{"ip":"177.39.171.117","total_events":960,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"960 events across 2 port(s)","confidence":"medium","network_type":"residential ISP","why":["960 requests against only 2 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,736 bytes sent","bytes_sent":5736,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-01T10:08:00","last_seen":"2026-08-12T23:10:48","events_24h":0,"events_7d":956,"geo":{"country_code":"BR","country_name":"Brazil","region":"Paraíba","city":"Catolé do Rocha","lat":-6.3123,"lon":-37.7284,"asn":52768,"org":"Alsol Provedor de Internet Ltda"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as52768","label":"Alsol Provedor de Internet","category":"isp","url":"https://www.peeringdb.com/asn/52768"},"cve_matches":[],"malware":[],"top_ports":[{"port":21,"proto":"tcp","label":"FTP","count":957},{"port":2121,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-12","count":956}],"recent_events":[{"timestamp":"2026-08-12T23:10:48","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"7e4fb1f2-90c8-4ac9-b0b1-7e0f199cb1fe","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:42","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"5a89af98-2795-4647-a386-e4bd4fe3c111","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:37","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"17617758-77ec-49da-a884-caedbba906b8","seq":1,"duration_ms":101,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:32","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"b7655a5c-6e18-4f22-bd85-980c9fb7c2f9","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:27","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"5d6b97c6-cb01-4bcb-89bf-736b2d9f899a","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:21","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"a1004f91-604c-4f81-b931-38c5523da49b","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:16","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"ad00c118-07cf-460f-bb72-0b2d68f8dd5f","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:11","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"d35624cc-eda9-44d5-b2fa-b258cc9237ea","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:06","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"e7a534e3-d0da-4abd-8f55-6469d15ccc4f","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-08-12T23:10:00","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"d1c2f37d-237a-4dae-82c8-b06b685b67e6","seq":1,"duration_ms":101,"bytes_in":6,"bytes_out":34,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:22:40.979368+00:00"}