{"ip":"35.241.207.165","total_events":30,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["30 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,513 bytes sent","bytes_sent":1513,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T05:01:18","last_seen":"2026-09-30T07:01:59","events_24h":30,"events_7d":30,"geo":{"country_code":"BE","country_name":"Belgium","region":"Brussels Capital","city":"Brussels","lat":50.8534,"lon":4.347,"asn":396982,"org":"Google LLC"},"source_domain":"165.207.241.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":30}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i250900_b78ed14e2fd0_e7c285222651"],"tls_client_hello":"16030105c4010005c00303da485940e26998cbe3bf2b92246c30e9ec002ad0be340e85ec31dc692ba6f0d120d9c3eb683360655afd4897d7ec33e393f8add3749249b5b9cf91e9480da5c7890032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000545000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0aec761ff59030f06298861b127e63cdd52b72f41b5f020347cd12e87e19961386cd9634a0ac3105752755a21a74c7460697a11ac6b6a58cc03ab907f58b4653ba47b56796be2db532090124d1192b6472c3f487365b48bc50b2bfe684519a5c7f9ab63c4cb9d74c00ea53778fe9bce12b53065917f1dca5ff4437057971df4700ebb7a5a0f475ee5275598e619b8806bb3d99e42f50016d80e9c6953d0eb93ac00157108679a1b3b104ba4260852376b2a9de20e74f8c94c7cc8d4e5059e968432b8bf913a88332c29b3700381e11be6b983f6ca2592f3c8a5d5078d3885038c57be8260dd185eb84b57a0c91d1c51636376333ce5484612c4e034b07a3061735a74f6aa113accccd339b8114265fbd7bed80cb75f8b0839576f080801afe868d8703fbfd113495771f10c59ea6a58e9179bc1fb799ed3be942427a07b0f8e62010a4647ae31a4b3a77567b55b4de937e855ce6001a23c4a7d16b26e3650493588c16c7b2f5273cdba1314bdfb6cd01925c1d39aa2455bb116546f97461451223eb895f6506c5d698332b7c4fc82475af4293ddac8db151fc2d501a7fc8eed999ae2ea9f7ec53a90109e1fd3375cb603b0ba47c2ec244e3b19ea3a4c96b02ef254c6a12a7194315ecbe44f301b5a9e4a0a4292b15aa5304d840555e0a8460bc00a51296f99973a9b29f961b2ac772fa69bc53d886700178c1dc64c88317e4ffb4fa8e01eeca99b9f1a2e023873da6a23e1710640e8a6eca366f9255f8caa05ef35259cb8cc0f372b17b21f93403c7b619ddb92ab8ce09cca46ce710162da8ba5fa8c553cf95c58a0b797e0b88dbb720604a6d5b53eef54091c4a5b4562588ab3bd57d09ef2f06066b4518a7915d2f104c3d89216dc2d04156bb81769eca23e34bb65f006c895a008a817709ccc47839374c28b18cee97e47a7aac1f37aaf9a265bd09f0821ca8e96a1569cb415fb51d53866e0d63a874b0c9069c1466178322816ea6bad8a78ca49d993a9e8c59f08af132c1d91d6bf641c393fb3b1026900da0b3b3af42e42c41abf451e42a0290366a5a4606f3fe0068d2c1a4ac54d17fb2bcb158fe4e0898e56179c0ac6e4e656b9ea772692abf00b3a54d9400626a36ef091f807a490d29194135b329b9827e187f7284a19074d5c831ae3965691e26a6ad09a7056a80913c794c85665ab33a9537a6a08c0d34286a971573bb18e15ea3222ab61cbb17e5173ccaccb1cff5441945297ccf094874b855f76604f929b768517823b0b7a4a25bad82b372546e3e5419ff54f0e68b8740c64648635339c9e6399278f95b91030aa1d29bf7fe8028837ae5ef5a1eab385a7fc06d70ab23dfaa16eaa98df65525d863098b605e763444345379400634d2c7f4fc6ba5bb334bf107b577b9e8eb52d1cab433ff04a957763688b7d8aa3c61cfb5f6ca60f9566c1c91264e4ea64e28600bf307ba0eb8dbc380a9480003c473a14108d8c42390f4a8db140242d79c1fbd900fa965b310338998202fae389b218040b83b951bb38f41a09b01893a400cbaa870dbc4b88e7bc553ee2051b4943da5939c1b7c837810fd8a035ae962728921e9451473b05b72c28a51a3197b89cb46c5513ce811bd9d9c036f19e11ed9dad6d45da57bbf4f10a65172e3ca16d425e1058c4c610c07ac17c8d0de9caf78979d019c54af78718ea1283ed9eece7bc9a55da3148aa870f5f01001d00208d0de9caf78979d019c54af78718ea1283ed9eece7bc9a55da3148aa","tls_ja3":["9b72665518dedb3531426284fdec8237"],"http_akin":["b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"t13i250900_b78ed14e2fd0_e7c285222651":1928,"b11cun030_00040012_13ee3d34":5092},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":30}],"recent_events":[{"timestamp":"2026-09-30T07:01:59","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0011\u0000\u0004MQTT\u0003\u0002\u0000<\u0000\u0005AAAAA","payload_hex":"101100044d5154540302003c00054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"40bd0a51-a767-495a-9ad8-2dc7c2f0fd98","seq