{"ip":"34.77.191.221","data_as_of":"2026-10-23T04:03:58+00:00","observed":true,"total_events":87,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["1 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 87 event(s) from this address as well.","Not in any known-scanner range.","Sent 19,954 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,954 bytes sent","bytes_sent":19954,"session_seconds":30,"persistent":false},"basis":"interactive"},"first_seen":"2026-09-25T09:35:08","last_seen":"2026-10-21T18:11:14","events_24h":0,"events_7d":28,"interactive_sessions":60,"interactive_sessions_24h":0,"interactive_sessions_7d":57,"interactive_protocols":[{"protocol":"sunrpc","sessions":32},{"protocol":"http","sessions":21},{"protocol":"ftp","sessions":2},{"protocol":"smb","sessions":1}],"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"221.191.77.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":62,"first_seen":"2026-10-16T02:55:16","last_seen":"2026-10-21T18:11:14","verdicts":[{"verdict":"scan","sessions":57},{"verdict":"unknown","sessions":3},{"verdict":"credential","sessions":2}],"personas":[{"persona":"nfs@nfs-kernel-server 1.3.4","sessions":34},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":12},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":9},{"persona":"ftp@3.0.3","sessions":2},{"persona":"smb@Windows Server 2019","sessions":1}],"services":[{"protocol":"sunrpc","port":2049,"sessions":16},{"protocol":"sunrpc","port":20048,"sessions":10},{"protocol":"sunrpc","port":111,"sessions":6},{"protocol":"ftp","port":21,"sessions":2},{"protocol":"portmap","port":111,"sessions":2},{"protocol":"http","port":8453,"sessions":1},{"protocol":"http","port":4042,"sessions":1},{"protocol":"http","port":23023,"sessions":1},{"protocol":"http","port":12296,"sessions":1},{"protocol":"http","port":12360,"sessions":1},{"protocol":"http","port":8403,"sessions":1},{"protocol":"smb","port":445,"sessions":1}],"logins":[{"username":"anonymous","password":"anonymous@","password_sent":true,"service":"ftp-login","outcome":"success","tries":1,"last_seen":"2026-10-16T02:55:16"}],"commands":[],"downloads":[],"files":[{"sha256":"63cb366ca57ae1a1315e9bc1a7644cafba7df3ba5d335f91f808278994eb704d","name":"listing","size":266,"mime_type":"text/plain","kind":"ftp-listing","times":1,"first_seen":"2026-10-16T02:55:16","last_seen":"2026-10-16T02:55:16","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":57},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":6},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":2049,"proto":"tcp","label":"NFS","count":4,"sessions":16},{"port":20048,"proto":"tcp","label":"SUNRPC","count":0,"sessions":10},{"port":111,"proto":"tcp","label":"RPC","count":0,"sessions":6},{"port":445,"proto":"tcp","label":"SMB","count":4,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":4,"sessions":0},{"port":27017,"proto":"tcp","label":"MongoDB","count":2,"sessions":0},{"port":5432,"proto":"tcp","label":"Postgres","count":2,"sessions":0},{"port":60010,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9200,"proto":"tcp","label":"Elastic","count":2,"sessions":0},{"port":21025,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4782,"proto":"tcp","label":"","count":2,"sessions":0},{"port":21,"proto":"tcp","label":"FTP","count":0,"sessions":2},{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":0},{"port":57783,"proto":"tcp","label":"","count":1,"sessions":0},{"port":30113,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3612h1_bcee18a5b459_8537cf56674e"],"tls_client_hello":"16030106130100060f03039c1bb4087a6cb3df43810b0dfa087a3b99bf7b90c61f27b0f55737f12dea3825204c8803a9e2cfa2bbe4a929937fb9e4a3942cb79aae8ee4f55bb6d865fc5d3bc80048130213031301c02cc030c02bc02fcca9cca8009f009eccaac0adc0acc024c028c023c027c00ac014c009c013c09fc09e006b006700390033009d009cc09dc09c003d003c0035002f0100057eff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000b000908687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0301866e772956dd0955a0498bbe727912a11f157235b10517f8cba45a057dc365e7d7458ce03aec0c12caebab0b8f1405bb29bd4cb9753150552551374c0818439a412f706960030b6e9511ca34992c3769961a3fff02f13255e4c6cb5ae61141f11b2fa5b03b1895bab9652b48c99432a98e2e48ee466b3b9d36d12b698c1e1ad599a638466b2f4793a7025405883a6b0fcb276b567afe01ef3c324031a3ef22c4de03292419587e45615d4c037c1f8cf21111ad357c24a3727b36c89f384c8ffa1062e79a059870db5d29516c570da36b59caacde7066a4b07580f9c5596492b7f016282390b9c2b2436634a2826141519b674fa519313ae5edc82628562daa2329668a539d89a196c083fd831a8d585bb6a23d1647f7aa60510568af5cbc44698b1fae06f7f846b57f48a3dec61cf6c2f37ac19d41c55f6da8b98c915af78942a33673a8504030105f29336f64bc79e481dee16141f138339540f74b0c75f288d92c8947a67ae458b4de06200d1a3a0ad6147963b4acdca5487e1210aec57cba48fcd684a5ddb4e3548017ae70477d09d41b158a5b33b2997c14492314c0a56687cc1356a95b028bd9504a99550606c3953b271334487182c52776c1965935b1020c4a16e21cec151abe26a370bb571f3274317e6b262c8cfa8f64197b5554e6b1c087981cb3007dcc8bb759377d68b6bccc1c58e799da7c3ac0facc2e9636229a230e8dabc214033163a682adc95594cadfa0368077921a9cc45ee8828e5e67072b00c7bac6d8087645a53cad40647d07692f02608c6966cfd555d9a3a263ee91c14d399c84639a4aaa8e4d6cce44487b6a15ca9c72f5291cc7b6b6b9748c5cfdb873c88436a2c4a98cc8d09513bda024204910e5de68341eb89c6bc9181378c1ac17107b80c8494c562c74b352b9fc6cba3ea740d2483ab06e2b0d3faa23f37c6d15473b8882f1ac18698b796a28ab8a545405ba16274597910225ce6504d31926a0388c82d1b18c56515fa1ac6b7bb128ee9023ca5ca31a53dedb0b1eefb8c82a712814a3625828ccafc94e77b4445f96fb45646a477a87cbab0c43a9bd754a53869ba979366e98c250aac12b610c2de2912cdc9bdaf3b24151370d7d6c45d90c5b0d092e975153bf69beef6290ca630cb576663