{"ip":"34.156.179.40","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,008 bytes sent","bytes_sent":1008,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T03:46:49","last_seen":"2026-09-24T06:16:39","events_24h":0,"events_7d":0,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"40.179.156.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303b6da93a68650d023a2a745e96c2762a34f0927142413721023eebc22456c5dd5206d96f4d54a2009f5f6c2ed3d704d796d9aca946c77d02149872c835539a707b50032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c08d4a2ef41038ad23c8a66ca8471072868cc8995ab1c394a282e1ba147027fb977143991b62d0a64f495618d83f440c05d6c95728c244f6aa347bba5d0076cc75a87740cc31929753298ccb42c2b8e66591a75a799d0b99a37841d059071dd679a852a4b591a67b8b311fd3b5e46229904c18ac93ce50a748b1295a191438097862063c0d926b0eec6229c4e526efa9883f29c6139353f75a50f580960df687b8e20e0fb3a560c57cca5c15c22099271212fda2714f32ae4da90729b906bf351d13e9695b06ad67a60b1b624a5339964806b9047886d1ca941499353be1aae078b509a05f8745047974627a2780485110f3a9167d9438a8585603ec05e038074ec5aeec6bb00953b92e495da1e5129ef2cb5b69155651698a336f7ff100b881ace9958ba590089a59c0889bb04693962a29be1bb707fb6014863a16cc47bf4780cac5170ebd9c7979023dede9745bba21bd24568c29689c6c4c1af92927985df366b1b09648fdbcadc0e35ab61472da210a9ef7b63a2a408b7237f6f072a0225b5e7109a27b7ab618ab3ce49598ab369536327874811a0234c1d725cd6929ccaa62fd07ac0d0a4f09e241c8326da3e95b4e318821b55cd33802f0eb9898b55d8f6b6e65d0bdc54944072606eeb1a4caa906d11a48175979b3e4599d02788a198fcee92754fc37cca9a38b8029c77a654c683450d297651394e28b6bc8f29f09a8c6beec4a5115961f22071983605a04aedb36accc6017ece2bd50d57fb2d1806712bfb163ac2ac88d003676c9f59eb06050b219c30ca6ce42568d66618eddb99e388868a268592181cf99a0976afa91cc251728c346af533e9d2189b53071e8da320c4833dae98f75931886d6aecad7b22e9602d21cb8919095e8d35ac8bc0c53dc3d9eeaaf69bc032f903d5da2c78fbc1fa3b9c51af723aa505a606524f126597a33c0b958423bc46d627670f0d260b60632d2ba56ecab3100705644407ba2d1326fc313cdb3bd714a22723a6a241b191d391c01d2373533262d28909767423be615e55b0d3de4790b737852250c57abb3451b583612068c5523ab854be7a5cd3d7b6735a2b7cab44af3323aef9957e53c693014732898cd6982a63480201a87cbf2b8188dfb4d779b0c4c315112f3199882765918a46352aa51f5bc61b054211ca096faa4541a5a4609c847cc47fbe88e3995a3e3280ed924b547f1aa4e2091ee786408c865ac59394138945c679aee6b520ef825ae1c8002e487c452a3b239771a4779151590c4cc865edb086228337f2770a7e0089ef1cbedb4005bac7cdec9955a009d6681372cfa0700677b739bc072a82fe46b8657c69e4a18143854940febadab8bc31bc00bfc8196fd465322397245623ee8db5e04b74d82654c9ffabbf418ccdfc2b6e56c62b4f56857f2c021f06400206344211e35c08924e9495b5686aad9c546665959f85ae9a303cab64343629685588886646f59c63b94f3247785af80a869a2c41d92ba664617a4cc58432e0a373861ac273944c68637c361cfe173af833328fa209fc1f0a4c6344b29001e703698c87005719711343bad7e440f9bd374ed9a67b2bc7b21c45c3b885ea118449c4520b8271f69c5b48fca6fc78cde3faff1840cb5517425500a58368dd6e19d6dda92c88a377c1e408e6094ab2ddac958fb9cccdfab9b56ea418905d8d8bf03cf95d668c8b431b3a4ba5650001d0020ab2ddac958fb9cccdfab9b56ea418905d8d8bf03cf95d668c8b431b3","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1976,"b11cun030_00040012_13ee3d34":5076},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":20}],"recent_events":[{"timestamp":"2026-09-24T06:16:39","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cd097d6a-9c17-47c5-a98f-883398edd6e5","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:16:39","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"04d5164f-3849-4a0d-be57-629462068746","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:16:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"c57e4161-f60c-402c-82fc-2034c26b2c47","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-24T06:16:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006v6B4GS","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006763642344753","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2fdef2e8-d817-4673-9cfd-834d5fcae516","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"1a375f84ff852cbf","strings":["adminclient-5","v6B4GS"]}},{"timestamp":"2026-09-24T06:16:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9a644e10-7e90-4edd-9677-c37340775827","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-24T06:16:37","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"762296cd-2c63-4e51-b04f-d6a26d8e636d","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-24T06:16:37","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004%�@�`2\u0002\u0001\u0003\u0004\u0017cn=okrsocnxeiemeegmoarz�\u0014okrsocnxeiemeegmoarz","payload_hex":"303a020425d640b960320201030417636e3d6f6b72736f636e786569656d6565676d6f61727a80146f6b72736f636e786569656d6565676d6f61727a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"33992d43-185b-4a3e-8fb8-4189b23b4647","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"d898e49ea951b3c2","strings":["cn=okrsocnxeiemeegmoarz","okrsocnxeiemeegmoarz"]}},{"timestamp":"2026-09-24T06:16:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"c494dffe-fdb6-4ae4-84dc-48a36381a480","seq":1,"duration_ms":94,"bytes_in":189,"bytes_out":34},{"timestamp":"2026-09-24T06:16:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9f5d832a-7900-4bf7-9948-49b7c208508c","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-24T06:16:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d5764e76-f7bc-419f-8d66-cf4c2fa90abd","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-01T11:50:49.692184+00:00"}