{"ip":"167.0.139.241","total_events":1930,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,930 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,930 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"403,330 bytes sent","bytes_sent":403330,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T19:57:39","last_seen":"2026-09-20T22:50:39","events_24h":240,"events_7d":399,"geo":{"country_code":"CO","country_name":"Colombia","region":"Bogota D.C.","city":"Bogotá","lat":4.6633,"lon":-74.0413,"asn":3816,"org":"COLOMBIA TELECOMUNICACIONES S.A. ESP BIC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1930}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-25","count":20},{"date":"2026-08-26","count":7},{"date":"2026-08-27","count":7},{"date":"2026-08-28","count":1},{"date":"2026-08-29","count":7},{"date":"2026-08-30","count":23},{"date":"2026-08-31","count":6},{"date":"2026-09-02","count":164},{"date":"2026-09-03","count":187},{"date":"2026-09-06","count":227},{"date":"2026-09-10","count":260},{"date":"2026-09-11","count":65},{"date":"2026-09-12","count":99},{"date":"2026-09-13","count":404},{"date":"2026-09-14","count":54},{"date":"2026-09-17","count":151},{"date":"2026-09-19","count":8},{"date":"2026-09-20","count":240}],"recent_events":[{"timestamp":"2026-09-20T22:50:39","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��- ����\u0012��������\u001a)�]�1U�T��N)ӹM1�_�M�s$���I�����Z�Cm�9•v,+�\u0010B�S����\u0003��\u0018\u0004IS\u0005#�\u0013\u001ar�z�yڼ\u0014>�\u0001���iI�:�\u0015/]i�p�","payload_hex":"89b02d209fdff9e612a591b6c5c4e5eff91a299c5de23155b954feba4e29d3b94d31f75ff44dc17324a4a5a349f296d2ec9a5acc436dc239c295762c2b881042ad53a8acb5f403b2da180449530523f3131a72f97a8979dabc143ee70191cddc6949f53ad7152f5d699a70ed","method":"","user_agent":"","ja3":"","session":"e0ee2fe7-a104-4a23-abf5-ccf1f84d739f","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":13},{"timestamp":"2026-09-20T22:49:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-T**TkY5j_!BX","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d542a2a546b59356a5f214258","method":"","user_agent":"","ja3":"","session":"beb9b73f-083c-4825-9e4d-40b6bf290d73","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"658e93704a25d3ab","strings":["BitTorrent protocol","<-UW160N-T**TkY5j_!BX"]}},{"timestamp":"2026-09-20T22:47:57","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"k�pE�u\u0017\u0011�?���S��}ؽ�\u001bg��\t˟~ظGN\u0018..߼�%.�~��8���CZ֣�\u000e>\u000e\u0010�T�\")�|\u000eG7g�m\f-Cۤ��$\t\u0017,��\u0000�nȇ�(�ʬ\u0011\u0005�\\���{��1�\u0005\tU�Z\u0005�j\u0013�{�hF��K�Jχ\u001c^�ޠ�\u001f6���\u0018ƹ��tQ��/���0yw�������+\t\u0007��<4�\u0001�⭑[��\u001a`�HWN��B�\u0015�\r��h8��ˮ1V\u001fQ�ɴg�6�JH7\u001f-�\u0004�#��\u0015%J�B�lV�h��\u0011x�A����Kʷ4#�\u0013���-�\u0003A�\u0001��ݡ:�b.��G\u0004� \n7\u00199a��S\u0014\u0013;\fT��\"5����ů���iP�);Z��\u0012�K�԰��_ږ�_��}\u0002�J\u0007�ʢ�Jg\u0010=�o�\u0001]�m\u0011\bkZ�Ȧ��\u0004\u0002s��\u001d\u0004��\u0010�kX�����\u0010�o��AԄ��\u0010u\u000b\u001c��l�E�$�a\u0012*I!\u001a`�\u0016\u0016����ioR�,�\rYIi�}/y���&CR���W�\u000b�vV���g\u001a��n���\u0018srx9��S��E�e�z��\u0017u,;VG��pڍ�����\u001f�+<�\u0003���$�","payload_hex":"6bc17045da751711833fc191d953b7b47dd8bdf31b679cfa09cb9f7ed8b8474e182e2edfbcce252ebb7e979238dacddb435ad6a3e90e3e0e10c154962229927c0e473767a96d0c2d43dba4f0b42409172cecec009b6ec887e928b5caac1105b45c9796e57bbd8631b40509558d5a05846a7f13cd7b8c6846aeed4bb74acf871c5ea3dea08c1f36a3ebeb18c6b988bf745189e32f8284d4307977cefaceefc4f4d92b0907aba23c34ca01e8e2ad915bc1c31a60e848574e85ad42f215e10d82c2683891becbae31561f51cac9b467ba36964a48371f2dc104