{"ip":"179.6.39.160","total_events":4333,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"4,333 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["4,333 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"899,778 bytes sent","bytes_sent":899778,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-01T19:40:35","last_seen":"2026-09-21T23:13:50","events_24h":129,"events_7d":1115,"geo":{"country_code":"PE","country_name":"Peru","region":"Cuzco Department","city":"Cusco","lat":-13.5228,"lon":-71.9665,"asn":12252,"org":"America Movil Peru S.A.C."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as12252","label":"CLARO PERU","category":"isp","url":"https://www.peeringdb.com/asn/12252"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":4333}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-01","count":58},{"date":"2026-09-02","count":155},{"date":"2026-09-03","count":224},{"date":"2026-09-04","count":29},{"date":"2026-09-05","count":229},{"date":"2026-09-06","count":487},{"date":"2026-09-07","count":287},{"date":"2026-09-08","count":379},{"date":"2026-09-09","count":293},{"date":"2026-09-10","count":348},{"date":"2026-09-11","count":82},{"date":"2026-09-12","count":159},{"date":"2026-09-13","count":184},{"date":"2026-09-14","count":182},{"date":"2026-09-15","count":262},{"date":"2026-09-16","count":119},{"date":"2026-09-17","count":229},{"date":"2026-09-18","count":106},{"date":"2026-09-19","count":153},{"date":"2026-09-20","count":215},{"date":"2026-09-21","count":153}],"recent_events":[{"timestamp":"2026-09-21T23:13:50","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-99SDQKhepW2S","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d39395344514b686570573253","method":"","user_agent":"","ja3":"","session":"24854bdc-92b6-43d9-aa4b-63785a684104","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"3b829583565fab95","strings":["BitTorrent protocol","<-UW160N-99SDQKhepW2S"]}},{"timestamp":"2026-09-21T23:12:39","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�]\u0003Y����ǔ�\u0007�y�����1X��\b�h_@T�����w�=v�e�\u0015#�����\f\u0004�O��/=\u0003�\u0003��.\u0003\u0004�\n0\u000e]��=\u0016K\u0012]\b\u001bM���\u0005%�\u0002�]�F�\n��\u0001ɼD\"��\u0018v\u0018\u0016\u0014���0��8^k\u0007���\rB\r�y �A�\u0005�K��}q,f\u0000t�e($�[٬�ܐF]�\f{\u0004��ϻ�P���\u001a\u0015.�\u0015��L�\u0012�0.��S-�n}{�n�}�>n,���ݼ7l,.7�*","payload_hex":"9b5d0359d9d8ec8ec794a907fe79a988d5fc953158bfb108fb685f4054a8b9baa1a677a83d76bb65d315238793c3f58d0c04894fff8d2f3d03f40389922e0304bc0a300e5d8df03d164b125d081b4df79dd005258602cb5da046c00ac1ad01c9bc4422fed01876181614feeca830d8e0385e6b07cdeab80d420d9279209e41e5058d4bc1db7d712c660074a5652824af5bd9ace4dc90465d810c7b04b7decfbb8350f3ded01a152e8415ddd74cd012d3302ed6c8532dd06e7d7bdf6e817db93e6e2c99cec2ddbc376c2c2e37cb2a","method":"","user_agent":"","ja3":"","session":"84edc66e-4c7a-493a-b1e6-49f0ec7511e0","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":12,"enriched":{"digest":"48bc8e512354b586","strings":["h_@T","}q,f","7l,.7","}q,ft"]}},{"timestamp":"2026-09-21T23:11:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-((9fS3i.N86V","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d282839665333692e4e383656","method":"","user_agent":"","ja3":"","session":"cde069f7-996b-42d4-af64-5b3df8b680c4","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"b38bb15e433828c3","strings":["BitTorrent protocol","<-UW160N-((9fS3i.N86V"]}},{"timestamp":"2026-09-21T23:09:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"!����\u001f�\u0016\u000b��/O�!�*��ĺ�\u000ff�8\u0012r8>���\u000e��g\u0005*��Ԋ\"c\u0004��������\u001d�.ÏgyO8`\u0004&��9\u0017�/V��\u001dN�Ec�\u0014\n�htj�o��G+�]�C|�U\t,y<\u0012��𻐍�\u0013��&U���c�F\u001f'�׊��\u0001���O׆�o\u0012m��5,�\u0015�Y��\u0005��\u0002\\�\f\u000e�x��\u001f�\u000b�\u0019��\u0011E��\\ր�%˃p�i���9g@\u001e;\f�`��M��\u0011�#+�@��Ě\"u+���ݏ�H\u0012X���j[�΂�F�Pɩ3ţEErAs�)\"�w\u0017C`�O���0��|��y-���g��Ka�\b�m0G���n�\u001cq.O�^a�>�\u0011z����\u0006���*��T��톑צ��\"\u000f���J�:j\u001aIn�!