{"ip":"177.185.20.46","total_events":558,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"558 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["558 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"118,101 bytes sent","bytes_sent":118101,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-01T22:18:03","last_seen":"2026-09-04T20:29:24","events_24h":124,"events_7d":558,"geo":{"country_code":"BR","country_name":"Brazil","region":"Minas Gerais","city":"Lavras","lat":-21.267,"lon":-45.0436,"asn":28198,"org":"SEMPRE TELECOMUNICACOES LTDA"},"source_domain":"177-185-20-46.sempre.tec.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28198","label":"Brasil TecPar (Sempre)","category":"isp","url":"https://www.peeringdb.com/asn/28198"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":558}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-01","count":31},{"date":"2026-09-02","count":21},{"date":"2026-09-03","count":397},{"date":"2026-09-04","count":109}],"recent_events":[{"timestamp":"2026-09-04T20:29:24","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-0AMZ*FRJEQ*v","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d30414d5a2a46524a45512a76","method":"","user_agent":"","ja3":"","session":"206d5398-085e-402e-94ca-14e65fa8dcd1","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"eee984f2f7fa8300","strings":["BitTorrent protocol","<-UW160N-0AMZ*FRJEQ*v"]}},{"timestamp":"2026-09-04T20:27:12","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���,�6Fm\u001cB�6����f� �fw�k1��v\u001f_ް>�\u0014���d��22�M\u0016��Z\u0017-�iq0'`�˼v�9��xz�S�W� ��\u000e����\u0018�\u001ax�\u0017�\u001f{,cyZ��`�w���\u0016�˅�[��`\u0003��A�:(\u000b������\"\u0016\u0005��6�t\u001c\bS��\u001c\"Դ�.�\u000fp�Ԅ���o{\u001e����\n�\\U\u0005��\u0007\"6��Y�-q�d7\u0013\u000b�zR��\u001d2����x\u0007rC�\u0004��u\n��N=ϸ;\u00160I㠰C�x+WdJ\f�����F���3���n����\u001c�+ξ����`��#�8�t�]V\u0003hu��\u0001bc���i͖f�;�����6(\u0011��E �<;(A�\r��Ԃ��\u0019�1��3���ě>���͘\u0000'A\u0018|�u͏.��\"���E����u\u00113�x\u001c�����F]�~��$��ɝ�ǽd�76�.E��\u0017\t+-�\u0000S<���m�)%�Q�a�~G�VJ�k�##)�R��{f�9zӖ�O�w�a�+'���^�e[�]��xN�\u0001\u000b�c�1Ec[�����PJ7h��","payload_hex":"e1e2b12cfc36466d1c42ef36d0fea4de668920eb66779a6b31e7b4761f5fdeb03ebc149796bf648dae3232ed4d1687f35a172db66971302760f5cbbc76e339b9c5787ad953bc57c520cbd00ea9b08dc618df1a78f6178f1f7b2c63795ab4d9609a77a387c11685cb858d5bb9b36003f1d541ef3a280babe59aeafe9d22160596f13684741c0853aec41c22d4b4cf2efd0f70d1d484e0d8fc6f7b1ea2aebe8c0af05c5505bafd0722368fb759bc2d71bd6437130bd57a52aebc1d32e5f395a178077243be04a3cf750acbca4e3dcfb83b163049e3a0b043d4782b57644a0cc4fcfa98a646a2b49c33f792a76e91b792fb1cef2bcebeabaad4d560c0cf238738fc74cf5d5603687595f801626389faca69cd9666fb3b8ca8d4f2d3362811c2d04520e93c3b2841a50df6fed482e58819a431c7d733dccfd9c49b3e9af9cccd98002741187c9275cd8f2e82eb22b4afe545859280cc751133ab781ca1b9b7f1b8465da07ee9a324b5b2c99dacc7bd64d03736d82e45b8f417092b2d8600533c85f9fb6def2925e051f861c27e47c9564aac6b97232329ee529fb27b6689397ad396d74ff3778b61f22b2793c0835ed5655be15dbfc3784ef1010be563ba3145635ba5e0b6f5a5504a3768c09a","method":"","user_agent":"","ja3":"","session":"1b9aa09d-c45d-4ac7-a59b-f9562d4bc611","seq":1,"duration_ms":100,"bytes_in":459,"bytes_out":13,"enriched":{"digest":"e234df6d424d56ed","strings":["iq0'`","{,cyZ","x+WdJ","<;(A","1Ec[","PJ7h"]}},{"timestamp":"2026-09-04T20:24:40","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-ZrI1z9x3Um8~","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d5a7249317a397833556d387e","method":"","user_agent":"","ja3":"","session":"d799a86b-27da-4753-b3ed-c02b15ff4d3d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"22d5fce9c21a33d9","strings":["BitTorrent protocol","<-UW160N-ZrI1z9x3Um8~"]}},{"timestamp":"2026-09-04T20:22:27","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l����W��c�W��5�\u0016w|��\u001d\u0015��F¢>������\"-�%s}\"�i(0B�!