{"ip":"138.255.249.150","data_as_of":"2026-10-28T17:40:45+00:00","observed":true,"total_events":2478,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"2,478 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["2,478 requests against 1 service(s), so the activity is deep on few services.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload was observed, so this describes volume and focus only.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"517,789 bytes sent","bytes_sent":517789,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-18T18:11:05","last_seen":"2026-10-27T04:18:33","events_24h":0,"events_7d":1688,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DO","country_name":"Dominican Republic","region":"Espaillat Province","city":"Moca","lat":19.3929,"lon":-70.5235,"asn":264605,"org":"TELEVIADUCTO S.R.L."},"source_domain":"138-255-249-150.cgnat.televiaducto.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as264605","label":"TELEVIADUCTO","category":"isp","url":"https://www.peeringdb.com/asn/264605"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":2478}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":253},{"date":"2026-10-19","count":207},{"date":"2026-10-20","count":314},{"date":"2026-10-21","count":175},{"date":"2026-10-22","count":87},{"date":"2026-10-23","count":69},{"date":"2026-10-24","count":480},{"date":"2026-10-25","count":407},{"date":"2026-10-26","count":325},{"date":"2026-10-27","count":161}],"recent_events":[{"timestamp":"2026-10-27T04:18:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"<���˚\u001e�l\u0007�Z�����؆��ڑ:t\u0005/�t�{���\b�ԍ��_�[Z\u0000Ӓ�\r�\u0004Q��)\r52 \u0004\u0007�M��m\u0019�0��Pdכz]�@��2���V���_#\\��F�r��RU+\r�<,��c�u\u0016j}����k��i��\u0016�}�ŏ���q��c��!�������\r�S���qݯ�\f~�۰�\t\u0019�:�>��\"Ү�\u0017��e�Ɏ��|��\u0007dUtm��\"h\u0006�\u00199�Ѭ�N�H�G���\n�q�V��m�����!5��D9Ee�Z\r�S�,\u001e��\t��)r&z�\u000e�W\b^Qc��\u0000\u0015\".��ʭ��_@\u0004\b*@��T(=U�5af���7���\u0003�ݮGa��\u0002��ߚ\t[��q~̈\u000eyS�K�+�Y�\u0014��BW\u000f/~ʣ�˥L�ߏ\u000b1{","payload_hex":"3ce7edc6cb9a1eb36c07ef5ab1bcadf1a4d88686e0da913a74052f9474aa7b82c7c008b9d48dd8da5fe15b5a00d392fc0dc50451f798290d3532200407d34db9836d19f2309cea5064d79b7a5d9540b382328989f25691e3e75f235ce2e346ea72acb952552b0df03c2c8c9a63e275166a7dc7eafbf06bfa8269a8d9168a7dbac58fab8ae071f2d263b2dd21abf7aacaf882a90d9c53ded5c071ddafc90c7ed3dbb0eb0919c93a9b3ec3ee22d2aed517a3ce65f7c98e99d33c4e218f95409e73c6c8586eb542b8b2107977f21841909587d6c1f4727b67d1c58547a6ae9e4d6621503369115fca3a86243a436556e3bbd1b8befdf9ab0717b1147fe154495a2a952989aa0e2cb03e7c8bf7076455746d928522680687193991d1ac874eb648d747f8c6d80a8171aa56ae9c6dea99e6d9f12135ddc544394565855a0de653b12c1e978909ded02972267aa00ed857085e516387c20015222eb0e6caadf39c5f4004082a409eed54283d55d135616680f88137a3ae9f038bddae4761a6b002bfb8df9a095bdcef717ecc880e7953c04bf12b8659ce1494b442570f2f7ecaa3a5cba54cb6df8f0b317b","method":"","user_agent":"","ja3":"","session":"4cb852e6-7656-481c-bb0a-bb4cc75bb2d3","seq":1,"duration_ms":100,"bytes_in":424,"bytes_out":15,"enriched":{"digest":"5d97b286e606fd2c","strings":["Mf!P3i","$:CeV","TIZ*","dUtm","D9Ee",")r&z","T(=U"]}},{"timestamp":"2026-10-27T04:16:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BW160P-9_ZY7G.U.ZiJ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4257313630502d395f5a5937472e552e5a694a","method":"","user_agent":"","ja3":"","session":"ae069857-d7f6-42c4-a7bb-5e157acd680e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"7ee5043a93413f15","strings":["BitTorrent protocol","<-BW160P-9_ZY7G.U.ZiJ"],"iocs":{"domains":["u.zij"]}}},{"timestamp":"2026-10-27T04:15:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\b��N�\u0004N_ʖ\u0005���\u000e�\u00036ik/\"���V�\"c>}\u0011\u001a�Z