{"ip":"34.22.253.158","total_events":21,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["21 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,013 bytes sent","bytes_sent":1013,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T02:38:02","last_seen":"2026-09-24T06:53:39","events_24h":0,"events_7d":21,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"158.253.22.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":20},{"port":25,"proto":"tcp","label":"SMTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303cd8ac63a552c92686cc673b33feea05d84ed8dbf73a3074e4dedb2271150abed203a467d321b50b3cb83f32c968935ef14c25c632ee7ad316aea099eaa298fe5f00032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c005734f75b54164db4c9e0c563cb955a52a76f83c1ac8e461b2b21f7c9b0d01875928855a4ec0bb432268f7f87d71090f2b5c3edc8335a2465e3eac3a1748c7e4f67e0ffb44e2cc4bb299077e7c5d33f40fd3769593eaae98038a7b0b9fd8b386c512195b129274102b8ae4b5aff546c875ad0d2289b4c440961abf06c58c679b7475ac1d8d162acfb842164c9fb10c3c78b15ef8d55fa2422ba553a0533585fad8135efc430b079cc73b98dbe72f3df54b6273958d11986294b364e65ad6d7c401e7b11ab25a2f35805430472a96228df9cf7fb98eb64034f86133f83143cc8b9651e54f856a37a4b16d4f3342e330623ee705721ca7ccc906aeccbc8111a464523a283c87a2a0adda9b3010e8a6d2c4217f6137b2ca2a161563b5f6412180234ed8ab9fcb4679247035aa8d0a020d602420d0d8cab7b6382a73a25d760ad4a5254ac03faab66cce078ec765c120bc5f4a550a9f685d6d583d062a4bfd631e8c48a891f6250ec764398c9f8830191056185f535009da75eea9c7d240021b0b53de3382318b8d0640c090a07bf5ca3f57864b9d8a903ba00a8830b7bea22475b4ad2d3250b029468435c05d0bc7c318b120fc14ac7167655827f7ac1634d6b2c7e43160d5965d343fcdd50ada29a4685865ac825dfcf6cdcdb79c8375a09dd680df48be39bc2582eb282da7cde0f319119a84a0c67f8c7097d272345aea063e89abaa169f79022560ab71a470b85ee272713c4d00b769ecb8552436032bc51d3d9026075972517497584abf4f7731ced34df887c3819a592288472aeb72aa306292227ef78b77d3e48bfad714196528c889a0eccb9c8615abaaf999dda043984b01ac77cd97eb563fe583983041d6c73c72647f85600a9b9b225ec9217435c75bec535f9872988c7731a5bba4a0709d5cb06250382e6b71be6c944ee0ab4ec3a91129a81c80874273c68d335ef02314780758342910d57bc4d3665196f7a28b38b2f54cbb29e686b51b1612885d23cc8117543c8ac6636cc443e551806f6c08c09b88f2261971600f5161bd11998a5fb14f2761a2ddcac9881b1f324b653fe622e9a1002777704b2308dfb811ecd75b0df033689421cf5a1ce1626c9a2b12c749bff3260595636e16c82eddf4ae4cbc260c52170bf7a7a3c2738153746c41708cf05a841c943f6bca81976b24b50a2dd63320a5c553ac6430534d40ec5f8eec2f7751210de4a82cb27cc20158250237236876ce1332562c891621a747c1ca79aa08fa92c7d5ccc65009c0a5e3379c67ab88e3975d5592eb2645e9c04e41c07972c5976cb73033c245a6a8a3592747a3c1c1091608d9000a6229bd0d858b8828705cb87b90a7230b4141e1197f60d429ada0c4bd55134e8ac4091009e4124c11e2c61e435813464312243bf6c43fe9d878c0871ef5f1c17f9218b68578e3dab70377244b0998814a148be916727ba012e1a0493c5fe549c165aa2915f178d6552cc962ca429c6658ca5181511a7ba539698030851c949413320d4882bfc5a5fe093aaa894961f173a6e8c3cfd53332561452e5863195a87a56c070b8b4699a0548e62161829e4173890fc179cbd062b4c684c1367ac16103f42ba2a4ec5bbe4ca2cc31e1afd597be960a7592e4d42130a4dd92a327f60d150151ca128c538a0e58443943df80aa452d711319dfdf186971783f10d9a93d8783f035c821b16b572f001d0020443943df80aa452d711319dfdf186971783f10d9a93d8783f035c821","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1926,"b11cun030_00040012_13ee3d34":5089},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":21}],"recent_events":[{"timestamp":"2026-09-24T06:53:39","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"12520ecf-8618-40a5-af44-983ddcf8924d","seq":1,"duration_ms":101,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:53:39","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"58eb2e23-70e4-47e2-8ff1-f95ca28a946c","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-24T06:53:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1b1c8814-220b-4d3a-a3ea-53e2fc358e2b","seq":1,"duration_ms":101,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-24T06:53:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006q2CQJA","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006713243514a41","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a5f3b431-b215-44c7-bb64-278d5b4e2702","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"cbbef3410a12abd4","strings":["adminclient-5","q2CQJA"]}},{"timestamp":"2026-09-24T06:53:38","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1dac342f-c498-44d8-a914-8d47991b22c1","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-24T06:53:37","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"d20d3f7d-72be-4706-ba0d-ed9e9da6769b","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-24T06:53:37","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004pG�\u000b`2\u0002\u0001\u0003\u0004\u0017cn=jgzmaosuhkuagtrdsurj�\u0014jgzmaosuhkuagtrdsurj","payload_hex":"303a020470478e0b60320201030417636e3d6a677a6d616f7375686b7561677472647375726a80146a677a6d616f7375686b7561677472647375726a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e29f422b-607c-4a9a-8b7b-16020dabf99d","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"e223615018e8270a","strings":["cn=jgzmaosuhkuagtrdsurj","jgzmaosuhkuagtrdsurj"]}},{"timestamp":"2026-09-24T06:53:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"63a3ea3d-27a1-491f-baa5-4c8fa0411440","seq":1,"duration_ms":94,"bytes_in":189,"bytes_out":34},{"timestamp":"2026-09-24T06:53:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"454b757d-5fb6-41ea-9112-135e3aa9ab84","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-24T06:53:36","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"38484276-d23e-442e-b923-e20335188e52","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T09:59:35.235840+00:00"}