{"ip":"35.205.3.193","data_as_of":"2026-10-25T12:02:26+00:00","observed":true,"total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,017 bytes sent","bytes_sent":1017,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T02:32:20","last_seen":"2026-10-09T05:30:50","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"193.3.205.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":143,"proto":"tcp","label":"IMAP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303577c513b8fa34f7b72af38d3fd7921082238a661c620b0f676d58aad36e159eb2016c0dbb800b502bed4919c0229a9332c306283d4947b3bc104ef0a912870cfb40032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c04b79222624cd3d857d2a2a84d4683bd2692345b5b7d0a127e4fa6c51b14a07e95b22171b43c20bceabb19d873c7ec2a30ae76972c70937e394bc005f6de5c5d24c90617b3c4fc3948c663bc6152b22a82287fbba0fd032163a47313c5f7a1530ad545a48dbba77f1292d655fa5c1a7477a7b7e276f99369b0dcb0e7923659262a5068a2025c3c7b5287ec34517a277c833244831a661dbb0672e7b8686574e0b914f9e015267857ee46a6e914645cda058b75687a42389e0a97bb1297e93637696026882e641f3b4b1a7145cc1949aefe990a4f1afd2132605156770cbce0016c07ec66c9be539bc62b64e00c0b044bb84d1b2127b9da4d6506ad9c299316c1edac322e9608b85a809c045a9625bb7b252e7d00903c80c6b63981bfa555e6c93f8b17e6c1a3126c5ca1993b8dfe1b1e888156ea5658b027a01998a4d176173f114cb93a6523b26893c72d04babc116848b266511d3487144706c74cabb63a2f2462fd88b9e879ab250f68b97a30be673b298e972bc79b2afb9ca58d1be6302c01a20acf66005b1c50957b8b11a7c53818c57f8e92a7cb110f7d42f04689da2307112f315d3d19e6b504305442e3ee0bb489b7d90d8cf2eac8a9951c618432f9378800449620d13b606fc9d99e87446f7b4d41858958c8bac5129a9d2951a2a9ada244ebb5c9f7039b79563ba671273b6333092b7988488550334a48ae24c0694a0a152abae47a81b5676e743c3efdb2a04cbca9e47cd97404ffef5000ac3c701b55d4f311139a896f6fc9eb41cae86927cf4a0cbbc8b4116b4370026379f7b556602c92a9c10989bc8c7854875422e1e010ac68c1036f4bca1a6b493168cf15b42876c279ae51aed605180d86c85c5699c5aa4bbdc26ceba59312b04ee700b8bf2099d9577095aabf08a46c2c63c63e3971f56a5b6312311b39473f653a8e88b21343a41b0c6bb408ba9364a4fe39749051e664c3eae483928f30e2c500335311921da9743f01f992097360849d26153087a55cde950a2ab85c77cad69061995d0098bc70d032c8ef5fc96e3c61f7bf970dfe92bcfc94a420b8c0848c26840c08fe979413c9db2b5cc39cb40332b2fd948995d4c6bbf855eae60863ee4a20774717f217c4dab38dc18c7d0355bbe761405ab50d491a1148b958dc7029de031b5c9412a24794bb1bec4a30850f0cf9359665bb47420365c29babdd759234079645e98be8d007a34719a25c9384fca6224b9351f525705d902b22aaeecd23e46ba1629d1426a9bbfa58a575e598f4b8307dfd753c3ea6415a417e09946ed52bc0bf0401dcb06b4647b7a45863cb94cc719ab83112e62407cf5915ad3572dde348c6e578372d52f98dc6d39996f0f318145e59630f300119b7edf0730dba34dae7c1f17373073d599965b1b61a0328bc81ee3a73f3d4ca79d2a1f3f74a29cdacd4f479de3f19209a96387b251c25c2a6b68109f614a8496b504b4ca08a35e911a03b190ab8db49b74c537f5414b44eb03534b054079cc54929590db2b02a94ee968333af514d10550a68ab7da1950f7413463eaaaaa58ae687235c8bc2420ea44c190bd0d20b99a1ac5cac034fc77b5923490cf148ab2d335a9006fa354c1b411b5a74084e58c1dd3f7c734469208e5297550ba4e1eeee512e91f43ce477ebd43744647932fa432c12b81bd3c15c8955099d30c2e0cc1cce0ec418f83af74ca845f001d00204647932fa432c12b81bd3c15c8955099d30c2e0cc1cce0ec418f83af","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2766,"b11cun030_00040012_13ee3d34":5411},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5411}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":20}],"recent_events":[{"timestamp":"2026-10-09T05:30:50","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"61678969-697d-40e9-9c83-9b293b99c270","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":20,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T05:30:50","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c96862eb-8350-4ad2-9a2c-e330bfc81523","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":20,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-10-09T05:30:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"877c927c-3cdc-49d5-b0e4-6a63ac05d2f9","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":20,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-10-09T05:30:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006XT0ljk","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100065854306c6a6b","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ee4ed8e2-edcb-45f5-aa12-fdf06d14070e","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":20,"enriched":{"digest":"d8b23808f5a48bae","strings":["adminclient-5","XT0ljk"]}},{"timestamp":"2026-10-09T05:30:49","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"43cb1edd-db11-4c55-9694-186b113d4139","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":20,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-10-09T05:30:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"650a11fc-3a57-4b21-8f09-b1f123f4c6ba","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":20,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-10-09T05:30:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\u0003�b6`2\u0002\u0001\u0003\u0004\u0017cn=rezncvzdgpjiwietwiby�\u0014rezncvzdgpjiwietwiby","payload_hex":"303a020403cd623660320201030417636e3d72657a6e63767a6467706a697769657477696279801472657a6e63767a6467706a697769657477696279","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cd01b1eb-b3e1-456a-8296-c7cc1f7185b0","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":20,"enriched":{"digest":"31493bcb20709710","strings":["b6`2","cn=rezncvzdgpjiwietwiby","rezncvzdgpjiwietwiby"]}},{"timestamp":"2026-10-09T05:30:48","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"7FYWU8I4 CAPABILITY\r\n","payload_hex":"3746595755384934204341504142494c4954590d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c09890c5-5f6a-4d10-805d-da1534d06e04","seq":1,"duration_ms":195,"bytes_in":21,"bytes_out":20,"enriched":{"digest":"d8979da7d9551275","strings":["7FYWU8I4 CAPABILITY"]}},{"timestamp":"2026-10-09T05:30:47","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:143\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3134330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"e6afd5c7-bb19-4cd3-855f-aa2ccad700a5","seq":1,"duration_ms":95,"bytes_in":191,"bytes_out":20},{"timestamp":"2026-10-09T05:30:47","port":143,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2909b257-641f-4db9-8bcd-134af5a3dff5","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":20,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:143","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[]}