e523ec8d15254aa842f36c569f6893841178b941eaabd5cc4bcab73423eb13a782b22dc30341dd01e8afdda13ab8622ebfd147049a200a37193961c4c95314133b0c5491bd2235a79191e7c5afd6c0cf6950d9293b5a8ab112e84bd0d4b084d85fda96ca5fe0d47d02b64a07e4caa2b04a67103d826fcc015df26d11086b5ae6c8a6bb8504027386a11d04f2ca109b6b588f86c097ce10f56ffa9e41d484e8f510750b1cfcaf6c9a45d024e461122a49211a60eb1616fce2bdc9696f52972cb20d594969847d2f7989f98126435296b3cb57e00bc6765696bdfc671a8ace6eead5d918737278399fe853adda45cf65ac7a7f9ae017752c3b5647c6fa70da8db1cffb8fb81f8a2b3cdc039ba99924d5","method":"","user_agent":"","ja3":"","session":"aff599dc-f491-437c-9275-a1080c4e6b01","seq":1,"duration_ms":100,"bytes_in":487,"bytes_out":13,"enriched":{"digest":"5a6b513f2acaf498","strings":["srx9","u,;VG"]}},{"timestamp":"2026-09-20T22:46:27","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-PF380n3vjjAy","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d50463338306e33766a6a4179","method":"","user_agent":"","ja3":"","session":"b069c37e-29f2-4097-89d0-74911730b411","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"0c2fbc0036f6c779","strings":["BitTorrent protocol","<-UW160N-PF380n3vjjAy"]}},{"timestamp":"2026-09-20T22:45:15","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�� �\u0017��\u0006)�K�ϕ��2[\u0002�=�]VoЊ\u0015e��\r)\u0005��^�;m;b\bVp�\f�l\tW���^�DŽ���$��w���3h���\u001c\u0003��v_s�Q�\u001d�<7}�\u0013��T�o\rD\rG�ɉ��xE-<2�&��\u001f/�\u0018��\tq.�>���ټM\u000eC�D�Pū���t�\u0016\u001c�6�V��%�\u0016��z�nfe$��6[�ķ��[��a�G����\u0016��4}=6�XM�-�,�C&�0o��V�b�g\\,��0.��W\n\u000f�G\u001c\u0012��\b����꼻�\b��X��F�mR�r�\t��!\u0015�$'ңyt_�\u0011\u00105�!�#悕8:��G�p�k�FF]Ǜ=F��A!5�9�\u0000\u001dڲ�\u000f����Z���o���ဈ%\b\u0007�� ��q\u0019��7͋A\u0005y\tXw�","payload_hex":"c8ca20d317bc910629d64bedcf95cbff325b02e33dda5d566fd08a1565bfa60d2905b3d25ebd3b6d3b62085670f30c956c0957d7fefa5ed2c78487f88c24beb277ddc0bb3368cdfd8d1c039dd5765f73b851f01dc63c377da513cae254ba6f0d440d4789c989d4c278452d3c328f269af81f2fb2189ce509712ef13ef5b7ead9bc4d0e43b144b850c5abe5e6bc74e5161ce3368956f0d325c916fca27aad6e666524efbf365bc2c4b7958c5b97aa61de47ab8afd841683a1347d3d36e2584da92d982cdb4326f6306fb8c356916294675c2c98ba302efc9d570a0ff0471c1281ab08c7fad6e2eabcbbb7088e8d58a9f946cd6d52b772e20984912115be2427d2a379745fcc111035c421b523e68295383af2cf47ed70ca6b8c46465dc79b3d46cbd1412135cb398d001ddab2c50fa0f9f0d25abaf4ec6f87f5b0e18088250807b8a22092c07119f09a37cd8b410579095877c3","method":"","user_agent":"","ja3":"","session":"16b83241-094f-4de8-9637-fa102c73b0ff","seq":1,"duration_ms":100,"bytes_in":339,"bytes_out":13,"enriched":{"digest":"a935aac897461985","strings":[";m;b","xE-<2","nfe$","4}=6"]}},{"timestamp":"2026-09-20T22:43:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-fwuJKZYn!*2.","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d6677754a4b5a596e212a322e","method":"","user_agent":"","ja3":"","session":"c30bf614-c199-4bb2-9b0f-b938ecb7cc2b","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"5411fcabd34f6f86","strings":["BitTorrent protocol","<-UW160N-fwuJKZYn!*2."]}},{"timestamp":"2026-09-20T22:42:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0010pT�c����&6�\"5�G��\u0005�c�[2l���\u0003!�m�\u000f�\\|�\u001fs�z���M���01��7�\u001d:p\f\u001a\u001d�uGAφ\u0016\u0006\u001d�9v`�^\u0019���\u0005����}#�����<6��T��yQ!