{"ip":"207.175.9.253","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,009 bytes sent","bytes_sent":1009,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T03:52:17","last_seen":"2026-09-30T06:54:11","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"253.9.175.207.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":990,"proto":"tcp","label":"FTPS","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003030767d1e69f3d78bd799ed168f50deee9cc8d73422b9286a74e3358f1ae9ee46920f379e1d1c7650ce79bbd6cd48bc4a524e73d960fee5396bfc7f15b7cfc608c320032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0efa1c8e3244f763017f9417f4a934c10525e48566d261a0416ac330079ceefa486527b70207aa0fa900ddc047f76854b907001d7a74623e2b550b37bce4c0dc9003c9c5929c72807e49c4af96c05e9a0c755a5991bb4abfd651036c2478669701718654be78a4eac0bbcd01db30b5a6f632255029a377a7fb2d73563672ae1f7b5a826c3daf956423916a8d15719bc9d2af2a765b3b221622503007e9c314e2f027df3b2362e1a573b0c5196068ee3ec642ba23b26e58c57e84f2791133103999596594dacba8bba646e9926678c46c5d631bb34735bf13a24ab30ff407b75643bed2c400031bf045c237b628e86fcbbebb23a4dc0c9126463c1299a7c043d43856a21e67cd8c2acb865471e30010f919b27ec914866b309d3884952639e9a14a2b6c49b937672bc86ad14a32d20774b26184f4a4125445b3e37c2bdd8b448c32ad8fccc885b0a7bfb4b0e7359c09aa5a65a7eb1fac4cfa164c976a151eb17d46733f534b59b38c9f52c66c4189d1c959842b06ffb78bf0844afd8648b48f05ea0e730f956785d5685e9ab9a526cc92997a1aa71aa8100c7e19a0808e84f2c171b0e7646a5161302ba9302082ad3fb393f5268aac62a8f43c3dc05731c812b5480ba4246b9eaf31e5a878534aba863fc785c719b53a9af46485dd7ea0571287e883478d25c83a1f91bbe228f16807b87b4279ec04dd96211188b7397d3095a581d5be3b12808078c5366bd8988763cc16c0a1f558888988801655100716672839110fcaa9244fbb1e1b10377c81fdbfb4ad2d279fd50518e43122d841e466b775c0c657596c2388a916f90079a07c429b1836c13a3a9fc2adb9b867d9b9e79a482e5776093dc83bc833254d5cf38f9466245719628a1cc0592334570af556d5d347c286a57b3d35c9b09b9c5d0775372379a39a9cb046c99dc6d6e03acab58a4580aaed26a23df187fc7f545dc2a1e8b729927967b058c4175f53605f83b596661160732d61c206b2aa3eed2008053920a0a98fc6070067498f0e9665730580505887b4081ca90976a139585c9964a39654722b580e4764af3094052521967b0172c550d797d037b2bdfc95f4ef769287a1297cb07f1695f3dd3085f8b87e3b6cfceaa7f53a1a7dab2c001db21da4b6289f01b69c750025cc4347ac8a497cb38655f8d8ab7c1c17f8cc71f4990220f175b77676fa4601273b4a433235beac3beb800364854c23e6710ca3aa3adfc4403750ee2fc969e8cbd87c607cf53b5bd906a555753f46a0c88d77799529b9de5753cdbcc908979790a9db065aeb1ac5361392da41169833261bd9b23c7c8232d288ad5858af519bc2f78bf04a729af79c6bb02848a1a814d1750e230995e8b0a1aab69729848dc7c12762c5f736a3dacb647fc824547071858a2c131203db8a4cbd2f31ce0c13ae004a43087a0cb675b51229256e5520873148319c454d04697484263c0063c8883c4f800908c3db9870a472008cb347e6eeb55fb78ad91344efad68090e33203e4446cfb5e6e4633b4ea3e39c9ccf13971ad23914460504f422aef0cb937646763a2b85da454e67855ac7b6011b95b92fc35e6035353fa16e23214d895047c4288f098b8a8f82428e4792bf1f53e2362c996c2d35139483ea26917bb8ee51848f2d3bae857d247ef98c4e276a2ddda7a85db57d1a7e2b28c1687a7765594dcd381047379c61e54f0f641001d0020e276a2ddda7a85db57d1a7e2b28c1687a7765594dcd381047379c61e","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":2002,"b11cun030_00040012_13ee3d34":5052},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":20}],"recent_events":[{"timestamp":"2026-09-30T06:54:11","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f9759af2-d136-4ce7-8c26-24c24c9f6791","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T06:54:10","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u00060rDM8A","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100063072444d3841","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"5f3e0d80-1620-49e2-9228-7320cea6ac10","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"6bf55b7a1588d685","strings":["adminclient-5","0rDM8A"]}},{"timestamp":"2026-09-30T06:54:10","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ad91def8-4107-48cd-801c-7368cd2f3d21","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-30T06:54:10","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"fa7751ab-2fae-4696-becb-713bd2e7d6d4","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T06:54:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u00042�(\u000e`2\u0002\u0001\u0003\u0004\u0017cn=lpwperlcrbvxzdgtricc�\u0014lpwperlcrbvxzdgtricc","payload_hex":"303a020432cb280e60320201030417636e3d6c70777065726c63726276787a6467747269636380146c70777065726c63726276787a64677472696363","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ae8772f5-21d0-4c74-a7d1-1985a8ada384","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"085b5a78750f1161","strings":["cn=lpwperlcrbvxzdgtricc","lpwperlcrbvxzdgtricc"]}},{"timestamp":"2026-09-30T06:54:09","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b2e32ad1-e59a-4128-9906-dd7a3a77efa5","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-30T06:54:08","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b941f793-41e1-46e6-8f19-2c166cf0c76b","seq":1,"duration_ms":192,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-30T06:54:08","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"da3e809e-3cb6-48bf-ace1-cc3e502a02e5","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-30T06:54:08","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"fd32ca29-5be7-4402-84ae-5cfda1cc7e2f","seq":1,"duration_ms":191,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-30T06:54:07","port":990,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"6234e3d3-2534-40c3-a68c-93b60f8e7931","seq":1,"duration_ms":90,"bytes_in":191,"bytes_out":34}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:990","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-02T21:48:41.511372+00:00"}