{"ip":"179.216.233.27","total_events":49997,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"49,997 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["49,997 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 27929s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"7,935,830,475 bytes sent, longest session 27929s","bytes_sent":7935830475,"session_seconds":27929,"persistent":true}},"first_seen":"2026-08-15T02:01:35","last_seen":"2026-08-15T09:47:04","events_24h":49997,"events_7d":49997,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"Sertãozinho","lat":-21.1373,"lon":-47.9818,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"b3d8e91b.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":49997}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-15","count":49997}],"recent_events":[{"timestamp":"2026-08-15T09:47:04","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"H�v�( �Z�","payload_hex":"48de76df2820b45af2","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48042,"duration_ms":27929011,"bytes_in":316886,"bytes_out":672516},{"timestamp":"2026-08-15T09:47:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�<f�\u0000���","payload_hex":"f43c66dd00edcac2","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48041,"duration_ms":27928448,"bytes_in":316877,"bytes_out":672502},{"timestamp":"2026-08-15T09:47:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"gLN","payload_hex":"674c4e","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48040,"duration_ms":27927937,"bytes_in":316869,"bytes_out":672488},{"timestamp":"2026-08-15T09:47:02","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"F��","payload_hex":"46b3ba","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48039,"duration_ms":27927334,"bytes_in":316866,"bytes_out":672474},{"timestamp":"2026-08-15T09:47:02","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scy�'","payload_hex":"736379f327","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48038,"duration_ms":27926818,"bytes_in":316863,"bytes_out":672460},{"timestamp":"2026-08-15T09:47:01","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"D\u001cl\u0004�1","payload_hex":"441c6c04ba31","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48037,"duration_ms":27926337,"bytes_in":316858,"bytes_out":672446},{"timestamp":"2026-08-15T09:47:01","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u001d�:I��{O","payload_hex":"eeff1de53a49b88c7b4f","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48036,"duration_ms":27925719,"bytes_in":316852,"bytes_out":672432},{"timestamp":"2026-08-15T09:47:00","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�s��","payload_hex":"9373ddfd","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48035,"duration_ms":27925117,"bytes_in":316842,"bytes_out":672418},{"timestamp":"2026-08-15T09:47:00","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���\u00187","payload_hex":"b1e19f1837","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48034,"duration_ms":27924597,"bytes_in":316838,"bytes_out":672404},{"timestamp":"2026-08-15T09:46:59","port":8080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013��","payload_hex":"13a8a6","method":"","user_agent":"","ja3":"","session":"b61d4eba-3398-418b-a938-60a465c12c54","seq":48033,"duration_ms":27923990,"bytes_in":316833,"bytes_out":672390}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T23:43:55.400114+00:00"}