{"ip":"121.202.7.202","observed":true,"total_events":313,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["313 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 66,574 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"66,574 bytes sent","bytes_sent":66574,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-16T16:43:31","last_seen":"2026-10-17T04:49:54","events_24h":313,"events_7d":313,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":17924,"org":"SmarTone Mobile Communications Ltd"},"source_domain":"m121-202-7-202.smartone.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as17924","label":"SmarTone Mobile Communications","category":"isp","url":"https://www.peeringdb.com/asn/17924"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":16663,"events":2}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-16T16:42:48","last_seen":"2026-10-16T16:43:10","recent":[{"timestamp":"2026-10-16T16:43:10","port":16663,"src_port":59279,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000\u001fd�C.S\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"41001f64d7432e530000000000000000c5fa0000","sni":"","session":"88964cb0-5dae-458e-99ce-b1e893cf0207","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-16T16:42:48","port":16663,"src_port":59279,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:b��9��E��$u��@Z���\u000b�9:info_hash20:b��%M� \u0017fi3�2`Q�D2\u0014�e1:q9:get_peers1:t2:��1:v4:LT\u0001/1:y1:qe","payload_hex":"64313a6164323a696432303a62be843998a145e0972475cdf3405af5918c0bfc393a696e666f5f6861736832303a62be83254daf2017666933be326051a8443214cc65313a71393a6765745f7065657273313a74323aa596313a76343a4c54012f313a79313a7165","sni":"","session":"484b454e-10fd-4b5d-8f80-b2228790c155","bytes_in":104,"source_verified":false,"enriched":{"digest":"3505632bd8552b45","strings":["d1:ad2:id20:b","9:info_hash20:b","e1:q9:get_peers1:t2:","1:v4:LT","/1:y1:qe"]}}]},"interaction":null,"top_ports":[{"port":16663,"proto":"tcp","label":"","count":313}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":203},{"date":"2026-10-17","count":110}],"recent_events":[{"timestamp":"2026-10-17T04:49:54","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-qB5020-3UBS2p9Yg!iZ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d7142353032302d33554253327039596721695a","method":"","user_agent":"","ja3":"","session":"cebeaac2-ed58-4092-ac31-ada472b91549","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c6029cf7c673ce31","strings":["BitTorrent protocol","*-qB5020-3UBS2p9Yg!iZ"]}},{"timestamp":"2026-10-17T04:47:32","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"%p���[\u001d\t��xn\b��s��|\u0011א0mG\u0015�kQ\r�e�7*]�5��\u001d~�6i���\u0015éϝ�\tT\r!\u0002\u0012��N+Mu��ҳF��\t�Χ�-��wB����ye�B,�N�\u001c�|\u0003�!ށ�%_˄(\\�\u0013\n\u0002-\r&���-�\u000b�.H�mX��N��\u000e8�ۋ/���]\u001a\u001a\u0016��C����9�3��\u001e1ռ��{a��~i���=��\u0019�\bA��vQzw��R�kݻ�our��C.�]�h٭l�\u0000֘�\u000bt�ps\u0012�&�g\u0016����[Iϻ�\u000b�\u0004t��Ϫ�(w� ׫(!��j��$6\u0013{�\u0005nZ�\u0005��Q�����[��P\u0018G5�J���%���\t<ӭS�O�}1��Ε��.\u0013���aD^o\u0005�\r����߮�޲�\u000b�~\u001c�kS�s\u0013{�?��\u0016�ߖt��\nL�Q���\u0001��V<\u000e�I2��}]��$\u0000m�3��rR�8�YIo\u0013\u0006�:���\u00148SR\u0012Q�S��������`��K\u0018ni$���ɂZ:I@�U�s��[�Юsj�>��AK�*�|�*��\t5:��CL$������9���=�#2䲵,]\f�\u0013�c6\u0018\r��L��\u0002��'�\u00000\u000f\u0013U06��C�P\u001f\"�v\u0006[).