{"ip":"35.195.131.158","total_events":37,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["37 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,969 bytes sent","bytes_sent":1969,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T04:43:09","last_seen":"2026-09-23T09:22:17","events_24h":0,"events_7d":37,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"158.131.195.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":110,"proto":"tcp","label":"POP3","count":27},{"port":143,"proto":"tcp","label":"IMAP","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303a4c535fcdfa712bd33cb2ef127658deba21e22744b0dce281052e33318ae20b820eac266f5b4b073b55fced898a7d693beae128d179433b77ebee10bebacc95d4c0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0a83b0e65b5896a69cc9da4421859bd9efb4b35cb80410711cd7c9cd2799975139153b19125f671260ccbd340880ef68e3709242ab467ce7bcbc77b57fb177b9640a652c1956e9887eeea02c5d9b538604b1db983d5b140e407bca93b86f42477c2b5072ff6b6bf39a7224c776ec20516c74cafabb78df9429f03521290a05f18387265811bd850d4212c5521920833b4ef2182dc29abcd203df94a8fea289bb5a0647fe885baa25efacbbba34ac49f06b5845740466b8eade3877211c4eac7a7c2a525fae56b3eda8740681dd18a8e684713486391dc99504ee446cbc0b835e41af52cb4f28b8dfe6b4d48f4bff13a74986468ae611304d5c89490ae83b0045cc3538d15984ac67a3448a994f76d898b5b9d484725d899d52ca831e82d044a981926a29eacc7539748567788f5938c79b9cd1f529e492760dc3a7f405147c027c737c03976b20fdb2280003b2d00891fce867ffbca33f17ac5ab2976a02bbf85cccb42105d34c1c73ef5bcc8663de2e7c42bcbcd37b058776a383205060a434d64898be299a028333db891687c94a844bacc005632d272602421b715d5be73b838a7a46a1a1995464a847ed8885431aef6c202e696b316936fc83791c7062f03640c8a6b888e393d9cc280b76b565ea7133e411fdfc97de26018fb7a2eefc5941139a2897730c2252b5bb1015c1cb81b5a96992c863fe9cfa5abcb23e50882293382e60898a5cbe59186b72c3f9a8799c3e430a8698337707ef4531af4a485e6a5b47eb89f3db5c91a4aa0780547c51b84fb7c19fe24b059e65ff3550a14b2391c211c3f262be87b7f70392e0e431f360a2f866a7180fa0d5dcc2c0569281f3316dd88375069504cf2c582284d30f8026422878a01cc7aaca12b836aa89497629a56af0073d0957b2d0021f1e991bebc3ab6dccd4d232f69e7a55056c92c84766a7880c05620e2256117f4bc8326ac78a05f7359a3c6a1706998c7d48c85dcd32003422f27f3c3c16ac6c12744d9d8b0f0c1899f926136759c10549ce4972795879b51cab0ca699ada573ae2d710c5943d7803cb71884ed75386e97598ae1c2bcb3a3924026a06047a8b79253f893f7f99c4b35a842779ab0f820f22f93d8bd89dad58789c0317c2286c60f0b537a3a68ff06282990120645e5e3b145607cbc1b8370c37c1b51a5f27f57d826baefaa07723312b9683a527d30d302a849f555c13aabbc4755b4b7a5a6a9b5459f6a5513790792a8146706c32b96b1bc32f2442a55c2c34f876731ff32a0148bd6707061f414d0a1ab39e8a45af099077c207ac66775a992e7dd55fcba8731cf3097b51ce9152264f23b9d2e023e7d42c73fa26626c75d36021edc2c810a59750b131e7354819193bd28974618a92846076f3c362974c674b9687a3530dc006388865720da179430161ba838ad7548da39c842970337303912491b8c47a90a9cb0dc7da9a980c1a9bc7cee741a9cdd34da487a8bfd44259ac29a1c31e2b3823d76a58aff0b5a5110137fa7442a810e7f41319a212d3f73616012f66d8bc8a3c6a9e3973b6567da252348ba8910924992b28997fc113de4b03f62060258733fc26490d635cb656109925bfcba161603350fe73027492576ee4d1198691638062c225254eb6a84dfae56ab9f05ca6abd9fa73fd8d7c405b634c1b82ccbf4bd73d441209473c568ee5418da2d60eb84a627ee71f4a001d00207c405b634c1b82ccbf4bd73d441209473c568ee5418da2d60eb84a62","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1961,"a11cun030_0000004c_13ee3d34":2230},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2232}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":37}],"recent_events":[{"timestamp":"2026-09-23T09:22:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006915fbZ","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000639313566625a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"63690247-6637-45d6-9d89-36e996db32c3","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"3ce6150af9023816","strings":["adminclient-5","915fbZ"]}},{"timestamp":"2026-09-23T09:22:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1d9277a7-4c61-47be-9983-bc67bd5d49d7","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-23T09:22:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"695d8d59-45f5-4fbd-8079-adbe1015dd9b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T09:22:17","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"dcc27dcc-35d6-4cb8-8c93-04ca3258ed19","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T09:22:16","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\u0007\u0010S�`2\u0002\u0001\u0003\u0004\u0017cn=fhllibbufkvqyovbqppw�\u0014fhllibbufkvqyovbqppw","payload_hex":"303a0204071053f160320201030417636e3d66686c6c69626275666b7671796f766271707077801466686c6c69626275666b7671796f766271707077","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"faf35495-ab26-4a3a-9475-143e2530bf7e","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"6191783321161b78","strings":["cn=fhllibbufkvqyovbqppw","fhllibbufkvqyovbqppw"]}},{"timestamp":"2026-09-23T09:22:16","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d4d10c48-2a32-41a3-9a6b-b0b04dfc0659","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-23T09:22:15","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d879c4c1-1568-4bcd-9857-0360497b0789","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-23T09:22:15","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"183eef95-9dbd-4358-b57b-4a07f310a78e","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-23T09:22:14","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"15548232-489d-45ba-bede-751749e3389b","seq":1,"duration_ms":94,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-09-23T07:02:34","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"90e477f1-e582-483e-9117-ef86e3fba075","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":2},{"value":"185.228.81.201","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T13:01:30.700501+00:00"}