\u0011�\"�%FA��\u000e�ߍ�7d\rݖ��1","payload_hex":"218de6daf61f9a160bb7b92f4fb421a62aaef7c4baa80f66f8381272383efecbce0e858d67052aa3fed48a2263048ca1e1e3f6c0afdb1dbf2ec38f67794f38600426cae13917f92f56f9a71d4eb54563c9140a9a68746aa36faea2472bce5d8c437cd155092c793c12f787f0bb908dcb13c6dc26557f8ac08663ab461f7f27fdd78ae1f9018fd3e74fd786816f126db198352cfd158759f0bb0580a0025ce20c0ee978bd961fb20bce1983e3114580ca5cd680f025cb8370c769a9c4cd3967401e3b0c9b60f7884dabe411b5232bd3408dd2c49a22752b969dbfdd8fe9481258d3fd8a6a5bc7ce82e646c250c9a933c5a34545724173e82922a877174360f74ff2ffc330b8977ca7ec792d97f38e67b8e04b61b108c16d3047d0e2d36e901c712e4fb95e61ad3ee2117ae398eae506b9fdf92ab97fbe54a4b6ed8691d7a6d9c1220f82aa834ab23a6a1a496ec421118522b3254641bd960eb6df8d9f37640ddd96f79e31","method":"","user_agent":"","ja3":"","session":"cb23a8da-dd3a-4d6f-a5ca-21e754bebfa0","seq":1,"duration_ms":100,"bytes_in":356,"bytes_out":12,"enriched":{"digest":"6e792ee3463f2ddf","strings":["gyO8`","EErAs"]}},{"timestamp":"2026-09-21T23:08:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-871wX3zM9mrT","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d3837317758337a4d396d7254","method":"","user_agent":"","ja3":"","session":"7ba05164-f709-4a98-91ec-afa666b860b8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"db7469545e5c24a3","strings":["BitTorrent protocol","<-UW160N-871wX3zM9mrT"]}},{"timestamp":"2026-09-21T23:07:13","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"#G\u001f�4���\u001b�\u000bd?��{�/�t�ߒEs�QS��~΄7��\t\\88��0={p��뮨P�Ą�\u0006�\u000efmf�4I�\u00128�UUV\u0003��TX��`CD�\u0013z�k\u0013��Nҗs\f���\u001e�88���Zn\u0014�_Y���\u0011�\u0007_0݊�^��8=�\u0010,ܤ\u0015\u001e�\u000eU\u0011hWB���{!\u000bB`Tk�$)��\u001b��`lg����_^��:~=\u000b\u001d\r#8y�<����@\u0017J�\u0013T�~{Ԣo=\u0018DZ+�,5�p\u0007n�;@��D�R\u000fnB�\u001cj>js\rBY�_&A�\u0010 F�f��;\ru`�tו\u0010��^\u0013?�=Q�4\u0018��y\ta�\u0004t]9(�l�\u0001rP�\u0016>fp�L�3�Ik����K����S�\u00196\u001cá��\u0004\u0000J[-]k��\"�,�z����o��\u000e��\u000fo֍\u001d H_>P��8��}^a�<�\u0017\"D��\u0016�`'�\u001f\u001e���\u001d�����ڨ��\u0003[���\u0014-*�\u000f���Q]a�e�\u0017���\u001fb","payload_hex":"23471fac3495aead1bb60b643ff4de7bbb2fad748cdf924573815153ace87ece8437d2ed095c3838dcc1303d7b70b9a7ebaea850a7c484e806bc0e666d66dd3449b91238c555555603d7d45458a8bb604344f9137abe6b13aeb24ed297730c8b87ae1e88383897b7965a6e14845f5992bd941180075f30dd8ad85e9ac6383dd6102cdca4151ea80e551168574282e0ef7b210b4260546bad2429e8f91ba1d9606c67f7a99f8e5f5ed3d23a7e3d0b1d0d233879ca3c97abc5e140174a881354817e7bd4a26f3d18c7b12bb22c35e270076eab3b40abc344a9520f6e42861c6a3e6a730d4259da5f2641a6102046e46694e43b0d75609a74d79510c4da5e133fdb3d51a53418cae7790961df04745d39289f6c9401725090163e6670814cf533a7496b86d6e0d34b95bded9d53b819361cc3a1aea904004a5b2d5d6baaa122932ca77aa1a2add86fe3a80eb4a10f6fd68d1d20485f3e508da338fad07d5e61d53ce0172244a29416926027cb1f1ed8efc61df59c8affe5daa8a9aa035bb19ceb142d2aa80f8fe7ee515d6192659117b8c8ed1f62","method":"","user_agent":"","ja3":"","session":"4372503c-2775-4166-82d5-fdd3d0cd740a","seq":1,"duration_ms":101,"bytes_in":403,"bytes_out":12,"enriched":{"digest":"12d37b5cad6e6e8c","strings":["0={p","B`Tk","j>js","t]9(","J[-]k","H_>P"]}},{"timestamp":"2026-09-21T23:05:42","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-XSKpbTX~ug0D","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d58534b706254587e75673044","method":"","user_agent":"","ja3":"","session":"8eaeac5f-a632-4b36-b1b5-62abff306726","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"af871bb57f893868","strings":["BitTorrent protocol","<-UW160N-XSKpbTX~ug0D"]}},{"timestamp":"2026-09-21T23:04:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��̞\u0001���9V{{ar'm�078�%#�\tđ���_\u0018�cT�#\u000e3i�o\u00026�f�r\u001f��&�h��\u000b�\u000e1fZn�F�k�\"��v-r$\"���e�L�$���U�\u001c�;��K\u0003��\u001c0�&�m��M�\f6{L2�\u0018\u000fR