��a�x\u001c�o)\u0014\u001d�F�0����z�h\r��ZI��BX\u0002�Q�-��\u0014�i�\u0005,5�1�\u0006\u0012\u000f��t","payload_hex":"f2d8107054d163eb94d8cf26368022358047e98c05d063ca5b326c919cee0321b56da00fb55c7c9f1f73f77a8dafc84da4f4a1303184f5378f1d3a700c1a1d83754741cf8616061d92397660935e19a68a8b05f8adb4d17d23a999b1fad13c36e79f54b4c7795121e3a961b2781cde6f29141da846ed30c0e6d7d27ab6680dfdd05a499182425802df51822d87ef14a269c7052c35ab31d706120ff8e174","method":"","user_agent":"","ja3":"","session":"bc7814a7-90ca-40af-965c-89dd7ba56397","seq":1,"duration_ms":100,"bytes_in":158,"bytes_out":13},{"timestamp":"2026-09-20T22:41:03","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-rpdUdbZgFWWY","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d7270645564625a6746575759","method":"","user_agent":"","ja3":"","session":"f17c58f8-3c31-489f-b93e-847365228168","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"fe9c05072b72ed96","strings":["BitTorrent protocol","<-UW160N-rpdUdbZgFWWY"]}},{"timestamp":"2026-09-20T22:39:53","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0000�w\u001f�H��O\u0012.��Y������{�,�Q�\fɵ�\u0000S�A��sg?�j�,�}sI�\u0004~�Gt����:z�i�u�x�:'Va^����_�k&�\u001c\u000eFQ��b���\u001e\u001c���rIE�I�OT�V_��\n�rӆ帽\u0019h\u001d��0�W��\u0007!�(CI!'e*��Y�\"�M�\u0007��N�)�J��U���j���}��\u0019�\u001aa�F��c�/�U������\f��&j�E�\u0003����fX�Ʌ9�\u001dP�0}�\u001c_;U�\r\u000bi0K�R\u0010m�r\u000e$J���B���fj9\u0005�IN��\f�\u0012\u0004������}�\u00061T��\u0000�3+2���]��\u001a\u0004St\u001cxsW��qH�\u001b\u0012k��R\u001c�Q�Á�T�\u0001s�vҦ�&\u001c�AH,Q�\u0006��~0�\u001d\u001e�Y\u0019�Q\u0013����t��a��D����D�vYq�\u0004���^@�\u001d�!�[��\rո��jFI\u0004\n\u0015(��&ǵ��������;)����$�n�3n��4��|�\u00016M�d�D��Úa@JN��%e�,��\u0010\u001f�z_���P\\��^��\u000eI��\u0012�\u0017+,a��.��z^@�\u0007\u0002Q�-��\u000b�z����\u001b�8r�i����C�~\"Č��I@� ���\\�ن}\fG�d����{)\u001cօ\u0012[�������Q�i�{\u0012�\u0004�O\u0016���gH\u0005��\u0000���7��\u0014\r\u0016$ ->u����o��P��ד|1\f��\r����Z.�n3�&�&�%n�","payload_hex":"e8ce00ab771fbf48c0bc4f122ea2c1599c84a584bb917b8c2c8351d40cc9b5ac0053b241a6fd73673fcf6a9c2cfd7d734991047e9f4774bbf4af813a7aac69c475a678d73a2756615ea0daedf35fbc6b26991c0e4651efa162c0829a1e1c98b58f724945f849804f54d7565fe9ea0a8772d386e5b8bd19681de69330be578de10721d72843492127652a889559d722ac4d9107b98b4e91299c4ae7ed5591f5fa6ac5e58c7de3d119ba1a61e446bbca63df2fa155bcc1fabea4fc0c87e9266aa845e203baaee99a6658ddc98539c51d508c7f307dab1c5f3b55c90d0b69304b8552106da7720e244abb93c94299a5de666a3905ee494ee2cc0c831204f7aea890f2b57df1063154d4c00089332b328188fc5d85891a0453741c78735784ef7148e31b126bb5b7521cec51bdc38198549c0173b076d2a6a5261ca941482c51b2069ff17e30bc1d1ee95919ec5113d8f0e8f67487a961efd844bd879797448c765971c904d6c8fc5e40a21db721f55ba8b00dd5b8d1f66a4649040a1528e9b026c7b5c2f380dee1aee3863b2985f888b224ce6ed1336ee2fd3496c57cd201364df164eb44bcf1c39a61404a4e9cd72565aa2ce981101fb57a5fa7fbd4505cddcf5ea6940e49fdb012cb172b2c61d0c42ed4ee7a5e40bc070251d02defc10beb7a93b47f91b41b863872c5697f9ea0e2f243f57e22c48c819649408f2098a7fc5cb6d9867d0c47c0648586e9937b291cd685125bebaffba07ff888c151f1697ffd7b12a904fd4f16ddddf4674805b2b500a4f4e43789b9140d1624202d3e759895b4986f8fbf50b1dad7937c310c938f0dae9ab8835a2e9b6e33ee268d2695256ea5","method":"","user_agent":"","ja3":"","session":"93e39195-02cb-4f54-bd57-49d88815a15c","seq":1,"duration_ms":101,"bytes_in":608,"bytes_out":13,"enriched":{"digest":"f7e36eb82547e5bd","strings":[":'Va^","(CI!'e*","AH,Q","a@JN","$ ->u"]}},{"timestamp":"2026-09-20T22:38:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-BTy)kDi6CIvs","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d425479296b44693643497673","method":"","user_agent":"","ja3":"","session":"cc2b19af-8462-4435-ad7c-a27c0cac32ef","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"cb276e0c54675f6a","strings":["BitTorrent protocol","<-UW160N-BTy)kDi6CIvs"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T10:40:39.954611+00:00"}