{"ip":"179.6.26.137","total_events":1047,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,047 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["1,047 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"221,566 bytes sent","bytes_sent":221566,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-04T06:46:21","last_seen":"2026-08-17T21:53:12","events_24h":0,"events_7d":133,"geo":{"country_code":"PE","country_name":"Peru","region":"Lima Province","city":"Lima","lat":-12.046,"lon":-77.0305,"asn":12252,"org":"America Movil Peru S.A.C."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as12252","label":"CLARO PERU","category":"isp","url":"https://www.peeringdb.com/asn/12252"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1047}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-04","count":416},{"date":"2026-08-06","count":400},{"date":"2026-08-07","count":98},{"date":"2026-08-17","count":133}],"recent_events":[{"timestamp":"2026-08-17T21:53:12","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-nTlaKOKCRx2q","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d6e546c614b4f4b4352783271","method":"","user_agent":"","ja3":"","session":"d05aec14-f462-432b-b8d8-517032c3e192","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"48f8ab61c0a195ff","strings":["BitTorrent protocol","<-UW1609-nTlaKOKCRx2q"]}},{"timestamp":"2026-08-17T21:51:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"U�Ry\u0010��K�\u0011�\u001dw���Ӟ�O\u000f�I3�{���J�\u001bQ#���O��s����u��S\u0002\u0016�\u0007�u��\u001a�t$Ǚ@�;49�k�\u0010\u0004\u0000�\u0006\"�W���\u001d�\u0014�T��-t(z��o@�\u0000�\u001c��EE��\u0017�zq|?��\u0019��\u000f��B�\u0010i\"�\u0015p�z\u0013_�Oa��\u001b�8YS���~��\u0004\u0000��`�ZVŞ��\u001b0w�72������`j�\u001b��*��x0tY��~��\u0004�����j�S�\u001b�%��2)��:\n��r9\u000f�É'�$\u0015�\u0017\u000e�5XW1�`f�ʭJG�Wz\"-(�Hѽzi/\u0005�QP�\b\u0011���c�\u0017�\u0013Fr����s\u0019�\n�\u001f�n��}�V;�\u000e�.\u000el\u0003�\u0006\u0001����\u0013�k\f\u001c��\u0019\u0014F��\u0017䛽a\f�H���\u0018\u0019��:��\u0012�a[\u001dv��\u0005\u0015�\u0000b� �����k%��X΍\u000fa#iL�\u0005\u0005M�\u000b�%�&��\u001b�_\u0010Y8��う4\u0018\u00067|D8�NZ���l*���\u0015cg��PҦI��m�\"���Wc��\u0012�\u0012p��M�|���陦J������v\u001dwB)c�\u001a[�G","payload_hex":"559a527910b7da4b9411801d77998d92d39e964f0fc24933c87bcef1cb4abd1b5123c2e7e94fe4c873fdfbd0c475c1dc530216c307f775f69a1a867424c79940d83b3439e46bbc100400910622a757bbbe9a1db814a254a1912d74287aaafd6f40d800d91c89884545bb9e17bf7a717c3f9c96199de20fb6f7429e106922971570e87a135f9b4f61a0e91bfc385953ff9a8f7eccd1040083ec609d5a56c59e95f81b3077f43732aded97e7e6b3606aa61bfcc62a8dad78307459c1bc7efefa04fcfe9dfa956ac653ec1b9325bccf32298db43a0aafcf72