{"ip":"35.205.158.133","total_events":29,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["29 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,502 bytes sent","bytes_sent":1502,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T02:32:30","last_seen":"2026-09-29T12:02:01","events_24h":9,"events_7d":29,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"133.158.205.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20},{"port":110,"proto":"tcp","label":"POP3","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303c3e762324312f04cae25d8cf5e9bb29b7ad9e1189e93c857cb6713808f684d51209e2ae096e209b12c992fec38489855f2f06b788ffd4448d50427503c015399390032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0b852147a5c715783a7b42661f08791d92284a40060b005c8e7056d8c7406e8cc363574cf4e1763a6b7132ee324eeba33bc940c24b6c54504c70302bdfeeb26a8531549495489735624b31dc5272b36a558d97571162383e5155ae3912fe0c6a5c861a7d6777e88d2abd0546d90f114c0b82f89d9b5cbbca58aec73225250ce4c42997a7d3958394dac22ab0898ce442ddbb9b445f02067a07e783aae73aa1f2fe14d03d5ae47811de56c5b65fc6c7d86336f04b2d59a60b59112d7a325e2f21176a6bcc8259e374c442bc0c015b1ccfe3b368c4008e7db833bf94a75f14f46822d1b96b3c93b322da849f95a2a55f934dc236db00a2e9ce86f2ae4709e0a0804ebcfd4fb13f846b630036a0da762c552b40293a5ed9142e14451109363d597930c97bfbacc02415b45c4c68af1dab7b5b26b9485318159829774b4b32b536822556ee13f3f2317fff90001481c5f88c29b028f1b4bb570a23af5d70d4b4cc171b971c736baad72999c6092610150c3130f6f8b6d4b9799e4144dd1245261a05c9ca49872542ac351ac94d2139ec95aed65c8c877be77e3a8de583480078ae021b90d4875e43cb10d8a4808bbc216faa550953f6a44cdef52440c0966cf242a04db34f478927c18b5cfc60fca36803f419018c4145f8292893502fbb37356854a13d71370eabbf226055dd427942c98c8c99e6477ae52c68ff6078ccb1820d3a636af77bc7101a9816a9410d419c440c4d3cc1014742c2bfbc8049c704b906db43258a1f7a2fa12c1b017c8af1a5a0c720364b8574d554cd96032e0a4c2c05a4f865c34f163671724b63680b253f706ed4aa5bb851c53650baf44868b067942b969008924d2047ae88216e6ca2dafa5b49f8cbb04981ec85618642bcb7dd48287414efb2b76b2970d0ec93e59ca9e5efb09e6c8b6315732cb12790669918b553d3da33206c3071193ce9bb5cf30497b50a961c3895c50444ff1586fd5f71d0a034720530f36a7ce64e77b003704fbf4357de87e818b8caec1bf704788a8a0344d684f84e61b8eab5e4c4655c3007d4f2790d4fa96a0600f8599c7fb6761df44ccd1b651b05c8924aa9d75973c2aa061ab9320f31c8ab3138cf03a7394d384a32319a2095a70e31db9b5361412578bb25206caae427b48f3062e5dd17ee6d1a47cd50a4480218e80477b8ca7fedaa02a7cc56348bb30d767acf38182297e6bc210f6b1ae18b84650f649370153f7c9bdddfb06903ca5f1359a3dd49eaecac50a27bb09e321514013b912646f26b238e3194543313b304386a89985f262fcd1445f029ff07a804ac08e8bcb51b00b95cc384c262180f51b4dc5d90984a77f82120d9e7ab2caab959bbb1a1cd4c4192c526642160ec2b5322667d158355f21115e058d23a455f7c7a618cc4022bc94235c3de50910bce36f8fe33eb14a4c7e3c60912c1359e44131310cbe75228dd48bbf1051fab2cadc865efc91769d045de9580353eb6cc60b64aec7c84b733cf6322cd69161de5cae159108297bbffc32bf83a20fb199cc8b1a776a87557dc07a04e1acce207ab537b2ebe25c466c9d2a88832d261d95c625bed2c2a95a807d1015fa1462ab280231990ade75a02db30c7769c8218076a09e0fdfc31c63d26f70067ada12e3b5fd9e52d3f8d47bf2cad8b592b9b745a976b8f85ccacfcc1e201e09f4f0a3baa9277339c28440d064885948ab0c001d0020b745a976b8f85ccacfcc1e201e09f4f0a3baa9277339c28440d06488","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1926,"b11cun030_00040012_13ee3d34":5089},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":29}],"recent_events":[{"timestamp":"2026-09-29T12:02:01","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"411a392f-15bc-4d4e-9238-2e4bcdb79a88","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":5,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T12:02:01","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"04c7612b-2b99-43a7-abf5-bd1b87e6e812","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":5,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-29T12:02:00","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"efd40023-4021-4b9f-9ede-4557f8d12e48","seq":1,"duration_ms":101,"bytes_in":71,"bytes_out":5,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-29T12:02:00","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u00061yULZR","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100063179554c5a52","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2b9bf037-394f-4b13-b6c8-116a48043c0a","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":5,"enriched":{"digest":"cc609a97b59b6324","strings":["adminclient-5","1yULZR"]}},{"timestamp":"2026-09-29T12:02:00","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"10deaad6-e4d8-49ed-86e3-e124092f881a","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-29T12:01:59","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f338296a-6eab-40bf-8e10-e7a840bc7d21","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":5,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-29T12:01:59","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004,|�a`2\u0002\u0001\u0003\u0004\u0017cn=yqypvcfyhikwxewepbms�\u0014yqypvcfyhikwxewepbms","payload_hex":"303a02042c7cbe6160320201030417636e3d797179707663667968696b777865776570626d738014797179707663667968696b777865776570626d73","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7fb7c1de-49c6-4f87-98ff-4c7693c60df1","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"c0def7b1d6c01140","strings":["cn=yqypvcfyhikwxewepbms","yqypvcfyhikwxewepbms"]}},{"timestamp":"2026-09-29T12:01:58","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:110\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3131300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"551bb44a-7077-4a23-b26b-984563ceef5a","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":5},{"timestamp":"2026-09-29T12:01:58","port":110,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3ddd0fce-c69b-4fdd-a640-3c028b12adc4","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-29T05:15:52","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cbecd301-b5dc-4aa8-b676-d76d7ec8360a","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":3,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:110","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T09:59:28.531584+00:00"}