":1,"duration_ms":100,"bytes_in":19,"bytes_out":34,"enriched":{"digest":"d4b335fe12cd8784","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T07:01:59","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0010\u0012\u0000\u0004MQTT\u0005\u0002\u0000<\u0000\u0000\u0005AAAAA","payload_hex":"101200044d5154540502003c0000054141414141","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"084de5bc-3c66-401f-9f7b-5084af15c2f0","seq":1,"duration_ms":100,"bytes_in":20,"bytes_out":34,"enriched":{"digest":"03018dd9d8971729","label":"MQTT","strings":["MQTT","AAAAA"]}},{"timestamp":"2026-09-30T07:01:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000C\u0000\u0012\u0000\u0000\u001e3��\u0000\u001fconsumer-Offset Explorer 2.2-18\u0000\u0012apache-kafka-java\u00062.4.0\u0000","payload_hex":"00000043001200001e33f481001f636f6e73756d65722d4f6666736574204578706c6f72657220322e322d313800126170616368652d6b61666b612d6a61766106322e342e3000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"6a34153b-3fa7-4e4c-b100-f53e1cd0ca78","seq":1,"duration_ms":100,"bytes_in":71,"bytes_out":34,"enriched":{"digest":"5205d1d8e7086ced","strings":["consumer-Offset Explorer 2.2-18","apache-kafka-java","2.4.0"]}},{"timestamp":"2026-09-30T07:01:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000#\u0000\u0003\u0000\u0000\u001e3��\u0000\radminclient-5\u0000\u0000\u0000\u0001\u0000\u0006zFjjXg","payload_hex":"00000023000300001e33f481000d61646d696e636c69656e742d350000000100067a466a6a5867","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"0fb44fc0-8b3d-4d32-b1cc-b2f02b996118","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":34,"enriched":{"digest":"2b90ceb31f19b077","strings":["adminclient-5","zFjjXg"]}},{"timestamp":"2026-09-30T07:01:58","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"bd8405eb-fe2d-47f2-8cfb-4f8b4f23538b","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":34,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-30T07:01:57","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"Not a command \r\n","payload_hex":"4e6f74206120636f6d6d616e64200d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"955b8a68-8054-4ecb-b889-b9d435b7b8b0","seq":1,"duration_ms":192,"bytes_in":16,"bytes_out":34,"enriched":{"digest":"ba8182e82cf8725d","strings":["Not a command"]}},{"timestamp":"2026-09-30T07:01:57","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"0:\u0002\u0004xL(T`2\u0002\u0001\u0003\u0004\u0017cn=ahackynpbjxsgrmshhmj�\u0014ahackynpbjxsgrmshhmj","payload_hex":"303a0204784c285460320201030417636e3d616861636b796e70626a787367726d7368686d6a8014616861636b796e70626a787367726d7368686d6a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1a540834-f31b-4c06-927e-30b98cf6f3a7","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":34,"enriched":{"digest":"1ffbc39fe6980d34","strings":["xL(T`2","cn=ahackynpbjxsgrmshhmj","ahackynpbjxsgrmshhmj"]}},{"timestamp":"2026-09-30T07:01:56","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9b72665518dedb3531426284fdec8237","session":"2e5364ad-8643-4e89-aee4-c757acc2cef6","seq":1,"duration_ms":90,"bytes_in":190,"bytes_out":34},{"timestamp":"2026-09-30T07:01:56","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO example.com\r\n","payload_hex":"45484c4f206578616d706c652e636f6d0d0a","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"1da7c0dd-607f-4f7c-bd03-c2b90f4f2161","seq":1,"duration_ms":191,"bytes_in":18,"bytes_out":34,"enriched":{"digest":"cbacbcd31c19589f","label":"SMTP","strings":["EHLO example.com"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-09-30T07:01:56","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000f7badbe2000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"9b72665518dedb3531426284fdec8237","session":"b18e24ea-76d9-40c6-975c-b00437a2004e","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":34,"enriched":{"digest":"dc4c1983cd3d4350","strings":["00.0,","(NTLMSSP"]}}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T10:48:45.271025+00:00"}