390ffdc38927b9241582170e8b355857319f606696caad4a47b0577a222d28a648d1bd7a692f05d251508e0811dfd5eb639e17bd134672aafd90f37319d50aab1f9b6e80b07dcc563b940edc2e0e6c03c30601c2e5e2c813936b0c1c82a3191446e58b17e49bbd610cb048a3a3e41819f6f93aa2ac12b2615b1d7691c605159c0062e320d1f5a6808e6b25a9f958ce8d0f6123694ce605054dc60b9025d1269d8f1bd25f10593882c8e38186341806377c4438c54e5a81b5cf6c2a8bb5fc1563679f8a50d2a64986f56d99229efe85576399f012df1270f1ae4d927ce997dae999a64aeab5c6fbc0bf761d77422963f71a5b8947","method":"","user_agent":"","ja3":"","session":"d6622825-9aab-46d8-937a-0972388f760d","seq":1,"duration_ms":100,"bytes_in":459,"bytes_out":12,"enriched":{"digest":"d934ccfd1718dbdf","strings":["-t(z","zq|?","x0tY","5XW1","Wz\"-(","a#iL","7|D8","wB)c"]}},{"timestamp":"2026-08-17T21:50:28","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-H!s8B5V7TOt5","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d4821733842355637544f7435","method":"","user_agent":"","ja3":"","session":"a378ef3f-7039-4f74-beaf-9386fee4b6f8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"0bdd02cf5e0e7e71","strings":["BitTorrent protocol","<-UW1609-H!s8B5V7TOt5"]}},{"timestamp":"2026-08-17T21:49:15","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":",};���i�,3n��z�\u0018\n\u0011m�{)U�;�h��\u0011�9���w�\f\u0017:\u0012\u0019Ik'l/ؼu����s�Kɛ���>\u0007\u0003ta\u0016�\u0005=zZV\u001b��9Q,E�\u000b\u0017\n\\\u001eW��%�P�c*��v�;�Ě����H[ϝ�W�\u001e<ǰ\u000e1\n�?e�\u0006�2;%��\f��\"�]լ�i���˲\u0002�:��a59��,(\u0005OB���9?���\r>�WjL�����0�sO\u000f$�sat�Y6���V��Գ3�Y\u0006;eJOs�\u001aE�F�����{��Z\u0012�᥵iN�L�N5��R\ft��,�#�K�,BݥFpߖmf��\u000e\u0003��_���³U� %S\b�*���I��4�N}\u001d�9\t]�K�pˠ\\ʋ���6c�;k��#�*\n8%{\u0010�\u000f�E�\u0015\u0002��\b$�b��\u0013\t~���Nv�p\u0017�|ɞ��\f!�\"��\r[\f�>~��47��\u001c�\u001biIv.��\u0013LR��f���Q牭��ut2N�a\f�;]�*s5��Ai2ŷɛ���ž�\u001e8\u0000\\�B0|�p󬿍����s>\u0003�\u001bM�I�IETթ�.�J�'�\u0010��\u0011���R۽\\\u0011�K�Ybb�+\t@���e��\f�v����z N\u0000�4�[�m��%KW���=�X\u0018\u0006ط>>���\u0014��أ�U�\u001b\u001d|Q�\u000fc�p��)\u001f\\����an�'S&ԉ�}��\u001aC!��1/a�\b�a��=8��;���\u0016��\u0000�@\u001a","payload_hex":"2c7f7d3bffbde069b62c336ea7d97a9e180a116d9a7b2955f93bee68b68f11db39ee9fe177de0c173a1219496b276c2fd8bc75818f8fac73d74bc99b97f9ae3e0703746116da053d7a5a561bf39039512c45ce0b170a5c1e57a6cd25aa5081632ae09476c43bb7c49adfc1b0f3485bcf9de857d31e3cc7b00e310afc3f658706ca323b25f2fd0c96b8228e5dd5ac8869f08693cbb202c13ae7df613539d4d32c28054f4282f49d393f9090a50d3e94576a4ceddcfbff8830f5734f0f2495736174d85936d8dbf25697b2d4b333b559063b654a4f73ad1a45d046ecc6f5f3b07bbbe85a12e1e1a5b5694e854c994e35bbd1520c74aefa2cd923b04bdb2c7f42dda54670df966d66b5bb0e03a9f75ff4ccdbc2b355ee20255