc734c2-10c0-4daf-9f35-ae9ec1f2c4ee","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":76},{"timestamp":"2026-10-22T14:34:41","port":9090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"0d404107-35a6-4721-b2e3-bba929a71877","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":76},{"timestamp":"2026-10-22T14:31:41","port":8053,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8053\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383035330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"2490d460-b6af-4dd6-af1d-362dfe0f2d12-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T14:30:19","port":8700,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8700\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383730300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"ae247649-0118-4875-86ac-e053105466f7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T14:30:12","port":8700,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8700\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383730300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"d51dac2c-4726-4ce1-9527-d6e0f529e81d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T14:25:26","port":843,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:843\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3834330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"707b745b-65cf-4508-be83-d5a05b64f68f","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":76}],"http_methods":[{"method":"GET","count":81}],"distinct_ports_total":87,"top_paths":[{"path":"/","count":81,"ports":57}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}