{"ip":"34.95.254.54","total_events":208,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"194+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 194 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"49,092 bytes sent","bytes_sent":49092,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T00:49:35","last_seen":"2026-09-27T00:57:10","events_24h":0,"events_7d":208,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"São Paulo","lat":-23.5475,"lon":-46.6361,"asn":396982,"org":"Google LLC"},"source_domain":"54.254.95.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":8},{"port":6380,"proto":"tcp","label":"","count":8},{"port":1080,"proto":"tcp","label":"SOCKS","count":1},{"port":8140,"proto":"tcp","label":"","count":1},{"port":9443,"proto":"tcp","label":"","count":1},{"port":9500,"proto":"tcp","label":"","count":1},{"port":8230,"proto":"tcp","label":"","count":1},{"port":2375,"proto":"tcp","label":"Docker","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":8484,"proto":"tcp","label":"","count":1},{"port":8070,"proto":"tcp","label":"","count":1},{"port":6080,"proto":"tcp","label":"","count":1},{"port":49152,"proto":"tcp","label":"","count":1},{"port":9001,"proto":"tcp","label":"Tor","count":1},{"port":8554,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ea010000e60303bf1dc18e324611b75c46f683d04ef1b11f11d4eb4dd213aab9a0a4d4531b29ce2025cff62eeb2af2c63d5b71290c98258e5542f03ee12307cb817b6117f59052fc0026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a13011302130301000077000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b00050403040303003300260024001d0020656b7f015832b2d35c78425ac691b33ae01fb17922e52a26d8ea4e83222c9679","tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"http_akin":["a11cun050_0080004e_3ef9a8f6"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3150,"a11cun050_0080004e_3ef9a8f6":79},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.27 (KHTML, like Gecko) Chrome/12.0.712.0 Safari/534.27","Mozilla/5.0 (X11; CrOS x86_64 12105.100.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.144 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/604.1 (KHTML, like Gecko) Version/11.0 Safari/604.1 Ubuntu/17.04 (3.24.1-0ubuntu1) Epiphany/3.24.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3880.4 Safari/537.36","POLARIS/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS/6.01/WAP;)MMP/2.0 profile/MIDP-201 Configuration /CLDC-1.1","Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-N950F Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36","Peach/1.01 (Ubuntu 8.04 LTS; U; en)","Gregarius/0.5.2 ( http://devlog.gregarius.net/docs/ua)"],"timeline":[{"date":"2026-09-27","count":208}],"recent_events":[{"timestamp":"2026-09-27T00:57:10","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284f532f323b20553b204f532f323b20656e2d555329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29205175705a696c6c612f312e332e31205361666172692f3533332e330d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3","ja3":"","session":"1130e5f6-ad99-4be2-8339-9da24960a7de","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":5},{"timestamp":"2026-09-27T00:57:10","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (Windows; U; ; en-NZ) AppleWebKit/527  (KHTML, like Gecko, Safari/419.3) Arora/0.8.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b203b20656e2d4e5a29204170706c655765624b69742f3532372020284b48544d4c2c206c696b65204765636b6f2c205361666172692f3431392e33292041726f72612f302e382e300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; ; en-NZ) AppleWebKit/527  (KHTML, like Gecko, Safari/419.3) Arora/0.8.0","ja3":"","session":"c8bdd0a1-ede6-4f54-8630-57a1a3c3f7e4","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":5},{"timestamp":"2026-09-27T00:57:09","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284f532f323b20553b204f532f323b20656e2d555329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29205175705a696c6c612f312e332e31205361666172692f3533332e330d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3","ja3":"","session":"32122243-86dd-4e58-9300-66e9153baa3d","seq":1,"duration_ms":100,"bytes_in":223,"bytes_out":5},{"timestamp":"2026-09-27T00:57:09","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (Windows; U; ; en-NZ) AppleWebKit/527  (KHTML, like Gecko, Safari/419.3) Arora/0.8.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f77733b20553b203b20656e2d4e5a29204170706c655765624b69742f3532372020284b48544d4c2c206c696b65204765636b6f2c205361666172692f3431392e33292041726f72612f302e382e300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows; U; ; en-NZ) AppleWebKit/527  (KHTML, like Gecko, Safari/419.3) Arora/0.8.0","ja3":"","session":"777fd6dd-080a-4c20-8985-dbdd06879df7","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":5},{"timestamp":"2026-09-27T00:57:08","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.7.2000\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36312e302e333136332e3739205361666172692f3533372e3336204d617874686f6e2f352e322e372e323030300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.7.2000","ja3":"19e29534fd49dd27d09234e639c4057e","session":"b068021d-f4fa-4721-ac78-dfa238ef9a77","seq":1,"duration_ms":100,"bytes_in":251,"bytes_out":5},{"timestamp":"2026-09-27T00:57:08","port":6380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Vodafone/1.0/V802SE/SEJ001 Browser/SEMC-Browser/4.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a20566f6461666f6e652f312e302f5638303253452f53454a3030312042726f777365722f53454d432d42726f777365722f342e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Vodafone/1.0/V802SE/SEJ001 Browser/SEMC-Browser/4.1","ja3":"19e29534fd49dd27d09234e639c4057e","session":"d1c80610-a430-4e72-a531-6c861cb53e4f","seq":1,"duration_ms":100,"bytes_in":174,"bytes_out":5},{"timestamp":"2026-09-27T00:57:07","port":6380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Vodafone/1.0/V802SE/SEJ001 Browser/SEMC-Browser/4.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a20566f6461666f6e652f312e302f5638303253452f53454a3030312042726f777365722f53454d432d42726f777365722f342e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Vodafone/1.0/V802SE/SEJ001 Browser/SEMC-Browser/4.1","ja3":"19e29534fd49dd27d09234e639c4057e","session":"2403ee03-b2aa-42f5-a394-10ce6281beef","seq":1,"duration_ms":100,"bytes_in":174,"bytes_out":5},{"timestamp":"2026-09-27T00:57:06","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.7.2000\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36312e302e333136332e3739205361666172692f3533372e3336204d617874686f6e2f352e322e372e323030300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Maxthon/5.2.7.2000","ja3":"19e29534fd49dd27d09234e639c4057e","session":"210cf07c-a481-469e-87ec-5056320a6b7b","seq":1,"duration_ms":101,"bytes_in":251,"bytes_out":5},{"timestamp":"2026-09-27T00:49:42","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204c696e6b732028322e3170726531353b204672656542534420352e332d52454c4541534520693338363b20313936783834290d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)","ja3":"","session":"b37b0b71-c761-4d13-a277-88b89ecb84d4","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":5},{"timestamp":"2026-09-27T00:49:42","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31345f3329204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37342e302e333732392e313537205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36","ja3":"","session":"59a35a6c-dd81-45a2-9025-3ee040d4e45e","seq":1,"duration_ms":101,"bytes_in":244,"bytes_out":5}],"http_methods":[{"method":"GET","count":208}],"distinct_ports_total":194,"top_paths":[{"path":"/","count":208,"ports":194}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:6379","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T03:03:09.005351+00:00"}