{"ip":"104.28.213.96","total_events":649,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"649 events across 1 port(s)","confidence":"medium","network_type":"CDN","why":["649 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"44,132 bytes sent","bytes_sent":44132,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T00:21:41","last_seen":"2026-08-31T20:41:58","events_24h":28,"events_7d":249,"geo":{"country_code":"PY","country_name":"Paraguay","region":"Asuncion","city":"Asunción","lat":-25.2869,"lon":-57.6511,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":649}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":30},{"date":"2026-08-16","count":39},{"date":"2026-08-17","count":63},{"date":"2026-08-18","count":48},{"date":"2026-08-19","count":15},{"date":"2026-08-20","count":16},{"date":"2026-08-21","count":63},{"date":"2026-08-22","count":29},{"date":"2026-08-23","count":85},{"date":"2026-08-24","count":12},{"date":"2026-08-25","count":44},{"date":"2026-08-26","count":26},{"date":"2026-08-27","count":22},{"date":"2026-08-28","count":98},{"date":"2026-08-29","count":8},{"date":"2026-08-30","count":23},{"date":"2026-08-31","count":28}],"recent_events":[{"timestamp":"2026-08-31T20:41:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-���*�Q���D3\u0012","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8922abb51a09d92443312","method":"","user_agent":"","ja3":"","session":"f381775e-41d8-4e80-ac01-c4a6fbe75def","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"6d321d8b61776818","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T20:35:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-����oB\u0001�l]�l","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8e7ab6f4201be6c5dc46c","method":"","user_agent":"","ja3":"","session":"b6276012-da0a-4b23-b183-78e44497fec3","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e720064632cd3ce2","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T20:30:51","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-����L�$\u000f���W","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8c2f24cce240fa090b657","method":"","user_agent":"","ja3":"","session":"ec468cb8-2a3e-4181-85ad-a13698093fc8","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"9009ebc3880666c4","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T20:22:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-���h��^�v\u0019��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8c668a1ad5e8f7619f3bc","method":"","user_agent":"","ja3":"","session":"b87dee30-3eb2-4b18-a3c4-ee4956fe153f","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"3b1775cef6696ba9","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T20:12:09","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��\u001a\u000f\u000f�)Y����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b81a0f0fbb2959f48acef2","method":"","user_agent":"","ja3":"","session":"2ea13ddd-9705-4c8e-88cd-5a331afb550e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b9e893c537500982","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T20:10:17","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��W�\u0011\u0002�{�lg\f","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b857fd1102f97b976c670c","method":"","user_agent":"","ja3":"","session":"d49bf5ef-cb98-4fae-9f3c-7ebabebdb827","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c93a558bd6bc8489","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T16:55:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��\u001a0��\u0015L����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b81a30e6c7154ca394e6b0","method":"","user_agent":"","ja3":"","session":"90df594b-7a8f-4229-9041-9e9df714ce01","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"6bd1a31d45309c26","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T16:49:49","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��ťw˂(e\u001e��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8c5a577cb8228651ee2fb","method":"","user_agent":"","ja3":"","session":"32c681ba-76a6-4bd9-8566-3848ab9e6642","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"65138ecb5304a66c","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T16:48:49","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-����\u0019��\r���}","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8e2ab19a7f10deeb2dc7d","method":"","user_agent":"","ja3":"","session":"8555aeaf-8a2e-44a3-910a-9dfc66bde6ac","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"363732034cbaff24","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-31T16:39:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-�����I�b\u0012��\u0011","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8ccfda549a06212f4c211","method":"","user_agent":"","ja3":"","session":"a5b8c5e0-97fe-4d1b-9e55-51f4432e52f9","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"7f0e2ea4df2acf3f","strings":["BitTorrent protocol","<-UT360W-"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-31T23:16:47.686757+00:00"}