{"ip":"34.156.149.17","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,485 bytes sent","bytes_sent":2485,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T02:40:28","last_seen":"2026-09-23T09:06:33","events_24h":0,"events_7d":48,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"17.149.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":30},{"port":23,"proto":"tcp","label":"Telnet","count":18}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c0030321f4fbc7a3ff912d9da5cf7a5d716a03a981abdd8cc00ae2a698c98b69ff507720bcdf24439761e50fda883f715f53f2d0747e7bd9df4889cff88bdc7a3b4dfe6d0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0a31417178358e57197a6d2188708775ee30d3536b69bf067c8d993bf71501ea156f32b686c66b46c74636634489001cd83c9133ad122655a28345b0107f516626b4005a488724b8c599b4f5f961cdeea7ccd2ca1437462ed1b5aff65657d5a5c68488464772ef3d7b9037b1c99c07a91b7cbcfb75eeef0c26d2a3a621a3867a6693c6620535a167ab15ee5106d9ef71b3af5a0b6a69d4a27812ea79a576500d602cb68b8c71f2c04739cb51cc8249f491f70bc23c02396dd5b6c8af4b5c7a401e224b8ddd8bb4449213f269e78a344954b77e6fcb7e9c600701521c6a00f9caa969fb3676ef79c69192bef30b8fd2624f692cf983bb4df2c51bf448a0f87ae43f627fa0363c6610c4a986201d6bef3327d41e9bb02326a497741d5f2509851a87a7ab0001456fb31312dd246f66acbad692f3ca799709a01c0999b21d50907b2bfa5858dfd2a793150a210f8b920f3953b93437bd23bfcba74aef32ca624af25c49a2623a409a04fa76372d7d0394dfc2fc2471169caaae7aa95eef93255ca9572f020d1136679875e52f30c487bb87a35be9539146ea0b6152228f32c31a4bc9fbef17e18f34aeb58b420734f9d708cb611728cb92ed634676402aa62e23de6c0538972016694bf2b4910d3127bfc7697271481dc7146320616a3d2ca02d94b71336b3fa2c45277cd7080c37d50319ac36160aca8bf8b3480b48b959a10ada44842015b989c9398fbc8a9b0652f93883e607615a71b3ec2699db3610975a77c077ffe6b1421d32c5577583f727b3adc9428e9529346a554c0636abb7b1c88c456677d9374cdcc1a9858e07c42a064c1073cb480651cc14c0f67af48e357afcb3d51e26eb0e74d57574de71614cfda638a3c4dc7224302b488a0c17659d62c2a722b7a3ac82715640b320cf0469da2b22701a58ecd1807f423044a1a5f15030513540fd0ea64219524aed31738a509a4f7ba4cc52d52f4750c9b3c5971c2d8c024b65758282c7c3ffa04ffa32fe16b0ae60a7c1403adbc93191cc204c9b6192e320c600644f7eb015a107f241ccb6c960313fba26bb2b06d2b3cecc05d62f482880ac26d09468a2a4442c128788b7de73388348875b4e70374d76e32078f5e207baae88fae29c560f03d2d7a5cd84850dfe5c20af1bf8d1987f82787415c17c79a0824e16819367b1906b190408bf59496d01930ce9069ddd51e0c2747568ab3b735068ee17aa714907e197292435a0d9bbc65e90bd98b5a54966bf04b9d02262977d05451b67442d650dffb521700011ec5cc2a68212c8774962384a6e4490fcca57888c742a076389b55acd046414500fab5459ce29bb121cb70342a9a54320b9b14048171bca88103ab4e49d6517cd22f97957c00c54546d58a30f76aaa558e97fbc6cacc0a78334cadd63fcae66236b74bd7776bf608c80b111e8092235573601b12a3275900446c942fc7a12c709cd815aa881860248a7d90c025bf2b59ec3c64c4137ec709a3d502a9817b70a898652dcccf775164767865af566aef4502a3f6cced8859592c1df8f3682a31ac92a0192ddb46695aa52c9781ebfc9ddbb8c84e587b63698a95f550a8a1c390f748b02cae354112be38cbd50258a7cc24427d3a863767279b7ee81362549b9783dd976e425fdd92d38586ea443b0a41b14d7e5427fba18d14554d5e504fb22776e3ce9fda4abe850566159dda916d6535001d00204d7e5427fba18d14554d5e504fb22776e3ce9fda4abe850566159dda","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1961,"a11cun030_0000004c_13ee3d34":2230},"akin_families":{"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":4,"ips":2232}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":48}],"recent_events":[{"timestamp":"2026-09-23T09:06:33","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9ebf4c02-ec2e-4ddf-b2e0-960d80efe369","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T09:06:33","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"3f92e8ef-06e9-47b7-89d9-3fc42682b66c","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T09:06:32","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9be9a8db-a6b6-43f7-8e66-31f46e11687d","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-23T09:06:32","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006tmXrZu","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006746d58725a75","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d13617d0-eeae-4a9b-b354-166e6db90211","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"1f5ddb341fe17818","strings":["adminclient-5","tmXrZu"]}},{"timestamp":"2026-09-23T09:06:32","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a157f443-4011-46d6-a36c-a849a0d09819","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-23T09:06:31","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"dbd1e565-aaf7-4fa0-82b7-ee5572288940","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-23T09:06:31","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004d5v+`2\u0002\u0001\u0003\u0004\u0017cn=vonggcmvosdeteinvpwi�\u0014vonggcmvosdeteinvpwi","payload_hex":"303a02046435762b60320201030417636e3d766f6e6767636d766f7364657465696e767077698014766f6e6767636d766f7364657465696e76707769","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"927d4055-78d1-4a33-86d4-ed3cd2f41c2f","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"39368ca2d1791d77","strings":["d5v+`2","cn=vonggcmvosdeteinvpwi","vonggcmvosdeteinvpwi"]}},{"timestamp":"2026-09-23T09:06:30","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"116fd5e7-d9aa-4138-9d18-dd707a79b547","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-23T09:06:30","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"25e6755d-9fbd-4ac2-8a76-0ea95187db7f","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-23T09:06:29","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"192.3.118.146:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"f5233b46-96f4-48f9-846b-1d044716c92a","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":34}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":5,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":2},{"value":"192.3.118.146","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"192.3.118.146:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-24T13:01:33.798506+00:00"}