{"ip":"154.72.114.197","total_events":1438,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,438 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,438 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"303,250 bytes sent","bytes_sent":303250,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-12T23:25:25","last_seen":"2026-09-16T21:44:55","events_24h":159,"events_7d":1438,"geo":{"country_code":"BJ","country_name":"Benin","region":"Littoral","city":"Cotonou","lat":6.3669,"lon":2.4151,"asn":36924,"org":"GVA Cote d'Ivoire SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as36924","label":"GVA","category":"isp","url":"https://www.peeringdb.com/asn/36924"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1438}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-12","count":27},{"date":"2026-09-13","count":766},{"date":"2026-09-14","count":25},{"date":"2026-09-15","count":178},{"date":"2026-09-16","count":442}],"recent_events":[{"timestamp":"2026-09-16T21:44:55","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-fQYaTS4iTcVD","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d665159615453346954635644","method":"","user_agent":"","ja3":"","session":"c1cd138e-fdf0-42d6-bf1e-94b317616b58","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"d0692314007831cf","strings":["BitTorrent protocol","<-UW160N-fQYaTS4iTcVD"]}},{"timestamp":"2026-09-16T21:43:40","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���6k!j�Rޮ������`�e���H��n���A\u0005A��w+\u001fA��\u0006��Y�[��\u0012*�y8�\u0007����ے0��t\\�fļkG�例}M�E��B���g�s\u0003�\u0002���3�\u000f|��T�^��Б\u0015�\u001b>�@/g�|,�BJ\u0014�~�\u0017XJ\r���c�����V�\"�\u0012Q��\u000e���\u001b{��1n`�~�D40�\u0002�M�3D\n�F(\u000e!f��L�;�s�o��p%�vs�\"�C�\u0014\u0005OG?^\u0017���d�v�\u0014��\u001f�B�ܾ\u0007\u0016�ݔ��t�\u0012P\u000e�\u0004���\u001a�(�&��rO\u001c&�\u0000�\u001e<\t��Z)A�܊�&\u0013\u0014�>��}\u0002�|8��\u000f+MT�P�5Ŕȸw���.'�t��8���\u0012<��i�PQ�)��\fͭ��\u0017:m<\u000fC\u0002ۑ\u000e�\u0000�n���Ϭ[�a�,�\u0013x�\t+�w��-Hݚ\u0004�R\u001a�g0z���x�oO\u000b��9\u0019�!i�g\u0000j��P{�`�S���У�\u001fu@O�\u001d��\\\u0012�\u000b{X s\r$|>\u000eT`\u001c��|�\f\u0016��w0�?*>6����=��\\�y\u001f�����)\u0005��}D/0\u0010$Q�\u0011�c�\u0013H\u0012�\u0014�_\"N��ݪ�;�����U�ȯ�����\u0014\u0005N��u��)��+��u�\bj��ThHo��c[��Q?���e\b\u0005\tG���H�v��?L\t\u0015� A\\�!_*w�z\u0002H���.\u0006���\u0012yQO��DE��\u0016\u001dR�\u0001�8���{)\u0011��\r��\u001e\u0001\u000e","payload_hex":"a2b8c9366b216ac352deaeabec91d6c1da60b965bebb9548fa976e87d0d3410541e59e772b1f41fdc80695d259b15bbbd17f122ade7938e4078c8fafcedb92309383745cd866c4bc6b47fee4be8b7d4da5458bb442d8eaff67ea7303b802828af433980f7cfdad54fd5e9998d09115dd1b3ed1402f67a87c2ce6424a14c17e8c17584a0da4a2a9639881d3eb8a568622dc1251e58a0ea8f7d81b7b8ddb316e60f57ede447f3430d402fa4d9233440ad346280e2166e9e44cc93ba1739c6f86b97025e376739e22ae43a114054f473f5e17e2ebfb64c776f91494fc1fa542aadcbe0716f1dd9480af74d212500e8604d3c4ff1abc288626c0e6724f1c26e6008c1e3c0989895a294183dc8ad62613148e3eafa97d02f37c38af860f2b4d54a250cc35c594c8b8779dc9e62e27c774ab9d38b0a2a8123cc08c69ee50519229a0810ccdade084173a6d3c0f4302db910e9200e86ea0acc6cfac5bce61c62c9b1378ed092bb777d5eb2d48dd9a04dd521ab667307aa596cb78916f4f0b85a13919b221698567006ae0e2507b83609853c8e9ead0a3ab1f75404fbb1d87d45c12940b7b5820730d247c3e0e54601c948f7cd90c16f4b377309e3f2a3e368d839bd43dc1a05cfb791fb8a88edcd72905c2eb7d442f30102451da11f663a0134812d914815f224eb694ddaa993bd1fbceef87559bc8afc4ddcef39d14054e83fa75afc529fff82be4b17596086ab2e15468486fa7bd635b8bc8513fa6f3bf6508050947eae39348dc76e7a13f4c09158920415cad215f2a778f7a024885a0912e06bdfaf91279514fe6cb4445e586161d52af01c738f0c0dc7b2911acdf0dcecb1e010e","method":"","user_agent":"","ja3":"","session":"48572829-67e8-4418-a5a6-957438faa305","seq":1,"duration_ms":100,"bytes_in":608,"bytes_out":14,"enriched":{"digest":"f9eeaa9cebee5ae4","strings":["6k!j","OG?^","{X s","?*>6","}D/0","ThHo","!_*w"]}},{"timestamp":"2026-09-16T21:42:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-qXGy9CW~y5e_","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d715847793943577e7935655f","method":"","user_agent":"","ja3":"","session":"463dfbdb-f517-499a-b8d7-e15b5f923246","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"fde739daf1b53b50","strings":["BitTorrent protocol","<-UW160N-qXGy9CW~y5e_"]}},{"timestamp":"2026-09-16T21:40:50","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"v�\u00000ZEv�����\u0001n~ԏ�zYT\u001e�sB>��3-g8\u0017S%��j\u0002�m6�Q�I��\b̉Z�KMg����]��j�jO����M\u0016�{n��\u0010yb�z��p�Bj�*\b�\u0014�������g��]\u0010ʏ�d�ʊJq\u0013\u0002��͹cNg���VglW\u0002��\u0003\bI���=r�\u001btKG\u0000Ċr�\u0012F�}�,�|\u001dx\u000f����h�\u0007=A'\u0005��t","payload_hex":"76dd00305a45769b82bcc7eb016e7ed48f9b7a59541e9973423e87b7332d6738175325b4956a02e06d36b651e349849208cc895a894b4d67fbc0a0e85dfee86ac36a4f86f5ea974d16c67b6eb9b2107962ee7adcd370fc426ae62a08bc14e5effec7eff0e667baae5d10ca8fce648fca8a4a711302bfeacdb9634e67a9dae456676c5702c5c103084986f8df3d728e1b744b4700c48a72d312eeb98b46ed7d8d2c9a7c1d780f88c0e69868b6073d412705bcbc74","method":"","user_agent":"","ja3":"","session":"2cb57d83-c5db-4ad8-bb83-847d4499a052","seq":1,"duration_ms":100,"bytes_in":180,"bytes_out":14,"enriched":{"digest":"5c9ae0be0b226a35","strings":["0ZEv","3-g8","VglW"]}},{"timestamp":"2026-09-16T21:39:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-7tQq52VCzbuj","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d37745171353256437a62756a","method":"","user_agent":"","ja3":"","session":"a82a6aa7-5da1-4857-9c0a-96f3bfe98205","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"5d24f38fa27a6390","strings":["BitTorrent protocol","<-UW160N-7tQq52VCzbuj"]}},{"timestamp":"2026-09-16T21:38:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"!