{"ip":"34.14.17.169","total_events":11,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["11 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"651 bytes sent","bytes_sent":651,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-08T08:30:24","last_seen":"2026-09-24T07:21:18","events_24h":0,"events_7d":10,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"169.17.14.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":10},{"port":7979,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303eaae670e0a6045368c174a535c47b439737bf84d966646ce546285cccec94dc6209e432591616868f780ede232f4bae54d7a8894110b3bbf5ed6554d03eb542f2c0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c07c8110e05533d6979b20a87ff4843950d886a5f908a63801f46540e923a740d9b02579372a9b3b307ac128ab7f831400c82baf6bb18b87f9a87ed07bcc7c9b158787a03337027664f0ca8a1271adda73001bab2822912aba45a93b939b55e8093062c3f8b8928c3ab390faac2f91848c6a21e1db634f290f2e63adc0277da5eb676f2752adc95a9a928b3a50644275af9b0c01b2e298c4853dc85b1a065a3c00dd35d8e2c177c69a6b9a75c5c4479ae754392c33ea202ea2fa2841c447c4f4a423a4bf9b439c30ac081f2349ba1c99bdc3adda29905c148903b5c0ea15001b734511d8172b1560e6b72321cbc79c35b684e786fa5aa6fa1c1a1f326fd8c910584550f20b687fb7c7f5879eb7e42dba3904741184bf3b50bcf47671924ce4b0b537e5cdc808513bd813ebfb63ba2153d206615998a44f374f0da0b35a612a31d9badf74396afccdd069c6d04868d955b43203a038f940cf71be2d848ae239cefcf202a364a812a1051ae932fdb6c13fe06f4eb14dfae49ff74c4c2e6cb27f08898fe40582f1979df16ccb14c46f581dd1703e14108b1fa75c8ed154d2b26041bb33a94cc55ce39c919842a5dc12893a2e6a296cba62083ec7427c17b710808806e828da2353cfdc392a2a08289aa7fb332f28701881b1485b04aff984c7c527067e957184cc75d7caba609cc81fb1b24d239586f7484588883f3569e37a1caf2528a2b25085e42c2e0870015b0f9845376096226bca1972f00656d43849e49d13784c7f41baff34bf2c63b21e7408a073b0404204d0774b48e19541d20d584487614350a3292fe5ea52a09ac7647b1eefd4642ef7c57ff450d5f47e12f311da77b5ac55bfadec124a7b16a0191926f65a834aab728288392538378673f8f319efdcbe02e0c6889424e1e23bef56622324961168bc86a1057bd8058fe3082bf4994dc2c487545df7193871c3aeb229aa38cb46e9827cc06acf4c45c16d86b71b8cb9f5ca2bd674cc8cba3cd03273dbf0a183c84ea6846ccac32e1257b72d78644618448289cd511c8e34f80588e01f6562ae017602c3168320fa5afde0418b4529afd884a5078348c2b24b91b2c6b61116d1a8c2a18c8a0c6a2ec98f5163264d346e4e44575462a62bd388455055cc22561f5b6fdd4951308821e80c497976864beb2ee37abe7c2a6c8a340014a344487c50b2777fc242512c6086d01c1ebcc2591242cfa922a584d30526119fa58882ac13338eb38430a9ccf8979b99fac9e666bc80232720f47cc047419b403e3a7872794267b35bb5f62ac244b513bc6312b4b2af5aa2cc295b069265ad0885b10ed2cdb6e7885a12234338b14264ae52dc4eabf6a154e65bf29c758390bb61a0689675ac0393bd3931705716019af427c7fb640e8c958963074d022a26e9b0b3a210ae29588b981a15c8c48ea4912a583dd9543e74eb4ae3d83603a3c7e6b77a3d60bfccd21167fb6eca406a2b74c4fb8357716c2548a6c48a8813440598fa95a0fa2089f4985e9ce87b55b9336f445fe5b478f195123ccc2701780f0c65cf235b0abd82cd8865758ab380da07571606783db9465f0891bf1751baf5c86de95c401ab14f2b4451684589f51beb34a659e6c019dd88bab03b4d8c43ba4940fc2cebc4884b7d225ab6e90941d03236879fea9e81ee94b89f0506a19c73fe762b57e9ecfa18a343e796f52f9ce7195e64dea027001d002081ee94b89f0506a19c73fe762b57e9ecfa18a343e796f52f9ce7195e","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1928,"b11cun030_00040012_13ee3d34":5092,"b11cun050_00040017_976354f0":1282},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":6,"ips":1282}},"user_agents":["python-requests/2.32.5","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-08","count":1},{"date":"2026-09-24","count":10}],"recent_events":[{"timestamp":"2026-09-24T07:21:18","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"16687c8a-7b48-4fef-9905-2d4dc56e47ff","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-24T07:21:18","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7d582378-f00a-4875-9463-b32a575f16b6","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T07:21:18","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9464ea8c-e70a-42ad-9320-afb1abbea00b","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T07:21:17","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"479d8efc-defc-4ddc-bc71-398fedb220a8","seq":1,"duration_ms":101,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-24T07:21:17","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u00065Xy7LK","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006355879374c4b","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"fc91b051-67b5-448b-8edf-be570be855fd","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"433c0379cb4886c4","strings":["adminclient-5","5Xy7LK"]}},{"timestamp":"2026-09-24T07:21:16","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c93b3670-fe47-4b1f-838d-8fee5d742945","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-24T07:21:16","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1844e281-167e-4e9e-a45d-a25db7c1db47","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-24T07:21:16","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004~\r�\u0000`2\u0002\u0001\u0003\u0004\u0017cn=bekwrfzhwopaqfnqizje�\u0014bekwrfzhwopaqfnqizje","payload_hex":"303a02047e0df80060320201030417636e3d62656b7772667a68776f706171666e71697a6a65801462656b7772667a68776f706171666e71697a6a65","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"ced8ba63-d182-4d2a-ba8e-6d86e121f778","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"ff9c215f46372ee4","strings":["cn=bekwrfzhwopaqfnqizje","bekwrfzhwopaqfnqizje"]}},{"timestamp":"2026-09-24T07:21:15","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"605c29d3-620c-4454-bf62-5b32d89cfb41","seq":1,"duration_ms":94,"bytes_in":189,"bytes_out":34},{"timestamp":"2026-09-24T07:21:15","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"97f8c67f-0b47-492d-a564-71847a555929","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T10:48:58.222071+00:00"}