{"ip":"179.48.106.10","total_events":29856,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"29,856 events across 1 port(s)","confidence":"high","network_type":null,"why":["29,856 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 7259s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"3,782,893,410 bytes sent, longest session 7259s","bytes_sent":3782893410,"session_seconds":7259,"persistent":true}},"first_seen":"2026-08-07T23:48:05","last_seen":"2026-08-08T01:49:04","events_24h":0,"events_7d":29856,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"São Paulo","lat":-23.5475,"lon":-46.6361,"asn":271073,"org":"MORAES NET TELECOMUNICACOES - EIRELI"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":29856}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-07","count":3495},{"date":"2026-08-08","count":26361}],"recent_events":[{"timestamp":"2026-08-08T01:49:04","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":")_9��x�","payload_hex":"295f39eeb778e1","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29657,"duration_ms":7259382,"bytes_in":245581,"bytes_out":385501},{"timestamp":"2026-08-08T01:49:03","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���","payload_hex":"b7e1b0","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29656,"duration_ms":7258497,"bytes_in":245574,"bytes_out":385488},{"timestamp":"2026-08-08T01:49:02","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\r�R�*�","payload_hex":"8f0dab52ee2ab7","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29655,"duration_ms":7257633,"bytes_in":245571,"bytes_out":385475},{"timestamp":"2026-08-08T01:48:56","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u00152kY","payload_hex":"fa9715326b59","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29654,"duration_ms":7251752,"bytes_in":245564,"bytes_out":385462},{"timestamp":"2026-08-08T01:48:56","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0014\u0012\"�","payload_hex":"141222da","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29653,"duration_ms":7251546,"bytes_in":245558,"bytes_out":385449},{"timestamp":"2026-08-08T01:48:56","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"k���;","payload_hex":"6b9bd0e73b","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29652,"duration_ms":7251402,"bytes_in":245554,"bytes_out":385436},{"timestamp":"2026-08-08T01:48:56","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��3�h�C\u001f","payload_hex":"93a833f668f8431f","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29651,"duration_ms":7251261,"bytes_in":245549,"bytes_out":385423},{"timestamp":"2026-08-08T01:48:55","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�r\u0017Ep","payload_hex":"e672174570","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29650,"duration_ms":7250614,"bytes_in":245541,"bytes_out":385410},{"timestamp":"2026-08-08T01:48:55","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"s�P\u001d�","payload_hex":"7394501d81","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29649,"duration_ms":7250444,"bytes_in":245536,"bytes_out":385397},{"timestamp":"2026-08-08T01:48:55","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\rl\f\u0011PO","payload_hex":"0d6c0c11504f","method":"","user_agent":"","ja3":"","session":"a614179e-ef45-4963-a07f-1adbc747498c","seq":29648,"duration_ms":7250268,"bytes_in":245531,"bytes_out":385384}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:13:45.716714+00:00"}