����h�\u001c0\u001cQ�_�d�����1!\u0012_�݇c\r�'\\�ͤ2�#_����\u0010�6\u001c�'���Mh􆰫�f(\u0010�[�\u0014�+`�}-��[�P�ם�\"S~��d����\u0019�^]��[�@����\u0015\b3\u001f@\u000bc\u001f�+]����z$�OF�Q��џk\\k�κv��\u0012W�Xn$��p���J��S;�ڣ\b�\u0012�3�`2�\u00109Pљ��}��W1�:�\u000b~��}�\u0004�\u0011\u0003\u001f�\t\u0004�","payload_hex":"6c90bceee55797f063ec5799b935ba16777c8ee41d15bcf346c2a23ed0c4ea7fadefed222df225737d22fc692830429d218bac8d8268a11c301c519b5fef6499f9ec9de63121125fb3dd87630df4275ca0cda432e9235f9f90e3e510cf361ca827a691e04d68f486b0abaf662810e35beb14ad2b60817d2d89fb5bba50dbd79dfc22537eea9f64999ed9d619c55e5dd9d25bd9409990c8e01508331f400b631fbf2b5dbbb3cbd07a24d84f46e4519998d19f6b5c6bc0ceba76bba11257a2586e7f24bd8d70b5f8a34aafdb533bdadaa308e8128d33f76032d4103950d19982f87dfbac5731bb3a800b7ef8de7d9204b611031f820904d4","method":"","user_agent":"","ja3":"","session":"d2092067-2ccd-458d-b2c4-e92d127b1040","seq":1,"duration_ms":100,"bytes_in":247,"bytes_out":13,"enriched":{"digest":"dd50d2abc5d188de","strings":["%s}\"","i(0B"]}},{"timestamp":"2026-09-04T20:19:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-F72*a~yhFPpQ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d4637322a617e796846507051","method":"","user_agent":"","ja3":"","session":"d374b8be-e986-4051-ab68-e710e92547d1","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"ea5aee2e8735f82b","strings":["BitTorrent protocol","<-UW160N-F72*a~yhFPpQ"]}},{"timestamp":"2026-09-04T20:17:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�l����.�.O�:Z��7�7h���%D�]\u000b2i�\u001d�%\u0013�\u000ftZ\\�i(ėc�!B��j1 �2\b\u0019��0�I\u0016\u0003h%���\u001e��\u00183�>�g��\u0015�h9O��w�'��T/\u0012�1\u0014��J.���\u001d\u000e(G��ln�����\u000fU�0B����\u0002 ���\u0011q�\u0003�Ń��V�\u0006�ض-e��T�U�Rgo����2�\u0017C-o �\u0018�X'��o�\u0012���\u00112I�$W\u0013�G����\u0002\u000e\u001aH�h��R�p��Z\u001a���_��z����g�\u0015z>\t\u0005G���I\u0014\u0006;�\"\u0014��\u0017\u0017=f��+)|�U�\u0010k�2Ek�'4�aQEq\n���1\u0019�\u001e\u0014�-\rS(��\u0018rm�\u0013n�2\u000e�f����h$�\u0015����̅u!\u000f���\u001f5����\u0010��U>�dXJ�\u0014�^�\u001b^\u0005���|�\u000e�\u001e��\u000f8�#���G���_���!\b����$O=\u001f�\u001b\u0012^���\u0001�Oͅ\u001f���\u000f�c��\u0004��ù$���m��\u000fت�1\u001b\n}�@�\u0018[�}�.�f���j\u0017�*��?\u0007fڗ\u001a֙\u001dT�u},p�f>���g\u0002cɍ�:�\u0017�\t>�\u001b\u001bP�cT��F\\C��Ȓnr\u000f","payload_hex":"2d77f727a9a04b1dd126c3fd0b2af467723848efbee378981b7976d567e4c06db0937c63ab75fcfcc5d9a0c3912e240578fa943508ed9e2bf231191b93282fb3012668cf5171460b1c4eca1676562bcaf46766c5d66cc0b3c8997a7a85f24a02ab50ada310ab16cda95cf2771a3072814ca9b40141e4da3345a745eead5055dc49ef4342ae03797a596658d7cad23a304e638365559d66573b637af467d4b3e3a52d1836c6faa34cbed214bd6dd21a7aed61d5cc4bd3f70b47acc6e67e20583c0a252148e1a1446489c5394d2bba08e869333d64fea7672abd98c4a27f1d3071bfae8b38c669d15ce2aed97a970d79f018d716cce4e4684a56fefaefb2a7ff679a763e7d2c709e663eef8fd9670263c98ddd3a9517b9093ed01b1b50e86354b9dc465c43b8dfc8926e720f","method":"","user_agent":"","ja3":"","session":"30628f16-dddf-4d3e-9539-36fa32e6264b","seq":1,"duration_ms":100,"bytes_in":299,"bytes_out":13,"enriched":{"digest":"578e75c6a89fe9dc","strings":["gr8H","yzYfX",":0Nc","fW;cz","~ X<","i3=d","v>},p"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-04T21:01:50.874962+00:00"}