{"ip":"157.100.107.80","total_events":532,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"532 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["532 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"110,232 bytes sent","bytes_sent":110232,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T21:51:40","last_seen":"2026-08-20T04:35:14","events_24h":217,"events_7d":532,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Guayas","city":"Guayaquil","lat":-2.2038,"lon":-79.8819,"asn":27947,"org":"Telconet S.A"},"source_domain":"host-157-100-107-80.ecua.net.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27947","label":"Telconet Ecuador","category":"isp","url":"https://www.peeringdb.com/asn/27947"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":532}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":44},{"date":"2026-08-16","count":95},{"date":"2026-08-18","count":100},{"date":"2026-08-19","count":124},{"date":"2026-08-20","count":169}],"recent_events":[{"timestamp":"2026-08-20T04:35:14","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�f7\u0017�eDf���]l���H'\f�?P�t�C4�\b_���:\u0006�+]�m\u0000�S�\u0015\u00114ihQ\u000f��`\u0003A)S4a\f�\u000f�B�\u0010c�3��#�\u0016S���ʐģ�c5|p�Ѷ^\u0006�\u001f�\u0010\r��(e\u0001��\u000b�F\u0014�5�\u0013ԭT�yۈ�i|}\u001f�\u0019���v�(\n�\u0014\t���Z�ܖ�~\nUEU�Ea2��WمB���̋\u0005�sR���21�f�Y~�Ƒ,��-�Y���\u0011_�y��\u000e9j�Ġd\u001b�d��H��Ek\u00141�&h\u001c.\u001cܧ}�e�{`W\u0011L\u0000&�\u0019\u0016�mBc\n���C7\u0016�Z�������%/S���\u0001����\u0013:��a��\u0013>�\u0001S�H�\u000e9���\u001d�\u001c\u0003s� \u0000G�l�\u0016�78�tp&���\u001c;\u0012*�\u0003ҵ�������m�%�{qWXM�3�P�Ԥʚ���S�-���Y>\u0018\u0016\u0007�\b���\u0016��y��\u001c��\u0000(;w���y6,�ʰB��mm\u000f(��9�_�Ǘ��K�~\u0013\u0017-�Rha�e�p����q�Ő��D��\u0013B'\t��'�\u0014h�\u000f���\r:\u00048��A��b\u0010\u0007�5³C�B�ZO(����no�P&J��5r�\r*��n\t4���x`Y\u0015è׷�I<�����\u0016Ϗzꌊ��g\u0007\u0006\r�J�OS@A\u001e�5�8Acq��Od\u001d\u0017����'�Hk\\��\u0007U�\u0018���","payload_hex":"81663717d9654466b09ba45d6cfed9e748270c9c3f50c974f743348d085fc18a963a06c32b5df86d00ae53ae1511346968510f9ad5600341295334610ce90fc042ab1063ff33f3a2239f1653adb9bdca90c4a3a563357c709ed1b65e06a71f96100db089286501fcad0bd64614ed35d17f13d4ad54f979db8882697c7d1fa41984e3a176df280adb1409ddfb7f965a87dc96977e0a554555e845613283e557d98542dccdd0cc8b05b87352d9ffa93231f166d3597ec9c6912c90982db3599ab7e4115f82799aed0e396a81c4a0641b9664f7c448fee0456b14319326681cee81822e1cdca77dcb65e27b6057114c00269c1916f86d42630a81b3d0433716eb5a8abafbb7ebb1f7252f53fc83d701a1b5eceb133afcb06199f1133ec10153d648a70e3986be9c1df81c0373cb200047c86cda16ae3738837470268e85d41c3b122ada03d2b5bba591ddf4d8e96d8e258f7b7157584df733cb5088d4a4ca9a89bbe8538e2deb9ded593e181607c70882929616be8b79d2d77f1cc2e200283b77b4f8ed79362ccbcab04292a06d6d0f28b4ad39e75fdcc797b9a54bb67e13172dfb526861c865c970ead7e3f971f0c59091e044c8e513422709b585278b1468960fcbecb40d3a043883b9418efa621007bb35c2b343d142ed5a4f2880f4a3c36e6fed50264aae973572aa0d2a85c86e0934c0a59178605915c3a8d7b78d493c98addbccc816cf8f7aea8c8ac2d66707060dbb4ac34f5340411ece35c238416371b9b34f641d1792898bfc27f8486b5c85fe07558418d7f6e2","method":"","user_agent":"","ja3":"","session":"38c6e4bc-1a99-4e0a-8217-89230abab654","seq":1,"duration_ms":100,"bytes_in":567,"bytes_out":14,"enriched":{"digest":"fed81771867dbbdc","strings":["4ihQ","A)S4a","c5|p","{qWXM","OS@A","8Acq"]}},{"timestamp":"2026-08-20T04:33:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-_dalt)x)e-wK","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d5f64616c74297829652d774b","method":"","user_agent":"","ja3":"","session":"ee12cf01-c8e6-4d18-9464-778fb9c0d891","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"34779a983a83e996","strings":["BitTorrent protocol","<-UW160P-_dalt)x)e-wK"]}},{"timestamp":"2026-08-20T04:32:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001�\u0004k[w`U���\u001fԴ`�~Ko5�3��\t\f�~��~�r\t��Y��iM|�tt��EL��'Q�n{EJ^\u0012`wU7 �1y�\r��e\u0012�Ups��=�\u0018\u001dz�>�t�C��������\u000e^�[V��b׼(�`�ow����I�\u0004!