{"ip":"157.100.107.85","total_events":930,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"930 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["930 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"187,134 bytes sent","bytes_sent":187134,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T16:40:15","last_seen":"2026-10-02T03:12:18","events_24h":0,"events_7d":372,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Guayas","city":"Guayaquil","lat":-2.2038,"lon":-79.8819,"asn":27947,"org":"Telconet S.A"},"source_domain":"host-157-100-107-85.ecua.net.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27947","label":"Telconet Ecuador","category":"isp","url":"https://www.peeringdb.com/asn/27947"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":930}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":142},{"date":"2026-09-20","count":46},{"date":"2026-09-21","count":1},{"date":"2026-09-22","count":90},{"date":"2026-09-23","count":176},{"date":"2026-09-24","count":34},{"date":"2026-09-27","count":45},{"date":"2026-09-28","count":24},{"date":"2026-09-29","count":97},{"date":"2026-09-30","count":123},{"date":"2026-10-01","count":106},{"date":"2026-10-02","count":46}],"recent_events":[{"timestamp":"2026-10-02T03:12:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��Cwwb�)�th��G�aL\u0019\u0005���\u0006!J[\u0002\u0003�,�I�X}@����\u00188�]J�K�s�d̴�\u0019�s�\u00007\u0002\u001dW�2eљ˨�\u001f/�CΦa�v�4D$V�~+z�\u0016��e�\u0006�A�p�\u0000m\u001d��)4D��\u0014�{׈�9e4���n\u001bI��\u0018x%�����\u0010՜�YY�����\u0001��\u001a����\\6H\"�༛ N�\u001au�x<�k�����U\u0013�Qi\f^���+�g� �WY.\u0017c\u0002����\"A����Iq��~����d\\\u001e��_�λ��\u0002��\u0013L\u0001NŻ9�;L\u000f��\u000f2\u0016�\u000b�c'���.X����w�)u\u000e\u0003�YeI��G�#���u\"�����-y��#��\u001f�X5�\u0018��\u0017b��\u0012���\u001f–\n\u0015\u0004��:O��G��\u0006}���\u0001�4\u0011Z�頻��->^�M\u0015��r�V���[�8PZM��\u0017��\u0017EH�\f2P\u001cLJIN.\u001ax �\u0005�\u001f��\u0011Y-XJ`\u0017���\u0003-���\u0006�LU�o].{%״}�\u001f�=�A���Y\n�\u0014�\u001f���p��\"�o����p���Va���IY\u001b\u0010Ǿ�=W�Mq�c=?i=��A���?_�a����\t\u001a","payload_hex":"8bd943777762d029d3746899bb47ef614c1905a7b2a006214a5b0203c52cc249a1587d409aff95f81838845d4aae4bfc73ad64ccb4ec19a773c00037021d57b73265d199cba8ac1f2f8a43cea66193768e34442456b97e2b7ab516b0b265e906ff41ea70f6006d1df4ea2934448ada14b27bd7888c396534e1c6e16e1b49e19c187825ade4c4cce610d59cf25959998a97efd201a37fa01a97f08cbe5c364822e1e0bc9b204e911a75c1783cea6b87f7f5c0e65513b851690c5e89b0822b85679820f357592e176302a2b6f9802241e9cbd6d34971f6ec7ef985dbc3645c1e8ddd5fa1cebbd7ea02a887134c014ec5bb39b53b4c0fa9a00f3216a00bae63279e95f62e588da4a1f377db29750e0395596549adac47d623be8ec27522f0cbe1c4f52d79a49123ebef1fc25835b718d6e51762f4ef12e1b6f21fc2960a1504ec873a4f958847e3af067dbdeebc019934115a94e9a0bbb2e12d3e5ed54d15a4d072d156b4b9f95b8b38505a4de98717bafa174548830c32501c4c4a494e2e1a7820d105bd1fdbd111592d584a6017faafdb032d83ecaf06c44c55ed6f5d2e7b25d7b47d9d1f933dcb41eea2e1590af114871fbbc3dc709a8322c36fe3bbed9270c4f0cf5661bab29149591b10c7be9f3d578a4d71c8633d3f693db5a941bed9f03f5f9261fb7fcbccc2091a","method":"","user_agent":"","ja3":"","session":"f0bbc242-4ba8-43bc-a85b-4e7740e3cf1c","seq":1,"duration_ms":100,"bytes_in":490,"bytes_out":14,"enriched":{"digest":"774488b2ce79f0ea","strings":["Cwwb","4D$V","\\6H\"","8PZM","LJIN.","Y-XJ`","o].