308f82a93a3c0498bea34b34e7d1dd639095dd84b8c7f70cba05cca8bacb0bc3663c43b6b95e623a62a0a38257b10ca0fd545e61502f1850824a5629b9d13097e919dbc4e76e17017937cc99eaae00c21fd22b4f00d5b0cca3e7ebfae3437f6ea1cc01b6949762e8af7134c52b9be66a5e1ee51e789adf4ab7574324ec1610c823b5dbf2a7335fe98416932c5b7c99ba6b596c5be861e38005c8f42307cd170f3acbf8dfae5f6a6733e03d41b4d84499c494554d5a9b42eb04abb27fd10b6d711a5e9b252dbbd5c11c84bb7596262c32b0940aaaf9365f6b10cc176e7affdc67a204e0080349c5bfa6d87b5254b578f85bf3de6581806d8b73e3eb4b6d614ec9ed8a39955af1b1d7c51b80f638c70fdff291f5c9788b1fd616ee9275326d489ef7db9d41a4321abff312f61cb088d619cfa3d38c6ec3b84ffbf1687ef0096401a","method":"","user_agent":"","ja3":"","session":"0a375ba9-8f52-4fa4-81cf-08f423a2cdd3","seq":1,"duration_ms":101,"bytes_in":600,"bytes_out":12,"enriched":{"digest":"a0f96d2df5c88e8f","strings":["Ik'l/","=zZV","9Q,E",";eJOs","iIv.","ut2N"]}},{"timestamp":"2026-08-17T21:47:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-KQ(t(PYss4V!","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d4b5128742850597373345621","method":"","user_agent":"","ja3":"","session":"b3330cc1-d5f9-40a5-a605-9ed818a4851c","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"e00a332aeb295a7f","strings":["BitTorrent protocol","<-UW1609-KQ(t(PYss4V!"]}},{"timestamp":"2026-08-17T21:46:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�@�H?��)�AC}��7\u001a\u0003���\u000bv��=gG�O�ݷDU�ș ��\u00190���>^*�R�c�9S\u0007�iqO?l\u0005/���V\u0016+�5/u�b�*�\n�T��e͊�\u000e�\u001fb�a\u000b#\u001dl���\u0012'�\u00175Yu�\u0011\r)ٲ�����\u0015i�\u0001�\u001b|p�\u0006}?\u0005`�\u0014N���\u0002Ă���\tZSʓ@�9'DJ\u0001���\u0011I\u0015|\u0010�\u001aY�","payload_hex":"8140ba483fc8e629b541437d9fac371a038dcaca0b76bc9d3d6747cd4f9eddb74455e5c8992084a4193084f0b03e5e2a8352b963a83953078369714f3f6c052fedf7c056162be4352f758362a12ada0aea54e9ec65cd8a9f0e901f629a610b231d6c96b0a012279a17355975df110d29d9b2a78d85bea21569d201b81b7c70c8067d3f0560cd144ec7cdcc02c482bab9c1095a53ca9340993927444a01e3d6e61149157c10b51a5993","method":"","user_agent":"","ja3":"","session":"4ae6e882-d7c5-4eac-867f-f89f33888718","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":12,"enriched":{"digest":"b1c021ffb697a627","strings":["iqO?l","9'DJ"]}},{"timestamp":"2026-08-17T21:45:00","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-5WZ00j7Yjr-~","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d35575a30306a37596a722d7e","method":"","user_agent":"","ja3":"","session":"20a4b8cc-db89-42bb-88eb-8cead0d45e87","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"b80c0f7c4791eb18","strings":["BitTorrent protocol","<-UW1609-5WZ00j7Yjr-~"]}},{"timestamp":"2026-08-17T21:43:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cb`��\u001f\"��z\u0016\b\u0019pW�<��9\u000640B�=\"\u0000���A����\u0002�;M�\u0018t�X���L��hiz.