{"ip":"34.79.159.85","data_as_of":"2026-10-25T02:38:37+00:00","observed":true,"total_events":28,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["28 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,464 bytes sent","bytes_sent":1464,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-07T06:38:27","last_seen":"2026-10-14T05:42:54","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"85.159.79.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":110,"proto":"tcp","label":"POP3","count":18},{"port":23,"proto":"tcp","label":"Telnet","count":9},{"port":25,"proto":"tcp","label":"SMTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003034d138fa209dcce76df97afdcbaec8bcea063794dcbfd6fb103b20abebe379f5e206e1f564ea7dbd480686ab652d476723ea240d785213103a3e053d36410b53e130032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0e4204b93f1405d039b27322274db5748042ded20219cf234777c27e11b99e6487b6895809d182c82f533eb57b21c6bc6677827a6f8688e25aea40430e45b5001c390cbdb7f7c787e299172010007eec4ced16652cec8c98e5785d1d20f719bb8662522ba752f16c3432b548afb67725d799c0d9031d39b5d601c5cfbb929b66c4f9b0a043230bbefb3b2c52c56d1c5b65bd12299395f0d35379ecaa1c6fb6131dc3de83c3c5f90076863c4dc0c2b068ca2eec2a24bcb3e4e4a85b482615d409b4ad871a5716d7c81890eb7bdd7a78774b6af0635a16bb253dc8097f13995fde25cf484979e599030e0acc45455e87b524d499bf3ea2ff9771fcfb31448c91322903448d578b480539899868f76a6aa605efeb41dadfc597b4b784120c94c960f16a849741c59ff360dd2f331792a7e3221b5e2d80388899c9905bd5044231af8cb89418b379c3960d5933548c55d87b2a7c30405c295747a5edad2299a4930b825117ffc8066b78b32a712be05a0ae419dac341df2a114cac96bdb874ef5a96164cc0fad334435ac26cb4a85ec162db364c934689df9e5aa91396bbf79bd39eb8bf91748400ab5c8550883c50087279234a414d534239cec619b6c5ff8867b9eb3cc58ea0c29ca56d9c053e90660c299ce95b5a07ed6c6a648a57b4722588cb96a153479fa82ac629a52135caaa6b9b549600f864df0269898c99f9e055b4cb8cc22185e1f071583d50b86fa1aa4a763469092a5da6e3cf41920cc623c434184f9a4cee259b2bba6ec36a86c92a8e23c3b0b80b0a52324322a8d7e2b2949ac36b6152758104ee797aa8a2aa0b7c50812820ddd144905ab7a7040877cf623001a7768097c14435435e360bb26ad3a7349bf713e3102bf90419cf62b9b4b39077be43ee69b0f0a048f296496a2023df688c04bfc16426c66aba42e3d96897fe74b7cc739333a82b9f23eb4a5497e539a9ff50510d3b14fc710a3142a2c8960d107847023350b9aa4e8b4b160c23a37b7747e0543b996711a745936e079ef39b361229017db74d1e252510a7660e399daf417a85baaaa843d81b0bc04ba07fcc508a1cb3d89f77f03e8b327570daed386a1c276afe47feb570d35d3cf1c8cc6f8d5a8cc39a2d35a813e9b9667acb92eec721ee39cdd5330dbc2041c54bb647582cab5443577298363b833ea0f122caeea38737babcb89e13a44e14317a1be35229370584121ab1a65634d808c27b9519bd4b8b82b617e9ccc22d1c57bea121ff117182f737dbbc33e71ac88c4b71534b3472da3728eda49e5d68a6be6cf6af9b19f70c6910a413338a11835b74243267bfa92e36284acb89a3bac33720bc3ad0855abd917d0568be8eb891b665cc99b2b7000bf1c25a35a28657ad99fc3dc7d3ba04c28d1334d507e38d30b29151af0c36bfc8561ec177c8199842ff76fb96badb8a90c1c7aa2d8885d1e17b7af4a139182bbcbec7fb7a65173b2147b8517db7b30caa65b78791d71dc287467baad015fe75b54753776aab3348c489be3346ca469884de5b7c3faa5322396bf997248519383fa034258962dd1408c271751e138d44207c6805b910bc0a21c6b4e664c1d56ba6b300116570dd92cb8fdec570aaaa79a1fea91220e11d099fe26bf84c2e3fac1efd021c46ec4923846d3dd6b0944f775971307c50419c69b278bdbb1f265400f76817ae02cd7cddc2f774ccf5d795e001d002075971307c50419c69b278bdbb1f265400f76817ae02cd7cddc2f774c","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2679,"b11cun030_00040012_13ee3d34":5328},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-07","count":10},{"date":"2026-10-14","count":18}],"recent_events":[{"timestamp":"2026-10-14T05:42:54","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"bbb34aeb-a2e4-4f98-9672-f83323ee6380","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-14T05:42:54","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"5c206e21-df95-44f5-8f76-a64af491c9d7","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-14T05:42:53","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6aae2f78-723b-44ee-a64f-2959fa9363de","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-14T05:42:53","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006byeocT","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100066279656f6354","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f578974f-9b75-43fa-bb56-6b3a112bb269","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"37f41c8382c8e5a2","strings":["adminclient-5","byeocT"]}},{"timestamp":"2026-10-14T05:42:53","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"489bb64d-53ae-4da0-909b-4d363a924e0e","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-14T05:42:52","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"66e9f030-e831-458f-bd4b-bc27b176fd97","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-14T05:42:52","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"32b8e216-d0cf-4591-9dd3-f00e775441fc","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-14T05:42:52","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004I\u0015\u000b�`2\u0002\u0001\u0003\u0004\u0017cn=rvvhdoqlgpewjapbcopa�\u0014rvvhdoqlgpewjapbcopa","payload_hex":"303a020449150be260320201030417636e3d72767668646f716c677065776a617062636f7061801472767668646f716c677065776a617062636f7061","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"86537959-48e4-4b35-a950-97b2ccc51418","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"4fd883cf1433b2af","strings":["cn=rvvhdoqlgpewjapbcopa","rvvhdoqlgpewjapbcopa"]}},{"timestamp":"2026-10-14T05:42:51","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"35fc241a-1168-4a63-b010-7b5de53f1a01","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-10-14T02:54:36","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"335a0051-ea42-4637-9be0-ba40c3ba3ed9","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":3,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}