�\u0004��\u0018��\u001e\u001f���6�$��`x\u000b�>)P\u0005R\u0018�\u0018�5~(���U�\u0017zT2@M4�������F���׳�\r��e�6\b\u000elrӜo+z7�\u0006","payload_hex":"2570a6e3985b1d099e8f786e08daf073c1827c11d790306d4715b36b510d9f6587372a5de9359bdd1d7e913669ab91d315c3a9cf9da109540d210212b4b34e2b4d75c08ad2b346f29a098bcea7bf2d8ca87742abbdb5c37965cc422c8b4eb71cfd7c03f921de81eb255fcb84285ca8130a022d0d26bd9f972d8d0bcb2e48836d5888924eeda60e388ddb8b2fb6f9885d1a1a1682bc43e1ded6d839ca33b4d61e31d5bca9e77b61e2e87e69a7d9c03d8ba519d6084196ec76517a77fcc352866bddbbc16f7572eae7432ef55dbc68d9ad6c9b00d698f30b748f707312a7268d6716f783bcf65b49cfbbe30bfd0474f6d4cfaa8528779620d7ab2821d4e56accf12436137bf4056e5ada05a4c7518d96ceea955bd0c750184735924ab3f0bd25dde2a8093cd3ad53e44fa07d318cfcce95f5922e13a999a161445e6f05dd0dfc8e9fa2dfaeccdeb2ce0bd27e1cd36b53f973137bfc3f8fd9169adf9674a3c30a4cfd5194a3a401c9fa563c0eb74932e0df7d5df2af24006d8033faae72528a38d459496f1306853afc97b31438535212518a53ebd5e9d3e47ff1af9d6089c14b186e692493fa8fc9825a3a4940e7558c73cdfa5b82d0ae736ae13e9b8d414b882ab87c8b2a879109353aaee5434c2485ba83c1879f39ab949e3d9a2332e4b2b52c5d0cdd13af6336180da4e04c80ed028a8d27ed00300f13553036c1c74385501f229b76065b292efe049ba21886e21e1fa0f08736ff2485c160780bf33e2950055218fb18c9357e2894fad955cd177a5432404d349bdee6d6f2ddce46dee0d8d7b3a60de4f465f436080e6c72d39c6f2b7a37b406","method":"","user_agent":"","ja3":"","session":"2d403d4d-f8a6-4bd0-ac80-00968109b516","seq":1,"duration_ms":100,"bytes_in":596,"bytes_out":13,"enriched":{"digest":"f9d23c963defb144","strings":["N+Mu","vQzw","aD^o","Z:I@","zT2@M4","o+z7"]}},{"timestamp":"2026-10-17T04:44:59","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-qB5020-9_grCOhQDFT(","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d7142353032302d395f6772434f685144465428","method":"","user_agent":"","ja3":"","session":"f83a869e-5e19-4116-af01-a19b6ac2fffe","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"5327b1960d446739","strings":["BitTorrent protocol","*-qB5020-9_grCOhQDFT("]}},{"timestamp":"2026-10-17T04:42:11","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"P0M�ՙl|\u0016`d�@��q��H>r��\u001b��o�\u0005��g�\u0014\u0003��S&�\u0002)���ͣ��A�mqr6��Q@�\u0003���!X]�I�\u0003z�XI\r�g<�{n�I.�\\���[Q\u0019�����N����\n�6\u0019’4�3\u001e�Q3uesa�d!H-F\u001f���\u00020�\u0012f��\u0006�-\f'\t���\u000e\u0001\b�=����8T�%\u000b�\u0003\u000eAQ��U��(IU�~1���W��\u0015�8x\u0012yG�o{Vz���=�|$~\u001d\u0017ʦ\u0013-�@g�?�����\u0007Ŋ���0��\u0012-\u0011�\u001c��A�a���A�&���vk��(�\u0000\u0007(����c���{[��\u0017Fta�&�IhXB>����\u001b\u0004���7��4�\u001c�hu�����Jꦲ���˺�ࣖߑ\u001a>Dz�i�'C�Q�o�C8z ~\u0011l�k���F`P������C�7ju���\u0000q��\u0016��c\u0005��s�s��Eߡp\u0006ҿ","payload_hex":"50304dddd5996c7c166064c940d9e071b78c483e72bcfb1bb4ee6fd905c9d167a61403daef5326c7022995d6decda399f241aa6d717236cedf5140c9039bb8a821585db849f3037a9358490d95673cb77b6efd492ee55cbdffaa5b5119a680f392a54ef299d8d90ad53619c2923488331e8f513375657361ce6421482d461fb2aded0230d71266a1c906e62d0c2709f7edae0e0108b33de1c0fa893854cd250bf2030e41518dfe55f8c8284955b07e31ed98e257d8c415a03878127947ce6f7b567a80bedb3d967c247e1d17caa6132db04067d53ffdaaa8ea9307c58ac1e4fd308c94122d11eb1