{"ip":"131.255.20.91","total_events":2259,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"2,259 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["2,259 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"463,923 bytes sent","bytes_sent":463923,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-10T15:23:26","last_seen":"2026-08-14T09:46:49","events_24h":326,"events_7d":2259,"geo":{"country_code":"BR","country_name":"Brazil","region":"Espírito Santo","city":"Vitória","lat":-20.3163,"lon":-40.3457,"asn":28210,"org":"GIGA MAIS FIBRA TELECOMUNICACOES S.A."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as28210","label":"Giga+ Fibra - DF/ES/RJ","category":"isp","url":"https://www.peeringdb.com/asn/28210"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":2259}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-10","count":446},{"date":"2026-08-11","count":1243},{"date":"2026-08-12","count":191},{"date":"2026-08-13","count":87},{"date":"2026-08-14","count":292}],"recent_events":[{"timestamp":"2026-08-14T09:46:49","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0014�.���;y�\u0016A�\u000e:�� ��6Q�d�߻\u0005_N�c%c�!\bt��>�D\u0013��?^�\u0019��\u00117�C�\u0013���D�ե&c1�u�tP�\u0015\u001dO\u0011y��օAC���4���f\t��C �*\u001bE���}he��ֳQ��`Nk��ǚc\f5)\u0003\u0014�\u0013 Z!=A�ƶOt�\n���ϑ�E�\n��m �f1�\u001b/���$�C^��\u0016n~I̯��+��*�Ƽֶ�jK�n\u0012��\r:m�k7k���;��h,\t�2��P��$��� ���;1��{�_ࢰ�N\\��d\u0011�a%��\"0o��/���0�\u001a�a����\u000b\f��ƫ��\n^X-蘎0E��\\�{5���Y�\n\u0007\u0005B\u0012x0�.�p[�^���mFp9�HǦE\u001bO�;�ˉ\u000ez��uNT��Հ~����U%��@�����\u00176\u001e~2G\u0015�j0C\u0006�Gp?\u0017�Z��k�\u0005E�{�d��\u0013\b��N\u001cU&\u0012��b���'Q1�a.'\u0018�H@\u0016�\u0011���W�I�","payload_hex":"7d5b90cee9a85c2cc3e5245164459335f1d70dfe0886435d541a7157a31de2d06914d58ab00a3d9d741e69787f5d9c2cb1b6b6d383e274102c6c76f46e6a4cd256c83ccb308553ac0cf2f9c4402ecc331a4da88e4eab318ad4ac0b3e6609c1f74320b62a1b45ffd6f67d6865caf3d6b351a8b0604e6bbdf8c79a630c35290314d513205a213d41c0c6b64f74c50aa1a9bacf91c545840a87eb6d20f16631c61b2f8991f024e0435e96c7166e7e49ccaffae32ba0972ae6c6bcd6b6f46a4bd16e12c1940d3a6d996b376baaa78d3bf1dc682c09d332e6e35084f424ddd7df20a991863b31bbaf7bbb5fe0a2b0aa4e5c8fc26411c56125e5fe22306feadd2fa8aed8308f1afb6188afb9d90b0cc7edc6ab82830a5e582de8988e3045fabf5cc97b3599a8f959d80a070542127830b72ec3705b835e9ba8ca6d467039db48c7a6451b4f943b98cb890e7a98b0754e5496e9d5807ea97f9ee3df5525b9de40d9e2f7c1bd17361e7e324715866a304306bb47703f17dc5af3c06bcf05458d7bdb6496ec130893d44e1c5526129fe162c8d3d927513195612e27189d4840168611d1defe57ea49a3","method":"","user_agent":"","ja3":"","session":"8de9e9fe-fd10-4339-b303-621c96e6aebf","seq":1,"duration_ms":100,"bytes_in":421,"bytes_out":13,"enriched":{"digest":"49cfcf64cbf65aa8","strings":["$QdE","Z!=A","mFp9"]}},{"timestamp":"2026-08-14T09:40:13","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5230-JtmIL!HeYw-E","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353233302d4a746d494c21486559772d45","method":"","user_agent":"","ja3":"","session":"e85373fd-99ba-4bcd-8059-dd15dc477c00","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"fd848a677198fa9f","strings":["BitTorrent protocol","<-qB5230-JtmIL!HeYw-E"]}},{"timestamp":"2026-08-14T09:38:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001a�;H�:_�,��\t~\u0001���P�ح~;\u0012H#\\��q����\u001a�\\u�L�ڮn������|��������\u000e�5\u0011�S\u0000�R\n��Χ��3\u000e��z���tL��� ��\u000f�2̨\u001c�9�,��x�G-�/���(�����@�\f��.5��#9�\u0002������:�3\u001e�C�C��DUK��dΰxgY\t\n\u000f�)�:���;r����R�;\u0017칙�e���\u001bC.