{"ip":"35.205.166.228","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,007 bytes sent","bytes_sent":1007,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T04:14:09","last_seen":"2026-09-28T06:42:22","events_24h":0,"events_7d":20,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"228.166.205.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c003030ad29f38692cc56dff6238e4c1a6636614336ddea270c0c3e4d6499d4193830820b43b1642748a02fa64540c124b067f4d99d9f527f943e08a703ba3cb7b72d8a50032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0d31c8e7b81541435b81cdac281f8ccaea76e8ed314159493d2a756a0fa35e0ac87df32be393cc1d47703eab3079b299eac070d737c6a9299a6691c06ad4a6600948332001843bb6f9a29adeb1c8d8111676e461e2fe55d6882851f8055bc8c959d518d0a5b3078922c92481f656164b0fc47c87a934ab4a5f2987c1497730868c9b11526fd46bb8628ae4c273335166ba81680cdf930d8c024a634376e74afde51399796511bb27e2528b04e462dd0b62e551054de728495d8a1e225ac0f84a9e4e6c882f5288d59a15ecc1f99577eecf018d4d82fed6aa12f7a1030eca4baf257c1b0592d778770aa3a2925c31a7c13be8c367f08754a5cc16ac2883fc3437a99aee7db62e78177a99c9438a3220d98bfaf359d49529fe3b31379528d0040aaa7770b9f9420c697a41f9805cdf87ed2675aac001318698672480330a26e13602c9e41c91be2c37b406a8905c2807266b76213ebe34c08037746f36fc3587e46540d81b03f979383a2bb49a123a9337a3de04223f6c2c576ac5af5850e91683f70e17928920e96c6810b9079f9009f2b372cb314b1ecb44287d6059b72054d2763d2a50a353893ad5a54044aa1c3c898d257c257c94b3f4a4b26e95036a4c636c7c1237b67f3642c1a5609e3ab4df85a8951f356d0b33964a94ec81757439bb98d001ba6a2b3ddd0823f572d5b326bff8b06c4c56ef1937a7781589dea3dc229ba1a773d25a039af5c0bc143b2f943b85c5550d2071079a44b98d919d05072c7c0662b86ce3c7915a64173d76a2b8b827e363a568aeb948002bf344c11472bcc2af421c0d092827c12b18c4f9fc48f5bc55e702516e16b904aa39d5453281a369f379683a6e1557ca3bbed6a585d608f6a7079f5b9246a224278c02c2e0a68b2543c13955be61285d4644dd073278aba4417e8790a196425e41a39b0192a277d816a290330509d718a7a461fdbe456c1a79c9719bdfdbb89ce7617bef3bfaf18c229624a9f088c72f05f32975beb65705e607b869c1fb1a9cf74129f1ca53c73ac2714f39c17ca427a8ab0ef27b38f6141e3e92dd0dc3369e600d3353315c375ac9c560a1c81dd6243692976d4e717620607534bb0e4fa1afab07acb8ac4e8509585d37cc159499d9c55d11746e7c6217a62cd0be77b03e8a91266ae219432fa02bd3097601c871bda98a34f1024ef05cce652b4e23c0dddeb6c7a801b5f365af42cb5150c40bc722153b0b560d793a57694fc52527b67964a23c85ff460a3e1108356041fb89aac788f668b3deb047f5907235a42afaffa74418ca6628b316848102ab64a29160d3836006ba706e3936a4bbc52dfc88696450868825b836972e8155249b0262fdc8ca6401c3e0ba4d789ad9bf30955d7b82aa4288c2c943afbbdad312c4c563c68759c65f2c76e678bdcfa23de81bf94918236e105a6a83f1ee750ecb7306b431b990b8ae3fa2476b4c6f0654d29480a24f2994784039d6aca4da441cbcb7efd93ab0166668ac95d3c4117fb4599de5435942513cf830dd2c33171653a56fa66d02866b580b525043c0db15026bc3414e588cfab9a102ab88fa474ea121c519877f9e23993e937150a443677c322e5876dc096c239cb1f91a7b6c7add4e58d914f90b54eee0bd585b17e36035967f8151710531b01cfa50c0e023c8d9e185c3c3db8a10ebeed0dca046e0fbecb8f13541f1b7abcfc9da03468001d0020023c8d9e185c3c3db8a10ebeed0dca046e0fbecb8f13541f1b7abcfc","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1976,"b11cun030_00040012_13ee3d34":5076},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-28","count":20}],"recent_events":[{"timestamp":"2026-09-28T06:42:22","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"df42e668-79a6-4edd-b333-06540ac04b1a","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T06:42:22","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"dbea5f87-63da-4bec-9eac-fa986b8f3a9b","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-28T06:42:21","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cd693d8a-2d64-4e39-8a0e-2f538770e153","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-28T06:42:21","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006BVfdUI","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d35000000010006425666645549","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"f230f43b-98d5-4826-b90f-7198f2de90da","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"b922ba75292f12fd","strings":["adminclient-5","BVfdUI"]}},{"timestamp":"2026-09-28T06:42:21","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1d0640b6-f7c0-4836-89bf-4895367716cc","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-28T06:42:20","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"cb217ed9-9b98-49d1-bd05-a687c9c1330b","seq":1,"duration_ms":195,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-28T06:42:20","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004Aߪ9`2\u0002\u0001\u0003\u0004\u0017cn=hkbfjmtzrzntizcqxicb�\u0014hkbfjmtzrzntizcqxicb","payload_hex":"303a020441dfaa3960320201030417636e3d686b62666a6d747a727a6e74697a6371786963628014686b62666a6d747a727a6e74697a637178696362","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"9dbe7fd5-4617-4fc2-a017-42b6a72eac9b","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"a838ff3d119756c6","strings":["cn=hkbfjmtzrzntizcqxicb","hkbfjmtzrzntizcqxicb"]}},{"timestamp":"2026-09-28T06:42:19","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"ced60b6c-6721-424b-a67d-9758c376b1ed","seq":1,"duration_ms":94,"bytes_in":189,"bytes_out":34},{"timestamp":"2026-09-28T06:42:19","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"74d05a08-64c7-4b41-bdf2-860d3fd1d571","seq":1,"duration_ms":195,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-28T06:42:19","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"2a492d13-4587-4bf2-9807-b6b844f90eb5","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-01T11:49:50.087208+00:00"}