cb8fb41f861aeeef341c326b88bb2766ba1a928ed7f000728b8e5c8c26392e2d77b5b95b517467461f626ae496858423eb494cbc01b04a4ece6377fdae97f34c71c9c68758ab08eae7fe64aeaa6b2fbf4d1cbbaaee0a396df911a3ec7b2f669ed2743ef51ae6f8a43387a207e116ce76bfadaf0466050a58afbd8d3e543f9376a7594ea8f0071f6c716acb26305eebb73e373a5d245dfa17006d2bf","method":"","user_agent":"","ja3":"","session":"a479c6bc-624e-4eb5-97c3-cdc6c07fd476","seq":1,"duration_ms":100,"bytes_in":387,"bytes_out":13,"enriched":{"digest":"b194bb1ea961fd51","strings":["mqr6","Q3uesa","d!H-F","o{Vz","IhXB>","C8z ~"]}},{"timestamp":"2026-10-17T04:39:17","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-qB5020-OJ!XXSy2E31q","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d7142353032302d4f4a21585853793245333171","method":"","user_agent":"","ja3":"","session":"45dca6f2-6b6d-41be-8b7f-69a7f203ad6d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c228c788eb5e8ff1","strings":["BitTorrent protocol","*-qB5020-OJ!XXSy2E31q"]}},{"timestamp":"2026-10-17T04:36:22","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�+\u001e�\u001f+�-(|�Q�ֺ���\u000b���_�U�͂2��\u0005��\f咒IO�:���TV6Y� \b8��j1\\o~0�2��Q߽��#\u0004ۏ�C��\u000f!�l\u000e4\u000e�f�\u001a�l�4���w��c\u0018\u0010\u0012&","payload_hex":"be2b1e901f2ba92d287ced51cfd6ba8eb9b00bbfe1db5fb555aecd8232dbd50593940ce59292494ffc3ac3f6c35456365992200838a7966a315c6f7e30fb32ffc551dfbd98812304db8f90438bd00f21906c0e340e7fdc66f51a8c6ca334c6d1da77abf06318101226","method":"","user_agent":"","ja3":"","session":"d6612b3a-efff-4650-9c3d-3e504b5223b0","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":13,"enriched":{"digest":"cf823055949690e7","strings":["TV6Y","j1\\o~0"]}},{"timestamp":"2026-10-17T04:33:41","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-qB5020-zytmubth02OY","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d7142353032302d7a79746d7562746830324f59","method":"","user_agent":"","ja3":"","session":"407f2652-450c-4704-b778-a43f509a43ed","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e2af798563cd99b4","strings":["BitTorrent protocol","*-qB5020-zytmubth02OY"]}},{"timestamp":"2026-10-17T04:30:33","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�7gl�W��n��K�\t]�\u001c\u0006Zo�\u0019^��\u0012Z��\u000b\u0012@E\u0013�T��\fѓ��m&\u0001\u0010���*3\u0002��lK,\f\u001b�Y�'��ԝ̠�U,��-ZR�4�<��6};��qu`=��K\u0014&yQ�\u0007�\u001eK���¿��\u0010|�3�L\u001a�\u0006H��\u0006l\r�k��q�0���D2�3\u0004��|=f��T*A.X^ڞ\u001b5R\u0001J��q�= �\u0006��:Q\u001dno\u0000�-��m�@��ް����<찶\u0002��~`C�\u0014�qP�$��J!6%\u001f䐖\u0013H��D���:\u001b\u001eվ�k\r��\u0001�x\u0006G�6�m�WH��u����a�y��V�=9��\u0003\b\u001c�rq\u0010\u0013ȇ\u0012\u0012\u00044�/O�R�3:ԍ�0\u001dم\u000f�\u001e�K�F\r�ԗҸ�~���]��\u001f\u000b�40ܠ�Zν�F7��L���>\\���m.�~`+6J�_\u0004\u0012�\u001e\r@� �\u000eq�\u0012�\u0013@�Q:�9wNhNb��\u000fI\t���\n��\f��g�y{�m��\u0017�ؐ�K\b)��","payload_hex":"fd37676ccb57edfc6eabe14bf6095db01c065a6fea195ef3a3125aaf990b12404513a154b6f60cd193e5a86d260110e8e6b62a3302dcc26c4b2c0c1bc659e7277f9cdad49dcca07ff5552c90df2d5a52c834a53c81cd367d3b87ba7175603d9b834b142679518a078c1e4bafb8b5c2bf968b107ce933aa4c1aa7064893cc066c0d8a6b9b8671cf30aabf9d4432883304f6b57c3d66b99d542a412e585eda9e1b3552014aaecc71f33d20a006e9b33a511d6e6f00802df09a6de540a8c9deb0c18dbde83cecb0b60