{%","c=?i="]}},{"timestamp":"2026-10-02T03:10:47","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-0tivUGQF-s0x","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d30746976554751462d733078","method":"","user_agent":"","ja3":"","session":"08ebd912-8c38-4472-a3b9-063cf2838cfe","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"521deec4330098e7","strings":["BitTorrent protocol","<-UW160N-0tivUGQF-s0x"]}},{"timestamp":"2026-10-02T03:09:36","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001f�ޙ �\u0019��0�\u0007���G��3Xq\u0018�� ��oUn�G����{���$V�#�\u0001��5\u0011����\u0019�\"\u000b�\t��3i�����rtZ�֎�\u0002ڠ����\u001f�F9�\b�G]�4��P\u0016\tl�\u001c�%+Dn�w\u0015U��\u0007~�(BEqa2\u001f�\u0012���S\u000eK�\u00139 ��ʥz��]�'\f�\u0016�@����\u001c�ِ&;�k\u001cj1\u000ftIU-�`\u000b\u001d���\u0013\t�/]^eI�\\�u;�m�ͻu&�~$�Q�!>�\u001e}�g\r;ҳ�ґ��/\u0017��tʝ��ٳ��*ϱb'�}�c�+�w�-��r�\"�\r��(75\u0014vc��C�y~�K��\bH'���\u0002B.�����oy��/�\u0016��ݧp��Q\f\u0005�q�5��\u0013<ԫ|<���*\u0007G�%��~�\\��I:���'�1�%�F��$����\u001e��2�=&Y9G\u0007|��)�+�\u001bӍm��*y\f\r�.|�\u0015Vl\"��\u0011G�,�e����-1��2l�u\u001b��\u001e�%��xdg��a��e!\u0005\u0014�;\tO�\r�\u0004�\u0010��\u001e���%","payload_hex":"1fecde99209419dbd430ae07a690ac479b8b33587118b3a120a1c76f556eca47e5c6c8d97bcfd27f952456ab23ec01dfda3511aaf7acb719ff220ba50981f23369f489fbcef57f72745a91d68e9602daa0c2c9e7c51fff4639be08af475dfb34adae5016096c9c1cc2252b446ee177155583ab077eaf2842457161321fb912bca5ed530e4b80133920a2c7caa57a86e15d88270cc7168440bfeb83d91cb4d990263ba76b1c6a310f7449552d92600b1db885dd1309f42f5d5e6549d35cc7753b9e6dd3cdbb75269b7e24c851ff213ede1e7d89670d3bd2b39bd291948e2f179dcd74ca9deaded9b39bc02acfb16227937d9c63972bc677c82dbd89729322bf0dfef2283735147663b29c439c797efb4be9e3084827c085fa02422e92dafabdb66f79f2db2fca16d0c2dda770c9f2510c05d671f535c4f7133cd4ab7c3ceb8fd52a07478325b6c27e9e5ca9d7493abb80ea27c4318925f646e2a924beabf4ed1eddce32dc3d26593947077ccfe429812b971bd38d6de7c72a790c0d9b2e7cf115566c22a5ba11479b2c836592b3b0fc2d31a4da326cd6751ba9c21ed225aa86786467a1d661f2d8652105149a3b094fe50df504b910b7e71ed5c2e125","method":"","user_agent":"","ja3":"","session":"b86f8c29-0763-48b2-af26-521f38ecd173","seq":1,"duration_ms":101,"bytes_in":444,"bytes_out":14,"enriched":{"digest":"4c08d5d40f03ba40","strings":["%+Dn","(BEqa2","tIU-","/]^eI","=&Y9G"]}},{"timestamp":"2026-10-02T03:08:05","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-qev51lWbAUTh","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d71657635316c576241555468","method":"","user_agent":"","ja3":"","session":"7ad73d17-b34d-4e3d-ad69-634c5d2769ff","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"0a4dae25f32039b3","strings":["BitTorrent protocol","<-UW160N-qev51lWbAUTh"]}},{"timestamp":"2026-10-02T03:06:54","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�j\u001e� oh3�f.