{"ip":"23.251.136.213","total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,685 bytes sent","bytes_sent":1685,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T02:53:09","last_seen":"2026-09-22T06:32:12","events_24h":0,"events_7d":30,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"213.136.251.23.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":18},{"port":21,"proto":"tcp","label":"FTP","count":10},{"port":25,"proto":"tcp","label":"SMTP","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303b57ba92ccfeeb60db5949aab208670e99b8a545343f189b1d0d788ed09aa4ed1200b66839771d2ecf8e51667e84e19ce92db03254f89b0afa1025770eae50c7c350032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0ad8c6568213698cab04dc1527a1119764a893e33b94e2973c3980e9899714af823597b86710c36566c8fe06688b5f15d5317bcffbaad5624175df88413e303c898accee142ba896a5d50a38168afa9a67e95940198328742b40c89487ab12bcb73a97d963aae4481c6f63b693bf48e5a5197224c8ade4010364c478d2abeb8367d34f62dbdf71ef2522de02703b4007c764717c2641a655457c79aaed1aa3a102c2ff340812a605f304455704222d7d47ee27884282ab5a1c9116fb442aac3836bc226146c14c00b3962480719f1246e796b47c44a3ed79757296277272ced72a97b64446a6789bfc96056a03d66739ec41074e3f90ac305952336505d54a26c958dd9d09de83a6348b92eb511019e303ad0484af9c56f413399d3732eb91791f2c2268916569a0680bb17081362474aa44ee5b9c6a9e7403c65622de5826a3c0045d181de900c50dc7204a737e5010f47f3aa4a10ab24904cf3b50bed80b13bec3dc9c916593c6f97d287838b45b8020379201c95201324b0c53d1287d240c379f414db3c9d819b528a005978b24537d1b88209bc45c3bb9aa5172734452d670aad3a09bcdc19bf5b690f53b8e7eb4532e171b5889b8e443c1ee1958f5cc36db93d5d96bf62d09f4536a85c49b196b3531c3700b85b72709b17f533ab4f6c1653771713a52b65290dd50a03ef80c4c096a29a888ef259cd243b0d8408cc784aa6ec570f7dd58d2d4ba4b3a1bd8fa99cad9632fbe4a492f0582d9aadadaa79bb351d24c7977a02810e3c9983625548c13f52449a8e46aeaa0886707c0b21219c473ccc78a8aa2a0c922ca4bfff75c7dfe55dd075cd1657c316d88b33bc33cef5386f1a2c7f6bc9c9239062525ec1d4c2b9fc50327776cea551c1b15aeaaa5c3352a3d32920fa4c5ef861be6b8a65ac4cc606ecc52d8a1a64ba9ea733bdd7406e01d6a9f3ca5bf8e4a6dc20ca3dd0521c360eba068133b906945662a5e4394f973089b770d3dcb585b44ec8e93fe6e02398c4091c2b94a30b155499c60e4629baf49903f07b87e2975df96ef664bab42283d4e94cc6fa283276647e457f0cd4805f058a03f8a2f686c8cbbb26712749e6324244187aba57c2dcc39862a49ed841ab2a7590e5577881a0035f15b8ef48a7de3cc1a3f6783fb78bee31645dc30c67300b78c4885d317840b95123f21c136c1e74551e3f41c617995ff10754abf5bca74a7354ec1ede0792f3581b79f157adfa64baaaccfff90fdc0a8443c647ac783c01447e63f3b636262c4aeb0b8639c65236c689a805bdac4ef2288d90b545b6725da688b531d547de2538f8819366934327a503c3f18df5186f9c2a3356d705685370a15c48e491166c670e96bb9b1c74c0ef87a0becc10ca295caad145a1e0a180877cb68401d5816e4903b28fd2cb2450a82d104e57f76f7311c3ace115dca9bf73e146df39019e603a710b5c8f64c8df8c02b9770ffa1b892be921204a5baf40016f307365352a7ab19372ab0e4a38b67487652ca381f074711178aa5d18301e53a7e06a62ae15a39786a77158aefa856858e89e661b84e459af0a211679337c3bbaaaf24116993a0fbf40233d1821cc402d2a39a524d8274352af61a1c13ad6060b31f7be6457f552b5bf55cbddb1b27c8378ecc8b3afc7141969069e9c2289318030de90c6e6481c1d3c549ecd354fb4e25a7ac3741cecbecf55cc0266001d00202289318030de90c6e6481c1d3c549ecd354fb4e25a7ac3741cecbecf","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":[]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1961},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-22","count":30}],"recent_events":[{"timestamp":"2026-09-22T06:32:12","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"0cb415a1-da4a-4ee8-81e8-0f81f9730585","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-22T06:32:12","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a6f51e99-221c-4634-9cd4-bdd1f57a9cf1","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"95034d68-9cd5-48c8-94fa-d3da93102e5c","seq":1,"duration_ms":10,"bytes_in":190,"bytes_out":34},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ce5ff598-df7f-453d-8155-5009d7d778da","seq":1,"duration_ms":111,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a8a1fc48-7d3d-4e9d-aba2-2d68fe376ead","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ae3dacac-2986-4b1d-9f91-c4d5d0de685d","seq":1,"duration_ms":111,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004\u0001$�5`2\u0002\u0001\u0003\u0004\u0017cn=dyjntxcdlxlrjlubckjb�\u0014dyjntxcdlxlrjlubckjb","payload_hex":"303a02040124cf3560320201030417636e3d64796a6e747863646c786c726a6c7562636b6a62801464796a6e747863646c786c726a6c7562636b6a62","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"8378c3d2-a826-4629-b12f-4601046b3b5d","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"d1d185ac6154f424","strings":["cn=dyjntxcdlxlrjlubckjb","dyjntxcdlxlrjlubckjb"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"806f3451-74e1-4d4d-812f-dba6e2fe2ec9","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1587f347-050d-40db-93bc-0b0e86daaeff","seq":1,"duration_ms":40,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-22T06:32:11","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006ncx0kM","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100066e6378306b4d","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1c721bed-cec5-45d5-94e0-64eba473898e","seq":1,"duration_ms":79,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"558aba431bded4a7","strings":["adminclient-5","ncx0kM"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":4,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T12:58:43.886123+00:00"}