287b67e604394149c7150f224c5d74a2136251fe490961348c6e744a08fdb3a1b1ed5beca6b0d8b9301ce7806479036b56d9b5748c19e75acbacbee61ae79aade56e73d3982da03081cd472711013c88712120434d82f4ff852a8333ad48d7fdb301dd9850fa51ee04ba0460de9d497d2b8c17ef98be35dc1c51f0ba43430dca0a65acebdd9463799e84c8ae68f3e5ce7f4c46d2e827e602b364aa15f0412a11e0d40de208d0e71e312c01340ea513a9839774e684e62f3b10f49099cfc890acbe10ca1ea6784797bb56dfa9417add890e14b0829f2d3","method":"","user_agent":"","ja3":"","session":"7c1cdb23-d7c7-4934-87c2-b56bf645ba34","seq":1,"duration_ms":101,"bytes_in":414,"bytes_out":13,"enriched":{"digest":"7315cfed787cefbb","strings":["qu`=","T*A.X^","J!6%","~`+6J","9wNhNb"]}},{"timestamp":"2026-10-17T04:28:06","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-qB5020-QR4jpC*790yw","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d7142353032302d5152346a70432a3739307977","method":"","user_agent":"","ja3":"","session":"0a9534b1-1a44-488c-966f-113962bee764","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"4f3ec72fb4be9d92","strings":["BitTorrent protocol","*-qB5020-QR4jpC*790yw"]}},{"timestamp":"2026-10-17T04:25:32","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"8�4\u0019��mJ�q5O��R\u0011\u0016w�܎pԗ�Bt�k^C:6�s\u000f�\u0004�\u001f\u001e�AC�\f���;=\t�ܫ�TD5a4��\u0018ʮ�AG���0µc�\u0018���J���/DQZ��h?H��\f�Xq\u0002�l�\u0004CB�z[%����(.ƭ\u0018����\u0015�{Z\u0000�O�3=/,�>�xO\b@�\"O��6��(\u000b����e��n}��\u0013GoH\u0019�\u0018Ҳ4��R��q\u0006��}\u0001\u0007��ÿ����G;�b�\n�x�\b��C��� ��\u000f�{�ξaq�.ݱc�\u0018m�o�呖\r`���L��5���N\u0006��7Qx��`����\u0006\r1����\u0013�i\u0018\u0003U�DB$��aj�-:\u00102�8�HRiγ5�L���C6�p!U��Ϝ]�Þ.\u000f-\"��3H\u0019`���Q����[\u000e���v;I���^5���BA\u0000�\u001f[k\u0003\r�1Nw?���StK�<],t�\u0004T\u0017�M)q�'њ\u0003!\u001c�\"\u001d� a\u0016�\u0007�v��VW\u001chf�]\u001b�� \u0015v��y�\u001e���\">\u001dt�m\u0002M\u000b)d�I�/�\f4Xo��\u0011��\u000eL�\"�Rޘ�_�x[#\tp(�\u0005�f+�d�\u0019��ᠭw)\u0003�MO�{\u0018:sj","payload_hex":"38f734199aa86d4ad171354ff7ca52111677c3dc8e70d497c84274c66b5e433a36a8730f9104931f1eff4143970cadb7833b3d09c8dcabbc5444356134bd9318caaebd4147b0fcd330c2b563e61887f6cf4aa593f02f44515ad6eb683f48f08d0ce6587102df6c9c044342b17a5b25feebabc9282ec6ad18c0ad80b015db7b5a00af4fe1333d2f2c9f3e9f784f0840c3224ff9d3369f88280bd6d3f5b965fd816e7d89ea13476f48198718d2b2349cb952ade47106e4e27d0107ff99c3bf859d8388473ba162a90ad178b008bd9643b6abcb20f1f30f867ba6cebe6171c22eddb163d5186da76fb2e591960d6089f8b84cb4e335918ba14e06abd837517884f760fcafb9fd060d318dbf8ef513d969180355b1444224969b616afe2d3a10329938e0485269ceb335c04c82e7d64336bd702155f7b6cf9c5de6c39e2e0f2d22908133481960e7fa845191c1b39b5b0eadc0d0763b49e2cefc5e3583e3e3424100c41f5b6b030dd1314e773f9db9e053744bcf3c5d2c74fa0454178e4d2971ec27d19a03211c7ffd221db1206116d807d1768e8256571c6866df5d1bea9b2015769bfc79b81ef183d2223e1d74e66d024d0b2964cd49b62fc00c34586fa7de11b4940e4cea22cf52de98d75f88785b23097028e505d7662b8a649d19b6f6e1a0ad772903ee4d4f937b183a736a","method":"","user_agent":"","ja3":"","session":"fb536e39-6939-4ce9-9d60-e962d9beabce","seq":1,"duration_ms":100,"bytes_in":492,"bytes_out":13,"enriched":{"digest":"09f513109156a375","strings":["k^C:6","TD5a4","/DQZ","3=/,","1Nw?","<],t"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-17T05:24:55.643275+00:00"}