>#\b<�A��\u0011�\t�z�,D�\u001d�\u0007+�|�8n6\u001d�\bÔ!tz�ۧ���%�\u0014l��%�$��Q�g��hۣ�\u0001\u0006xLJD\u001d�\u0007�a�����\u0011ƫ�j�J�������bP�%�\u0014v\u000fWB+\u001c\u001aO��\u00190\u0012<:���s�:�-\u0013_��]\u0012^0I[�k\rl�h��v?�8\b�#^\u0002��mܲcO�lT���s_:�\f'D�F\u0016��X9[�I�\b/��ҫ�b\"�����Q�X��W���#�m�\\��\u0012G\u001c�\u0011�pC�x\u001d�4\f\u0016���]\u0002��Ў+\\I��\n��\u0017>�}�ݑ�՗�ɱ�'�J+��𽦦H6x��\"��\u001e��sx}���\u0019 Y��\u0018\u0003w'�{IVK)�;�s\u000e�\u000f*�����<���U�X\u0011��<C��\u0004\u001eW�K�S�p�\u0010�����y��:�\u0007��„j\nmɀ ��_�|��M�\"���o`��R,d+����p��D�/}UEh\u0005'PB\"ͺ\u0007�~�c�ۊ́ġ�06�\fnOh�*��0�\u000e\u0000�v\u001f\"�E��\u0001��\u0012�ޱ\u0005�1�\u0015\u0000Sa�v/Ki�>\u000f?1?�ƒ���T ՞\u001c1\u001f����E�\u0014Ԩ��T���g������0�]%�T\f;T�\u0004d�^Bj�g+#��D���H����jK�X","payload_hex":"806a1edc206f683383662e3e23083cd841f7bb11a409f87afe2c44e51df6072ba37cc9386e361dac08c39421747a93dba7aa8a962598146c9cfc2597248dab51b467b9b068dba3cc0106784c4a441dd807b061b4b3f5d8d611c6ab876af14aaa8fb1948aaaca6250fd25dc14760f57422b1c1a4ff18e1930123c3acecdc373ce3ac72d135ff2e85d125e307f495b926b0d6c8c68d5d8763fb938088d235e028bd36ddcb2634f886c5489e894735f3a9a0c2744e74616edf358395bd749e1082ffdc9d2abd76222b5b0f0dcdb51cc58d1ef57aef5b023c36d955ca6fb12471ca611b77043b8781db2340c16a6c0ae5d0284f3d08e2b5c49b99a0abee3173ea77dfedd91a5d597dec9b1f127834a2bf988f0bda6a648367892e922ddf11ee7b073787dacb38c19205991ad18037727de7b49564b299a3bb0730e820f2afc92c09be33cb1bc9b55bd5811b3983c43baff041e57994b9653a570e01088c5fcf5b579f2f03a9007bbcbc2846a0a6dc9802099b25fca7ce0de4deb2285b9ab6f60e9a0522c642bf6fba9a770fd8044a12f7d5545680527504222cdba07907eef63fbdb8acc81c4a1cd3036cc0c6e4f68fc2a94f9308e0e00c9761f22ee459dee01ace312eedeb1058e31971500536192762f4b69fd3e0f3f313fa4c283b18bca5420d59e1c311f8de08e9a45ec14d4a8889254d2f0f467b3bffedbfed430da5d25f7540c3b547f910464995e426ac8672b23949444c0f7a248eda4e59e6a4ba758","method":"","user_agent":"","ja3":"","session":"418125ba-7c05-401c-81e2-f0d2af5bdc6a","seq":1,"duration_ms":100,"bytes_in":542,"bytes_out":14,"enriched":{"digest":"69110ca307799b33","strings":["f.>#","xLJD","{IVK)","R,d+","/}UEh","'PB\"","v/Ki"]}},{"timestamp":"2026-10-02T03:05:24","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-fbnkvmbNglxC","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d66626e6b766d624e676c7843","method":"","user_agent":"","ja3":"","session":"874278e9-bc91-4add-b0cf-356c7938e7cb","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"22384bb71ecc5949","strings":["BitTorrent protocol","<-UW160N-fbnkvmbNglxC"]}},{"timestamp":"2026-10-02T03:04:13","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�*+\u0002Bh��\u0012�&���\u0013���`g)�U\u000f�0\u0010h�l�� �\fB�\u001e�a\u0001��\u0012����פ�ճO/�L�\u001e�\u0012�N��\n�\u000f=Ҋ*\u0011Z�T6��*<ߤ1j�<5�6����Dӟ��\u001a��0\u001a�� ���b \u001c\u000f��v:�Lu��I��P�\u0007�Qn����%�,\u001aݝ��\u001f;}v��HϨ�w�\r8_4\u0013D�&\u001a.