{"ip":"179.219.161.152","total_events":89644,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"89,644 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["89,644 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 21435s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"46,709,918,784 bytes sent, longest session 21435s","bytes_sent":46709918784,"session_seconds":21435,"persistent":true}},"first_seen":"2026-08-18T23:37:54","last_seen":"2026-08-19T05:35:09","events_24h":0,"events_7d":89644,"geo":{"country_code":"BR","country_name":"Brazil","region":"Rio Grande do Sul","city":"Porto Alegre","lat":-30.0273,"lon":-51.2353,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"b3dba198.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":89644}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":8709},{"date":"2026-08-19","count":80935}],"recent_events":[{"timestamp":"2026-08-19T05:35:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��=","payload_hex":"f0ff3d","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89116,"duration_ms":21435182,"bytes_in":926678,"bytes_out":1336680},{"timestamp":"2026-08-19T05:35:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"8�$Ʒ�","payload_hex":"388424c6b7e4","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89115,"duration_ms":21434768,"bytes_in":926675,"bytes_out":1336665},{"timestamp":"2026-08-19T05:35:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">Fs/\u0019�擄�","payload_hex":"3e46732f19fee69384c8","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89114,"duration_ms":21434496,"bytes_in":926669,"bytes_out":1336650,"enriched":{"digest":"921af8147db38e71","strings":[">Fs/"]}},{"timestamp":"2026-08-19T05:35:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0014Z\u0018|��","payload_hex":"145a187c86d1","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89113,"duration_ms":21434160,"bytes_in":926659,"bytes_out":1336635},{"timestamp":"2026-08-19T05:35:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u000e�Y�����","payload_hex":"870ec6599cedcac7c6","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89112,"duration_ms":21433777,"bytes_in":926653,"bytes_out":1336620},{"timestamp":"2026-08-19T05:35:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���~8�\\\"","payload_hex":"e6d0d97e38fe5c22","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89111,"duration_ms":21433563,"bytes_in":926644,"bytes_out":1336605},{"timestamp":"2026-08-19T05:35:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ҙ��ry�Nv�","payload_hex":"d299efb67279944e76f6","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89110,"duration_ms":21433145,"bytes_in":926636,"bytes_out":1336590},{"timestamp":"2026-08-19T05:35:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�O�Dz�n�2�","payload_hex":"e94ffbc7b2f36eb53289","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89109,"duration_ms":21432820,"bytes_in":926626,"bytes_out":1336575},{"timestamp":"2026-08-19T05:35:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��ԟ�C�\u0011","payload_hex":"9085d49ffc43ff11","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89108,"duration_ms":21432523,"bytes_in":926616,"bytes_out":1336560},{"timestamp":"2026-08-19T05:35:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\\\u001f","payload_hex":"fd5c1f","method":"","user_agent":"","ja3":"","session":"85890655-2ae8-426e-b6a5-bb3913bca296","seq":89107,"duration_ms":21432077,"bytes_in":926608,"bytes_out":1336545}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:23:02.374297+00:00"}