{"ip":"35.240.97.242","total_events":156,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"117+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 117 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,003 bytes sent","bytes_sent":21003,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-24T16:32:55","last_seen":"2026-09-23T08:44:31","events_24h":5,"events_7d":16,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"242.97.240.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2049,"proto":"tcp","label":"NFS","count":9},{"port":443,"proto":"tcp","label":"HTTPS","count":8},{"port":139,"proto":"tcp","label":"SMB","count":6},{"port":27017,"proto":"tcp","label":"MongoDB","count":4},{"port":9200,"proto":"tcp","label":"Elastic","count":4},{"port":445,"proto":"tcp","label":"SMB","count":4},{"port":8873,"proto":"tcp","label":"","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":5432,"proto":"tcp","label":"Postgres","count":3},{"port":5433,"proto":"tcp","label":"","count":2},{"port":30101,"proto":"tcp","label":"","count":2},{"port":11,"proto":"tcp","label":"","count":1},{"port":12389,"proto":"tcp","label":"","count":1},{"port":50000,"proto":"tcp","label":"SAP","count":1},{"port":591,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["a11cun050_0000004f_0d8a8ff5"]},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":296,"a11cun050_0000004f_0d8a8ff5":84},"akin_families":{"a11cun050_0000004f_0d8a8ff5":{"head":"a11cun050_0000004f_0d8a8ff5","shapes":2,"ips":87}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0","python-requests/2.32.5"],"timeline":[{"date":"2026-07-24","count":2},{"date":"2026-07-25","count":2},{"date":"2026-07-27","count":4},{"date":"2026-07-28","count":2},{"date":"2026-07-29","count":2},{"date":"2026-07-31","count":13},{"date":"2026-08-02","count":2},{"date":"2026-08-03","count":2},{"date":"2026-08-08","count":8},{"date":"2026-08-11","count":18},{"date":"2026-08-14","count":4},{"date":"2026-08-18","count":2},{"date":"2026-08-24","count":11},{"date":"2026-08-25","count":11},{"date":"2026-08-26","count":15},{"date":"2026-09-01","count":3},{"date":"2026-09-03","count":16},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":3},{"date":"2026-09-13","count":1},{"date":"2026-09-14","count":16},{"date":"2026-09-15","count":2},{"date":"2026-09-21","count":9},{"date":"2026-09-22","count":4},{"date":"2026-09-23","count":3}],"recent_events":[{"timestamp":"2026-09-23T08:44:31","port":13084,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:13084\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31333038340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"4faf72c9-5174-4015-87da-c04ed5015544","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-23T08:07:17","port":52399,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:52399\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323339390d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"51bf32ce-2e1a-47a1-b079-062f92697b36","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-23T01:50:07","port":5432,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\b\u0004�\u0016/","payload_hex":"0000000804d2162f","method":"","user_agent":"","ja3":"","session":"f7a7a897-1874-435e-94fe-5e0b4d466309","seq":1,"duration_ms":100,"bytes_in":8,"bytes_out":13},{"timestamp":"2026-09-22T18:31:53","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":";\u0001\u0000\u0000� �l\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000����\u0014\u0001\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000-\u0000\u0000\u0000\u0002name\u0000\n\u0000\u0000\u0000PyMongo|c\u0000\u0002version\u0000\u0007\u0000\u0000\u00004.13.2\u0000\u0000\u0003os\u0000T\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\t\u0000\u0000\u00006.12.85+\u0000\u0000\u0002platform\u0000\u0018\u0000\u0000\u0000CPython 3.13.14.final.0\u0000\u0003env\u00002\u0000\u0000\u0000\u0003container\u0000\"\u0000\u0000\u0000\u0002orchestrator\u0000\u000b\u0000\u0000\u0000kubernetes\u0000\u0000\u0000\u0000\u0000","payload_hex":"3b010000ab20fe6c00000000d40700000000000061646d696e2e24636d640000000000ffffffff140100001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ef00000003647269766572002d000000026e616d65000a00000050794d6f6e676f7c63000276657273696f6e0007000000342e31332e320000036f730054000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0009000000362e31322e38352b000002706c6174666f726d001800000043507974686f6e20332e31332e31342e66696e616c2e300003656e76003200000003636f6e7461696e65720022000000026f7263686573747261746f72000b0000006b756265726e657465730000000000","method":"","user_agent":"","ja3":"","session":"c10c5fc3-af23-4c74-908e-8924a6b06c82","seq":1,"duration_ms":100,"bytes_in":315,"bytes_out":13,"enriched":{"digest":"3322787f56416340","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo|c","version","4.13.2","type"]}},{"timestamp":"2026-09-22T18:16:35","port":139,"proto":"tcp","app_proto":"","app_protocol":"netbios","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000D DCDDCODJDECODDDHCODCDCDHCACACACA\u0000 FHEJEOEEEPFHFDCACACACACACACACAAA\u0000","payload_hex":"810000442044434444434f444a4445434f44444448434f444344434448434143414341434100204648454a454f454545504648464443414341434143414341434143414341414100","method":"","user_agent":"","ja3":"","session":"fdef7686-9ae7-4e1d-bf76-30f4af4b1938","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":13,"enriched":{"digest":"8a95250d63359832","strings":["D DCDDCODJDECODDDHCODCDCDHCACACACA","FHEJEOEEEPFHFDCACACACACACACACAAA","D DCDDCODJDECODDDHCODCDCDHCACACACA FHEJEOEEEPFHFDCACACACACACACACAAA"]}},{"timestamp":"2026-09-22T12:05:10","port":8873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"79b0e976-59be-4f4b-a632-5c4a74c2d83c","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":13,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-09-22T12:04:38","port":8873,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4\n","payload_hex":"405253594e43443a2033322e3020736861353132207368613235362073686131206d6435206d64340a","method":"","user_agent":"","ja3":"","session":"d2492cee-3948-4e87-8964-d1d22e5684af","seq":1,"duration_ms":100,"bytes_in":41,"bytes_out":13,"enriched":{"digest":"bad9adf5c8ec8f03","strings":["@RSYNCD: 32.0 sha512 sha256 sha1 md5 md4"]}},{"timestamp":"2026-09-21T14:52:57","port":3012,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3012\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333031320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"6731d7b8-3561-48c8-89b9-ddc805c845d4","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-21T14:21:59","port":3541,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3541\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333534310d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"c475a1df-c0f1-45de-9321-e5598702d7c5","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":78},{"timestamp":"2026-09-21T14:02:31","port":12113,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12113\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31323131330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"3c793c80-c8f1-42d8-9060-5b701d7ea10d","seq":1,"duration_ms":101,"bytes_in":149,"bytes_out":78}],"http_methods":[{"method":"GET","count":124}],"distinct_ports_total":117,"top_paths":[{"path":"/","count":124,"ports":110}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":8}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:13084","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-23T13:38:55.843999+00:00"}