{"ip":"35.205.168.62","data_as_of":"2026-10-25T12:03:05+00:00","observed":true,"total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["83 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 63 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"1,015 bytes sent","bytes_sent":1015,"session_seconds":14,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T02:46:34","last_seen":"2026-10-15T06:19:26","events_24h":0,"events_7d":0,"interactive_sessions":63,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"imap","sessions":63}],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"62.168.205.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":63,"first_seen":"2026-10-15T02:46:34","last_seen":"2026-10-15T03:10:22","verdicts":[{"verdict":"unknown","sessions":42},{"verdict":"scan","sessions":21}],"personas":[{"persona":"dovecot@2.3.7","sessions":63}],"services":[{"protocol":"imap","port":143,"sessions":63}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":21}]},"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20,"sessions":63}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303dcf382dc04440944749f48b1daa2f13e4d01f9173f65e23200d6fa2d4eedc6212040497f3c2fe39c85a2849274b6ce224e89b885cba5d7beaeb8c28450ae6feede0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c082ca7db78700be096a2fa970d5ab2698254713638c37417d17f9562fb6afb4574a0e65a14c3420761205eddbcabd2cc0a209bf3d207cf0d24f5f6b95c4080ecbaac4ac198bff29765062c5e4149520421810147aa1eca632411ad678967e4bb720ccc69c792fb6955847fb593b5a367db75718c5783f650cd7549b7ab137b5d316970a25fe543bbdf8bbef0112d0607138c50f7a3365a31ab1368a16a4f0c1f6b99b1a8737d8f82ad5b0628422419e45446b5a42b30725f9848e12a6812446591b542a10f26abeb132b938690163cdb4c240e0f06ba91ccddf086a4cd927144b94cf763c6d90728349698db18a763819c2b046b995782d3bcfb9ec1f86c4839fc54ace4490f8a1509efc7f3ff473daf13e81f3229bc4cc703b27acf35203eb7d39e3be87b41c8b350e203660cd43c3f5c400f623622535c1fda640e8563371bb0065dc494773cffcfbbc6a97684b084f5a669255a567ff436545c4b30130248e76241a7b1cf109946c895c3160515c7712334c0fc4ccafdcaa514a0b166862522ff446fef81caf39cf248b45b1cc9172a0ac19a37c9579c25e794671200c8d44a026f6a24ddb7005b3be58ac3cd7db477ebc6db81ba4f5fc972af302aaf06cae549a12546d5306cdab171ecf296d4710cf77882f8ec27dc2885820043849d09b09eb00127995104bbee5351ed0c49123da5db264c936d7245894079714627df497a04b0358f6aa0d1baf98e16d24f38cdc3746e773518f7c245c142a13ab403882a7ef62567d3b4c84c25092318a14138a71cb7e8c3577d72a13ff846d17ba82c43535c3526db674563cecc2467601a1a47f5a0a1fe3a968a70c8cde794ef162ca309012ac0c0e0a34613eb384643566abb779052b3994ca21a4180d212ab78dd306f04095c987293c8895e6eb7f2c193ecefbc5f4cbc4a90860767aa46e02684792889b6504b687cdf2711fa9c7097a3614aa94cc64557ec2a1577df6040a3184bd08ad95f4a8e6d42cae0167f25c604e966ec6e72616a9b99467018a5b2bed94b3b41a4e0cb390cb09baf27404b4a7c4cdb98877316450b343a5c60306b339263b941716cf70d1982d0a240ad6a51bb42527211833b1100e30a7a731054fc117956a0db034b509c84038d416bcb3b49fca35ff2998de526945e91522d04e706732dc1268999a00ac829394ac2b26aa15fe05a17bf05e3ea73e82f1c0545c9e0d29c42ee0984eac9e3fb5be81f515d6b86f1c576043109b59a721d50b60c4ca2072b278866b33184cbd77f51c03ba5034271310ecb66e895b0a824a8a99a7b2d0ce48c9a5b2320e26107ff0a69ee657bee5a11828a66f49c0703243c744ec8f895924511c189ca020328aaa88c7b1c3e5503201af8a51cc9c047dd07c88bfe62120c0113dea8c39ac4e472b191b2b98b7f537b3c497b53c8c268444a646c0747784095545ac8c0554688fde1a16c27c10a8149b5dcc492b7b28e86b2d3eaa0785f067bde35a27ebc265ab4af4d741da5b54bc7a8475134febec582a03534adc5b7d64c0fd658186137234b54340354541089a047a1f2d200ded2024df1987f8950d4497865d789477e6ad2cbb5f51090d2ac3c52e7024c5417aadeb9ff3a0530b53e253018428af4d0d052afac7e27103a3e9650ff6752e174a687bc52eb622a4689956d439f149bae477fbfd8c265007408b34aadcc84bc7095b96da143959001d0020a4689956d439f149bae477fbfd8c265007408b34aadcc84bc7095b96","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-15","count":20,"sessions":63}],"recent_events":[{"timestamp":"2026-10-15T06:19:26","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"8fb6563b-813b-4ce7-b6b8-1d3ef4087eba","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-15T06:19:25","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"81b27aa7-8b00-4851-85cf-a3d61f3df39b","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-15T06:19:25","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6877c237-41f9-446c-b0fb-f28f9ebefe07","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-15T06:19:25","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006wINSEX","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d3500000001000677494e534558","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3969d262-02fd-4961-a763-57c193abe6b4","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"ac6aafac077a04d3","strings":["adminclient-5","wINSEX"]}},{"timestamp":"2026-10-15T06:19:25","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"46d0009a-d6e2-451f-847c-0b1eb88815be","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-15T06:19:24","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"23f4af2a-e0b2-4179-b67d-3d8e035e976b","seq":1,"duration_ms":196,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-10-15T06:19:24","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004JI:�`2\u0002\u0001\u0003\u0004\u0017cn=hucvhmyaeyswjrlgtweg�\u0014hucvhmyaeyswjrlgtweg","payload_hex":"303a02044a493aa760320201030417636e3d68756376686d7961657973776a726c6774776567801468756376686d7961657973776a726c6774776567","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"4b1f90f4-8fe3-43c6-af57-49c81ac25aa0","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"74c838ac18b849ed","strings":["cn=hucvhmyaeyswjrlgtweg","hucvhmyaeyswjrlgtweg"]}},{"timestamp":"2026-10-15T06:19:23","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d86cf33e-135d-4d0a-845c-d9b475b8531b","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-15T06:19:23","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a6baf3fb-3889-4683-9151-217323e33953","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-10-15T06:19:22","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"73a6cce9-64f2-409e-8e66-99601099afd4","seq":1,"duration_ms":95,"bytes_in":191,"bytes_out":20}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}