\u0000˰0�G\u0003�\u0000�okOq�׌j���L^�\u0006S7\u0006c�mF\u0001��u�䪳^\u0019aC�щ_�\u0012�L+�2�cz��һ��s h����=e��\u0006#w���a�%=����\u0005I6@�A�����\u000f�\u000e��|��x","payload_hex":"6362608a9b1f228f947a1608197057bd3cc4ff3906343042bf3d220094f3d141e7f9f4d702823b4dec187491588bc1c14ceabf68697a2e00cbb030dd47039400e36f6b4f71cdd78c6a94a9f84c5e970653370663c86d460186bb75c0e4aab35e196143e9d1895fda12ba4c2b9232d4637abae3d2bbc1f17320689488cdd93d65a0f606237796baa561a8253da0829e9b05493c54938f69a408a727478addf117171d9c0dee7655edf8e88153d3eb5cb2ffb1fd4a389eec2926d7d1c342497d7dc6a902bd04a59ca3e66afaf7593250eb83cb8f731348652fa412b194106103f7cc52afd103cd87154b38f4edeeb406a3e3232e1d10448e411534ff3be8b9f028411e59f5c27c937ac83dc4fec7bee0a5e6b54ec247106579e0d5deb51743cdd607df3d2f597cbd1435666f6724ac4188186ce4131899ed57e1e8355ffd7c523bb4c075b5f2a8e72b1914aa77ca3630a2b5f92f15a5778fcdb0fe028d5f0491b9b2b4e3c86339ecd437f518666abb4b25bf7215711129eded54fb2d65202d1e9a962b4d53499f553012f496e05b9e3021b5c9c037d5eea88bcc4d39f31da98ecfd11d06c99824f97387d193291807d075ecd351ef37aaf7c832b73cf2ea748b3a49c95bb46d09eec482a6270ba8286abe438646f7c00268c926181b212813f724a2a437b5f0781b85d5aaccc7f9c666f167d1e878486960fcd0adcf0c1bc8dcae7024a3eba315939633b1f3f4dcccfa4261d382ab198509bd47af669e918c0ba6b2706d85ade09f5cc3ec6b6be69635ef56494f4f94eac7e4bcbb5c799f34580e2477b3c4f99bfc40683e3640a6419d8df99d870fc10e8dfb7cf58378","method":"","user_agent":"","ja3":"","session":"7ae52bd6-6f4a-4aeb-ac85-c1460dfb619a","seq":1,"duration_ms":100,"bytes_in":604,"bytes_out":12,"enriched":{"digest":"03f709fa792bce3a","strings":["hiz.","okOq","BI}}","=/Y|","5fog$","-e -","+MSI","xHi`","VIOO","@h>6@"]}},{"timestamp":"2026-08-17T21:42:17","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-jM.BiwkIF*Ad","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d6a4d2e4269776b49462a4164","method":"","user_agent":"","ja3":"","session":"365d76d8-39bc-431a-bb2b-5de719b146f1","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"5a27858984d31ace","strings":["BitTorrent protocol","<-UW1609-jM.BiwkIF*Ad"],"iocs":{"domains":["uw1609-jm.biwkif"]}}},{"timestamp":"2026-08-17T21:41:04","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C$o��4�7�ܠG<=KcJE�H����\u0015��\u001a|\u001e�@}\b(�<�΁��ʸ��\u000bu�)�3��\u000eY[�\r�$�^�3\u0003�2��\f�37��hDŽ�����E@&�&��\r\u0000\u0015�y�\u000e�k\u000bP��w�/�]�#?驖�ͣ.\u0019�ۺ�g�\t2M����8���G�A`�\u001f\u001d��� ���\u000f���)~M�\u00109�C<�ˁ>;���Z���\u000e�(����mie:#�x\u0003S�B]\u001c��žiE{\u0018�c�ކ���\"L;�jx\u0011P;j\u001dv�k��\u000e-\u00015�gFgB���G