��,{���\u001e�k<�\u001bU:y����\t�\u0019��k��=S�%\u000bϢ�\u001e\u001al�K�W(�γϒ�LI�XrC����P{q.�]ɶ�Ҹ\u001f����H�/�\u001a<���l5�\u001az\\��u�\r�","payload_hex":"2193c82c7b8082a21ec56b3ce11b553a7989fbb0f5098319b7d86bd7c83d53b5250bcfa2f81e1a6cfb4b88572891ceb3cf92aa4c49dc58724391899fd1507b712eff5dc9b682d2b81f8aa0d3e948b62f831a3cb381e56c35e51a7a5c8cea75d90d9d","method":"","user_agent":"","ja3":"","session":"83052f9b-6a37-4535-ac0d-b5fe2a0ceade","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":14,"enriched":{"digest":"81855a279b445521","strings":["P{q."]}},{"timestamp":"2026-09-16T21:36:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-2eou3RhQTc.(","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d32656f753352685154632e28","method":"","user_agent":"","ja3":"","session":"34124ea0-89a9-47aa-ba9f-4edd2149dd9e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"268bfa38f8313161","strings":["BitTorrent protocol","<-UW160N-2eou3RhQTc.("]}},{"timestamp":"2026-09-16T21:35:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0002�[(�p^�����\u000b�\u0005���f�X��C�\u000b�\u001cO���Ke�\u0010�����kU-\u000fH��,\u0016\\$w�\u0001�.���|�jV��\u00163��\u00017�>��0�Ώ\u0016�׮�À�K�7��{�)����Η\u0005��\u001a�s$\r:�F,J�a�\u0012\u0003��\u0019\tr�\u0003���L\u00031u�%\u001e\u000e�\u0013\u0002V���\u0017T��\u0013�壽�t��\u001b7T\u0007�\u000b�?[\t�[��H�(��v٪׎�N�W�W��&�Z�>ˏ�ـ�rO�7@�\u001a\b�\u001dV�#\fQ\rH�h�p^\f\\K��+�&\b͟g��\f*�Rm)��TQѠ�\u0005���\u00107s:���3Q�Dx�f4����W�)\u0016�p�\u0015�\u0006[�k\u001b\u0011��[�A�,��\"��\u0002N�je��N��\f���n9R�\u001c\u0007�\u000e+���E�C�`d\u0005\u0017L�+�%�}\u001f�'g����8��H\u001f�J\u0007F�Rˆ�p\u000e��\u0007�x�H���H\r�()����!\u0005��d���\u0002�n'B\u0016�5d��K��W\u0013�W�i�~.mD�'�\u0004��\u0005����\u0012ʐ���cw�\u001b���\u0012����f\f�T\u0000ȝ\u0018-w���\u000eq~��p��\u0015h�\u0018\u0018�u\u0019\u001c����p�\t��'`��%+'x\u0014)�\\xIz����5p�8","payload_hex":"be07611f52aedf87de8b91d17ffc9a8e36a037a1bc2ee63aad9a0740d7e09896f6dc760d35cde54a13b516a759c7d17b817af3d1aa872d8791a3c65a82fee3ba1c436c67c022de893640ddc7bfd314ca5d82cc87eff5f2a07e25f68aa04dc53e118d8d5be441a32ceed62283fd024e876a6594dc4ec0cd0cbd82c16e3952c81c078b0e2b92b58745ac43ee606405174cf92ba125c77d1f862767d8c1a4b038943c75cfbabfa8a72d9ddb51fdb60c535a27355be89500ce618689aefc16b623c94e842650480ac45b36a25b3ebe481f854a07468652cb86a2700ea5ad07b7788748b1d8eb480d822829faf4cde92105eff564dde4bb02bd6e274216b73564aeff4bf4ea5713f9ee91b0579169bc7e2e6d448d27920489b105b296a6a112ca90bffbce63778d1b88baab1292f1a7e8660cd45400c89d182d77a894c70e717ee1ab708fc515688b1818a775191ca59680d470ac0997932760bee5252b27781429845c78497ab483898235708338","method":"","user_agent":"","ja3":"","session":"c018abfa-aadb-4c81-83c6-f493fce9a425","seq":1,"duration_ms":100,"bytes_in":364,"bytes_out":14,"enriched":{"digest":"e2a408221b90be12","strings":["SZ'5[","~.mD","%+'x","\\xIz"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-17T11:32:56.238126+00:00"}