{"ip":"34.62.172.222","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"504 bytes sent","bytes_sent":504,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T08:54:57","last_seen":"2026-09-23T08:55:00","events_24h":0,"events_7d":0,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"222.172.62.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c0030315fe8015a1dee18e10c4d1a8c84faf3daed43ece95d30e25412df062b7532f4520ea7bc62c54a7378dd0505235f301fc34668c80970e2b4891022c6a3eb5de5cb60032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0781661a8553b03d8cfa111c5681344598522bb245ce138282b2155fd4604dae85016e8c675d05d6897181bb16102e6be510a297ae746804677e2a6134d2bc06524438645826c8c465dd97d1f977654c27e94283e4ed464031baf93475d497a705fd47f595a636a3a434becb2c34a19986b4a5d733e2aa08861e37e6bd8a8191415edd419fa552f286013f38cbca30aa8b77408b0bba9851615147593680a30ad091166e070a5068ba9c379d4259c904747b8122d0e3a99fe5671eea16f1de0330e5c2fab58a295b854310a6a389b05d3158da1dc973868c8c7356253e8965151ce46741f7e29640fa7bebb72874e55c53fdb5e19a72601e0aaf100b4a51c8007e94a77b9b5a2f25dc741c5b3b02ae0d5116c6accdeec8a49b2377fc82e92aac057208d1f811ac2d94ea71865b7f5928648724c847756e2ab2208ac3cccad53022fd3e86f40b0a84e8c42f8c12af7313b392c5b386698ad2812acc6741ea7728045bca346c7a09a360be8b93da64ba5113cefe33b0a5c8288b824d34c147ab01864e1168e3408d8e64330726792497b6452c18b041b42c1624a7a7d805047ecd5830fa013f9f5563c6c12326638e7899ef4e5ab09d594a8235c8d7723c00a42e0cb37cc9a1a3c12a5ca471b49b364c8e45d11f9b52bc4cec0fb14af01736aa6cb57d996c225c3c1b68c9da5a6a849a4302b64e8e548966979f21c28388106c95ab8383589202cbeca9688aa326d7840ae7b95cd4563cf1c117504723485b579d06000bdda5e1422a29742af19dc222116a9f0aa1d571c0ec20188536c9976cc25748c0d87c1602558a20091a5ca023813a776564738e30036e1b47e10e6927ea96158b69924f62b4a8764b8386f36968612030b04e3712ca761fbfc57e7d91acf489b52913e4a315cf5e64824119e216703974c4b1e46ab96c02b655401dcf157d47293645c5000686839b9a1d1f9290fb3344c3590b355b3ed4944fa270d9bc63938e908e5f04c92135568f8543997b26500a70a4427f39b490d429e147b77102a0ba986cf59273ae5e404cbb6b2495a9114370e6b707151510ef4a40488604ca352baa8457ae8505e39849b7cc60ab4aa2e28abbfcec95aa4120548702a0c780f358c026224b2c6b80591381b0d3a0c3256b1a7632bbeb829a96b0f0825cb2a94563385ac3dc8c73df9995e7a60f65a7ee52a08dbe4a5aea94ad4a917b020cb248a02c53a957c96559f8756abc0ab873cbb68529aa83204bb20c6b2eba29d5138e3f134c0716604977f3690bfe690021ac30e8a49ab714799943113388c5a13c353f3542c1ca1bce990b75fa4c9bda27a3cdb1cf88657b75aa127865a63f5b361788a3325b81b5b1080f43ab8942642b99652a8b1615419a5010a6ecc96bc24a522f1824f75a7a63b014c5b2c26d4cbd1da335773821879cd6a844aba9a578bea0bd5292574fc2ce6402884650dea0c064eca4c49838e77f97dcf7a8d63a12d22b50c527cc8b347b07608af9e32a34d623355d657c391cfbb0c03d60a2cbc191c8f749acd3033e67300c1162919b9666d489f77a234df17c6a5ccaae570287eda7c6e978f511a892d712172c68520b404e4652be9805cdf53062eb08e9b7b403425daff6740475a8f439c9bdc9e313f44e9c48c295ed89698cdc4876151e8cd899da1b61ab1188960ee85eb5da3c57ee8d2447bfe32963c569eb43626cb173f001d0020899da1b61ab1188960ee85eb5da3c57ee8d2447bfe32963c569eb436","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1928,"b11cun030_00040012_13ee3d34":5092},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-23","count":10}],"recent_events":[{"timestamp":"2026-09-23T08:55:00","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b735d6ff-5f7f-4419-bdfb-a8554b7156da","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T08:55:00","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b54afa1f-bab9-4910-ba2f-1766b44e4273","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-23T08:54:59","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"7d4c2d4f-6df5-4a1c-906a-d71405598e9a","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-23T08:54:59","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006yb6970","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006796236393730","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b84ca7cc-c0ef-4462-9081-8ea4f4715309","seq":1,"duration_ms":101,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"0035223ff91a1dd2","strings":["adminclient-5","yb6970"]}},{"timestamp":"2026-09-23T08:54:59","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"e5acfbbb-ebf1-463e-aedf-bea46343bebc","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-23T08:54:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a7b18ac7-05d9-4010-add1-d9894fd08d67","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}},{"timestamp":"2026-09-23T08:54:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"99f62ae2-934f-489f-81f0-a35a6d7a69dd","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-23T08:54:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u00043\u001c��`2\u0002\u0001\u0003\u0004\u0017cn=sowxqqcycbiqschstpfu�\u0014sowxqqcycbiqschstpfu","payload_hex":"303a0204331c8fb560320201030417636e3d736f7778717163796362697173636873747066758014736f777871716379636269717363687374706675","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"a7445249-91a6-4168-911f-9cf4bdf83ddc","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"a14d6dc76bb8f62e","strings":["cn=sowxqqcycbiqschstpfu","sowxqqcycbiqschstpfu"]}},{"timestamp":"2026-09-23T08:54:57","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"a6d8a5d0-cfe2-4220-9070-a70d9d2db6cf","seq":1,"duration_ms":95,"bytes_in":190,"bytes_out":34},{"timestamp":"2026-09-23T08:54:57","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"28cad51d-bc08-446b-ba16-5073f7c5e046","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T10:48:57.940400+00:00"}