�] \\��\u0007�D\u0018p��.r,�P�\u0018���B\u001ds\u000f!","payload_hex":"f6f201fb046b5b776055f1ef98a0fd9d1fd4b460897e4b6f35a833e3b1090cd07e81af7ecd7209af8e5996f7694d7c827474e6b3454ca2de2751966e7b454a5e126077553720893179dc0dbea66512f1557073bd953d93181d7ae73ec274fe43e69bfcbbacaeedbc0e5ebc5b56df7ff262d7bc28a0603c6afb7b928bf3e394584f66de763c77d3ba603ee46f7799acf383498f0421d45d205cf7c107bf441870d6e42e722c8750a518bb8bc1421d730f21","method":"","user_agent":"","ja3":"","session":"1a5fcf32-8833-4843-a29b-4c2032dcaa3f","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":14,"enriched":{"digest":"cbeb9ff50d541863","strings":["k[w`U","~Ko5","n{EJ^","`wU7"]}},{"timestamp":"2026-08-20T04:30:59","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-NwA!HZyygwol","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d4e774121485a797967776f6c","method":"","user_agent":"","ja3":"","session":"03863bc5-7ee5-4362-84ef-22ed8ede4501","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"da9e67e71fffca04","strings":["BitTorrent protocol","<-UW160P-NwA!HZyygwol"]}},{"timestamp":"2026-08-20T04:29:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�H�\r�\u0018��\to*�M��WN\u001e�r�\r�ԕ\u0012\u00147����ݶ>\u000e͢�p�wV��Ӎ\u0001P�M�8��53���0��`���\r�\u000e�fH�u�%����2\u001f���x\u000e�)a#�y=Up�h��[G�M�j���^�l2�^���pf�B)�M)��O�\u0013����\u000e�Aq��\u001a)_�#@��\u000ekU\u0000���1��İ\u00002����I(ʲˌ�,�7\u0004�͹������f@̛�\u0017�\u0005�\f�7\r\u001b�@���/yr88W8�\u0007��\u0002\u0005\u000e��eZ ��G��ðĜ(����`v8~��SR�e�\u0005�\u0013-Ud���\u0001F!}��|���x9���IFCLA���Yq��6�\u0014ӻ�\\���@9)\u001c�8�qwk\u001f�<�\u000b\u0013���\u0003�d�a�O�fύ�D�B\fX��k�f�[��yw%�**\u001f{�ݮ��R{h$��\u0016B��\u0014��K�Q**Z8�vu�\u0014��U0��jû��\u000b����\t��b��u��\t�E���\u001a��\b�z\u0005}AB�D�I\u0001\u001f\"`w��3^�D\u000bj\u001a2���\u0003��I\u0011�\u0001�֫�Rm��X>\u0019�@\u001ep���R��\b2.#?����$��\fI�-\u0005\u001ak�y��C��\u0002��47!�dDQPY\u0006\u0005�{D�&Q�>��}�\u0013\u0012h���\u001d��$+@�o��\u0015�\t3lu\u0003^<\u000e\u0006�S�4Q\u0002.��i�f�|r�0��O<��\u0006�\f�]��΂�-\u0018\u0018\u000b\r-Q\\��gJ�pvT�\u0011\u001b�cH�PM���T�\t5U]�٧�\u0017�련��o�7���\u0007\u0004���P��T�Q�\u001f���b��Vf���b�y���,������q[0��","payload_hex":"76be44b635723f04c7e5b8f01f76996cb24a301b6cb66602236c1637b7dde3f1751cb6936efaa39f450cfbf013a1fbdd171b26b071cdf9be2ad39b970fb1ad24886d79414ecd20d3090c5dad2d72dbccefe7f87175946ccb14105b4a287d010d9dab08b0f1cd15bf2498fd7fecac361159fd8c88b23619d0f845a1d59e96e0e61a5a489889777b7bc855c341bfbc149cc63e9543e7f902c5e3343721f364445150590605867b44fc2651a43efcaa7db413126888feb51dbc9e242b40946ff4f5158309336c75035e3c0e06ce53953451022ef094698466827c72b230ebd04f3cc8f006a90ca65d9cdbce82df2d18180b0d2d515cb799674ac7707654b1111bd6634891504da3918d54ab0935555d98d9a7b317ffeba0a8f7a46fc73798a5e10704b2e6ae508e9154cc51a31fb1e2c862938e5666dcede862c279ccf5bf2ce5f1ad9ec5de715b30cadf","method":"","user_agent":"","ja3":"","session":"39ca1e29-3b4b-4171-948b-4cb95d3d147a","seq":1,"duration_ms":101,"bytes_in":329,"bytes_out":14,"enriched":{"digest":"e4b1fd764f99c587","strings":["myAN","[J(}","dDQPY"]}},{"timestamp":"2026-08-20T04:25:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-F0X~B(-gUqWj","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d4630587e42282d675571576a","method":"","user_agent":"","ja3":"","session":"865c9dd4-425a-47d9-ab99-0c31000aae0d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"1b12bddc1ed5f329","strings":["BitTorrent protocol","<-UW160P-F0X~B(-gUqWj"]}},{"timestamp":"2026-08-20T04:24:21","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0011\u0017�\n2�5�1\u000fä��s���<\u001d��\"Y(q\u000e\u0015T