\u0016T��\u0006��O\u0007�΍\u000bh\u00175���4��Ӟ;�\u0005S'�<���\u0014�#X[\u0015\u0011x�$$�I_��|\u000f>hN墢h��Yy�d�V�Zv����Y��\u0002�ݶF��\u0002a9ľB�ZL+n�Jv���{<�����t��.n�͓�w\u0000�4%��GG\u00044��:�)�:Ή���GǷ�.�\u000b�pY��37�\u0000�A�˴�O\u0011�(�Ժ�\n�z8\u0010�o��Ad�ɔ\u001e���\u0019���\u0000m\u0019ܕPJ���\u0011;�\r��\u0012J��09\u0001H�:P�p\u0010��=z�r\u0011�\u0019Ê;ڎdA�qT��\u001a\u0002��I�r\u0015\u001c���vA0�","payload_hex":"1aee3b48c33a5fa42cfbcc097e01a3efec50eed8ad7e3b1248235cf4ce71b08e87b71af65c758a4cd9daae6eaccafaede99e7c9edde9f7f6a090ff0e823511ad5300b2520a84f0cea7e3d4330e9fe27a89e090744c7fb880d020bfed0fe932cca81cd239d82cfbaa78eb472d8f2fa7a2ed28b2f4ecb5de40a70ce2c62e3594892339a70290e3f6f0aaee3add331e9143a8439c9644554bfbe164ceb0786759090a0fcc29e23a8ff8d83b72b296eedc52c43b17ecb999db65a2e6941b432e16549cf506ac874f07a0ce8d0b681735f7bce634ffdfd39e3bd2055327b13cccf3ba149723585b151178c42424f0495feaff7c0f3e684ee5a2a2687fb5cf5979ad64f556f25a76fbaebfc8599ecb02b2ddb6468298026139c4be42ae5a4c2b6ed34a76f9d9c27b3cb8ef9bd7c07483c32e6ea1cd938477008734259eae474704348af93af129f83ace89f2e8c547c7b7892eab0bd37059c1993337e9009e4196cbb4d74f1187288cd4bab70ae77a3810c36fa1844164d0c9941e90b8c819f68fae006d7f19dc95504abaaaae113bf60d8bab7f124ae8a730390148e63a50987010e0d43d7af47211a519c38a3bda8e6441e4715495ae1a02bfd349bb72151cbeafd8764130d7","method":"","user_agent":"","ja3":"","session":"7e74f279-a4f3-4390-886c-7a90c0e82132","seq":1,"duration_ms":100,"bytes_in":452,"bytes_out":13,"enriched":{"digest":"24aba9a33e779df0","strings":["ZL+n"]}},{"timestamp":"2026-08-14T09:35:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5230-~rHBpUVTiSzN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353233302d7e7248427055565469537a4e","method":"","user_agent":"","ja3":"","session":"0660ea7d-2216-451d-bd50-e9bf2ec7aa4b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"9b85f56606374a4e","strings":["BitTorrent protocol","<-qB5230-~rHBpUVTiSzN"]}},{"timestamp":"2026-08-14T09:35:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5230-~rHBpUVTiSzN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353233302d7e7248427055565469537a4e","method":"","user_agent":"","ja3":"","session":"0660ea7d-2216-451d-bd50-e9bf2ec7aa4b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"9b85f56606374a4e","strings":["BitTorrent protocol","<-qB5230-~rHBpUVTiSzN"]}},{"timestamp":"2026-08-14T09:35:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5230-~rHBpUVTiSzN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353233302d7e7248427055565469537a4e","method":"","user_agent":"","ja3":"","session":"0660ea7d-2216-451d-bd50-e9bf2ec7aa4b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"9b85f56606374a4e","strings":["BitTorrent protocol","<-qB5230-~rHBpUVTiSzN"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:04:11.948476+00:00"}