d1a9cddba29d0011f89599a4a948a4db4a7fc61d0c254cad8b86a7eb14a3d219c4e79c3c05268c718f35831a0aab4ccbfc3786e54aac34c93480803a0216ed64c04307650fa65e3ef614a8853a90173d5c890d3dc28722d301f4fa0431fc1f41f45e699859c0806642a07fed78bca40735b10a6d2a212f1edc35831a988b831936baaa40107d2ae98033e09b1c9cba55d88ee847459603504b942e34faaf76b79faa6073664b7cb1a53462aba68d560148801ba6dc1bfaa73952cb10e3a4c7b0c53d9ac82e2e55cbb535a874065093c9c26e34b924d4636f32abf9517c4623a802e610fc5281ec264fa0203ae7764df5d71f1db22165975199239a448595ae16a61278c67c891af39025ab22ae80e9b5934079be95ce24c96bf726b625d871f4a63a21f676c4694a67149b47c85a6dd88a504c574088705b01bf20c77cafea2d18fbc6bfa974a340084e4d6138b89f655b428fcafed48c5f44a771b8528e5d635b53fea89debbbb9506385cc9c48768726faacdef92d57c76ecf15b1f54b288c221e7cb6af5c5c5100001d0020a3406c0f7b3872b54cc96b97dba7be31ce8ba8bee544e1e864490b89cd58c823001b000504000100","tls_ja3":["d18b223ce817c861b7829130500395c2"],"http_akin":["b11cun050_00040017_976354f0","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i3612h1_bcee18a5b459_8537cf56674e":309,"b11cun050_00040017_976354f0":1238,"b11cun030_00040014_54d07b6d":3797},"akin_families":{"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1237},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":3,"ips":3797}},"user_agents":["python-requests/2.34.2","Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0"],"timeline":[{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-27","count":9,"sessions":0},{"date":"2026-09-29","count":2,"sessions":0},{"date":"2026-10-01","count":1,"sessions":0},{"date":"2026-10-02","count":4,"sessions":0},{"date":"2026-10-03","count":3,"sessions":0},{"date":"2026-10-04","count":14,"sessions":0},{"date":"2026-10-05","count":11,"sessions":0},{"date":"2026-10-09","count":9,"sessions":0},{"date":"2026-10-10","count":4,"sessions":0},{"date":"2026-10-16","count":0,"sessions":3},{"date":"2026-10-18","count":0,"sessions":1},{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-21","count":28,"sessions":55}],"recent_events":[{"timestamp":"2026-10-21T18:11:14","port":23023,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:23023\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a32333032330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"8876594e-0f34-4feb-83a7-73cbf967fba5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T18:09:36","port":55299,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:55299\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35353239390d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"473f99ea-0fb9-43a4-a0f8-494857dec180","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-10-21T17:47:40","port":10217,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:10217\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303231370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"7c196349-fb94-4c84-ad1b-18fc7c5215dd","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":78},{"timestamp":"2026-10-21T17:45:02","port":9658,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9658\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393635380d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"cca0bd33-2ec3-4015-9794-0c21afe08a7e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:43:51","port":2049,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0003�B`\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0005M�I\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028038d42600000000000000002000186a3054d88490000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"bc66cea1-b228-4461-93b8-daa6349da573","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":13},{"timestamp":"2026-10-21T17:38:21","port":4042,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:4042\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a343034320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"2fa362ae-0d4a-4126-b4f7-304fe2ad31c9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:35:59","port":21025,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:21025\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313032350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"4b8843ca-6d05-4f77-86ee-2e7f0dad9f1c","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":78},{"timestamp":"2026-10-21T17:35:49","port":21025,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:21025\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313032350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"293b1328-f52d-4248-a99c-323bb2950947","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":78},{"timestamp":"2026-10-21T17:22:27","port":45333,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:45333\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a34353333330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"9af12852-ec48-4cff-93fd-26640e1861a8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:19:58","port":52536,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:52536\",\"user-agent\":\"python-requests/2.34.2\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35323533360d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33342e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.34.2","ja3":"","session":"a50185c9-c7b1-4ecd-8aa3-dea1b532510d","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":78}],"http_methods":[{"method":"GET","count":93}],"distinct_ports_total":100,"top_paths":[{"path":"/","count":93,"ports":65}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:23023","notable":false},{"name":"User-Agent","value":"python-requests/2.34.2","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":6}]}