�٨�)������$%�D^�\u000b�\ncfm��oA���+\u001a��C��\u00026Q��}V\u000f\u0005\u0003��\u0003J���4Gڀʊ�lo&\u0005ƪ�\u001d��n\n����_�\"�������\u0005oy��y�P��U2�\u0004���Q1��r��H�\u001d�\t��\u0000ʪ�NX�O-�[\u0015��ó#�B�d�M,.K\u0012�ro����P","payload_hex":"eb2a2b024268ddcf12cf26e5a8e413b7d5e76067298e550fa2301068ef6cd2ea20f40c42801ef5610184b412f8eab8fad7a4e0d5b34f2f9a4cce1e9d12b74eadc80ac90f3dd28a2a115ad4543690eb2a3cdfa4316a9b3c359436a9bff5a144d39ffdac1a8e8d301aeccb20bdccf362201c0fbfad763a9a4c75b19149e79550e407fd516eedaa8c9425d82c1add9da6961f3b7d76e0f848cfa8f677990d385f341344b7261a2ec6d9a8e129baa7feb884f524259c445eca0bdc0a63666d88c26f41a580932b1aa1ac43efcd023651fcdb7d560f0503a9a8034ae3bef63447da80ca8ada6c6f2605c6aae21da7cc6e0ab8f197b65fd422c9f8fbf3eb87df056f79f9bf79be50c0cf5532cc04a882a05131aba67288d748e71db3098ac900caaaaf4e58c24f2dea5b15a8e7c3b32397428564824d2c2e4b12cd726fbb9feac950","method":"","user_agent":"","ja3":"","session":"d199a535-3471-4384-a02c-3e0b50421b83","seq":1,"duration_ms":100,"bytes_in":319,"bytes_out":14,"enriched":{"digest":"3a8dc262180d50fb","strings":["M,.K"]}},{"timestamp":"2026-10-02T03:02:42","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-.*NHASVSxkKf","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d2e2a4e4841535653786b4b66","method":"","user_agent":"","ja3":"","session":"9fffe062-76b4-4481-9020-2559c8f21dcc","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"7426756aa384e23e","strings":["BitTorrent protocol","<-UW160N-.*NHASVSxkKf"]}},{"timestamp":"2026-10-02T03:02:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�|f�C5�(c?�D�\u00056;\u0016�gH�tg�&Dw\u0001W�X虔��\u0016��F�o�U��a_�7���P�I/�*�td���\"ݥV뗛\u001c\u0002�O��kK��\u000f�O\u0006W9\\��p�\u0011M�sZ�=��H�}�\u0015\u0019����'��!b[����v\u0007\u0006�\u0011�\n�\u0018o�\u0000������A��š\u0019!\n7\u001e`��#�%���t\b����6E�+���,�\u001b�\u000en�c�?\u0004(\u0013���4ئ���۱�/yc\t\u0004��a�C�\u000e0y�ѹ��","payload_hex":"de7c66ef43358d28633f91448705363b16f36748947467b02644770157c258e8999486a5168bdd46816f855589d4615fdb37a3be965081492ffb2af5746481fa9922dda556eb979b1c02fd4fc3f36b4beeb80f954f0657395ce18970be114dd4735aac3d8ec948fc7d88157f199cfad4ea27eb9721625bdde5cac67607068d11850ac8186f8600f7bcfa95e7ff41becfc29a19210a371e60d2c0239d2585bbea7408d4d9e4d33645ff2b8ea4bf2c911be80e6ebc63d23f042813b8ceec34d8a6ff9894dbb1cb2f79630904ba8e61ce43fb0e30799bd1b9e29e","method":"","user_agent":"","ja3":"","session":"b8fbf499-04fe-489d-9406-4442509832b2","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":14},{"timestamp":"2026-10-02T03:01:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-6m.eJN.ZwO*a","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d366d2e654a4e2e5a774f2a61","method":"","user_agent":"","ja3":"","session":"d075ea23-dc46-44ae-9738-cbf2617b7486","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"d6dfed6435fc8f76","strings":["BitTorrent protocol","<-UW160N-6m.eJN.ZwO*a"],"iocs":{"domains":["uw160n-6m.ejn.zwo"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T22:22:58.357024+00:00"}