{"ip":"35.205.162.104","total_events":217,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"203+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 203 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"50,719 bytes sent","bytes_sent":50719,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T01:18:18","last_seen":"2026-09-27T01:25:47","events_24h":0,"events_7d":217,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"104.162.205.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":8},{"port":6380,"proto":"tcp","label":"","count":8},{"port":1080,"proto":"tcp","label":"SOCKS","count":1},{"port":8140,"proto":"tcp","label":"","count":1},{"port":9443,"proto":"tcp","label":"","count":1},{"port":9500,"proto":"tcp","label":"","count":1},{"port":8230,"proto":"tcp","label":"","count":1},{"port":2375,"proto":"tcp","label":"Docker","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":8484,"proto":"tcp","label":"","count":1},{"port":8070,"proto":"tcp","label":"","count":1},{"port":6080,"proto":"tcp","label":"","count":1},{"port":8554,"proto":"tcp","label":"","count":1},{"port":6060,"proto":"tcp","label":"","count":1},{"port":9001,"proto":"tcp","label":"Tor","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ea010000e603039ab4a73ce85bf165171d8639afe0276006a90d7fea740a4809cd94198eaaf0e7207c0730b72cf8b13a6d4a6dd4c3b1a6355f71c3707bfc643903d915006e63fcf50026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a13011302130301000077000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b00050403040303003300260024001d0020b3a1db81c22b1af64e9478f0584586116c72c3647e55cbedd2c053561841596a","tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"http_akin":["a11cun050_0080004e_3ef9a8f6"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3150,"a11cun050_0080004e_3ef9a8f6":79},"akin_families":{},"user_agents":["Mozilla/5.0 (Linux; Android 9; SM-G950U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","Mozilla/5.0 (Linux; Android 9; ONEPLUS A6013) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/75.0.3770.142 Chrome/75.0.3770.142 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36","CSSCheck/1.2.2","Mozilla/5.0 (iPad; U; CPU OS 4_2_1 like Mac OS X; ja-jp) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148 Safari/6533.18.5","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"],"timeline":[{"date":"2026-09-27","count":217}],"recent_events":[{"timestamp":"2026-09-27T01:25:47","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b20553b204c696e7578207838365f36343b20656e2d55533b2072763a312e392e312e313329204765636b6f2f3230313030393136204963656170652f322e302e380d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8","ja3":"","session":"f9327632-cf4e-4c3a-b627-6d168a9e0edc","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":5},{"timestamp":"2026-09-27T01:25:47","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/71.0.3578.98 Chrome/71.0.3578.98 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29205562756e7475204368726f6d69756d2f37312e302e333537382e3938204368726f6d652f37312e302e333537382e3938205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/71.0.3578.98 Chrome/71.0.3578.98 Safari/537.36","ja3":"","session":"a8f07308-f996-465f-83ed-5b45dd3ee527","seq":1,"duration_ms":101,"bytes_in":256,"bytes_out":5},{"timestamp":"2026-09-27T01:25:46","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; SM-M305F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20534d2d4d3330354629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313131204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; SM-M305F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"a8f001b1-5f0f-4ef5-88cb-f3ad0ca476a5","seq":1,"duration_ms":101,"bytes_in":244,"bytes_out":5},{"timestamp":"2026-09-27T01:25:46","port":6380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 8.0.0; moto e5 cruise Build/OCPS27.91-157-12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420382e302e303b206d6f746f20653520637275697365204275696c642f4f43505332372e39312d3135372d313229204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36382e302e333434302e3931204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 8.0.0; moto e5 cruise Build/OCPS27.91-157-12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"c3453e9b-c78f-4a24-9352-3e66f15497d8","seq":1,"duration_ms":100,"bytes_in":276,"bytes_out":5},{"timestamp":"2026-09-27T01:25:46","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b20553b204c696e7578207838365f36343b20656e2d55533b2072763a312e392e312e313329204765636b6f2f3230313030393136204963656170652f322e302e380d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8","ja3":"","session":"7d493d12-8cad-4410-90e8-a8606ada0c5d","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":5},{"timestamp":"2026-09-27T01:25:46","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/71.0.3578.98 Chrome/71.0.3578.98 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29205562756e7475204368726f6d69756d2f37312e302e333537382e3938204368726f6d652f37312e302e333537382e3938205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/71.0.3578.98 Chrome/71.0.3578.98 Safari/537.36","ja3":"","session":"221803e8-161f-450f-83da-57369dd91ca9","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":5},{"timestamp":"2026-09-27T01:25:45","port":6379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; SM-M305F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20534d2d4d3330354629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313131204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; SM-M305F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"169eb179-2514-434d-96f9-17b30691d242","seq":1,"duration_ms":100,"bytes_in":244,"bytes_out":5},{"timestamp":"2026-09-27T01:25:45","port":6380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 8.0.0; moto e5 cruise Build/OCPS27.91-157-12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420382e302e303b206d6f746f20653520637275697365204275696c642f4f43505332372e39312d3135372d313229204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36382e302e333434302e3931204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 8.0.0; moto e5 cruise Build/OCPS27.91-157-12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"f4982312-6454-41de-b272-856cf6031197","seq":1,"duration_ms":100,"bytes_in":276,"bytes_out":5},{"timestamp":"2026-09-27T01:18:24","port":6379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6379\",\"user-agent\":\"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.16) Gecko/20120421 Gecko Firefox/11.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363337390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b20553b204c696e757820693638363b20656e2d55533b2072763a312e392e312e313629204765636b6f2f3230313230343231204765636b6f2046697265666f782f31312e300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.16) Gecko/20120421 Gecko Firefox/11.0","ja3":"","session":"3748c8b3-d5ba-421d-9595-25934cb2d0f3","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":5},{"timestamp":"2026-09-27T01:18:24","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6380\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363338300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f36382e302e333434302e3735205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75 Safari/537.36","ja3":"","session":"8f242c44-6dbb-44f6-8b7e-11d51daaa343","seq":1,"duration_ms":100,"bytes_in":227,"bytes_out":5}],"http_methods":[{"method":"GET","count":217}],"distinct_ports_total":203,"top_paths":[{"path":"/","count":217,"ports":203}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:6379","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.13) Gecko/20100916 Iceape/2.0.8","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T03:03:08.043917+00:00"}