{"ip":"181.117.113.19","total_events":652,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"652 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["652 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"136,656 bytes sent","bytes_sent":136656,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-12T03:33:24","last_seen":"2026-10-03T01:33:43","events_24h":0,"events_7d":232,"geo":{"country_code":"AR","country_name":"Argentina","region":"","city":"","lat":-34.6022,"lon":-58.3845,"asn":11664,"org":"Techtel LMDS Comunicaciones Interactivas S.A."},"source_domain":"host19.181-117-113.telmex.net.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as11664","label":"CLARO ARGENTINA","category":"isp","url":"https://www.peeringdb.com/asn/11664"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":652}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-12","count":27},{"date":"2026-09-21","count":247},{"date":"2026-09-22","count":69},{"date":"2026-09-27","count":77},{"date":"2026-10-02","count":155},{"date":"2026-10-03","count":77}],"recent_events":[{"timestamp":"2026-10-03T01:33:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L����\u0014�*YK@M���\u0004\u0003�M����xV�f\u0007>\u0004�yH�#\u0015�aG�j\")'�'�\u0010\"\u0013\u0003\u0018�S%Ԙ�\u0019�lV�D\t�D*5�a6mE�Z�\u00184�\u0014�k�\u0002'�\u0016�_�oIVc\u0007����[v9\t�I<�ڷI���)�x\u001ca���\u0015-�����kВ9��\u001c�\r��3���\"���N\u0004\nй�<5�~�\u0017���D~��\u0005Mf<��xI������N���\u001e\u001f?���W��e��|��J,\u000b\u001d������l�n�\u000e","payload_hex":"4cfa85b4c014a92a594b404d86f2960403d44dba8381e27856c766073e04de7948af2315c86147dd6a222927a227a71022130318c35325d498e019906c56fe4409ad442a35f76136c28f6d45ae5a8f1834da14fe6bb10227af16aa5fb56f49566307b29be6ac5b763909cc493cd4dab749d3f29d2982781c61f9daee152ddce694f6ef6bd09239c2e51cea0d9aeb33abe7d522f189fb4e040ad0b9dd3c35cd7ecf17a6958d447f7efdff054d663cb8cd7849978ab7f1a1f84e8793991e1f3fe2cbf93c61b7f587a955895bd53718849f4564ad054017f7adf6069c817b1759c7aa143c4f85c9834a9fbdc8d42e76927b2773d9856bb4c7ee225ebf22fde292f9ff1a78b2fcf97da8b8380adf187eb5262b670c0ec5ba433c47bd00c130558f045edb90c1608bbaca3230be814d028d273e578be665f1ea7cbaa24a2c0b1dfca89598fafa6ce86ec40e","method":"","user_agent":"","ja3":"","session":"089bd992-af3a-4503-894d-19406c517a9e","seq":1,"duration_ms":100,"bytes_in":329,"bytes_out":14,"enriched":{"digest":"7c1a037081494acc","strings":["*YK@M","j\")'","oIVc"]}},{"timestamp":"2026-10-03T01:32:24","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-AM!mnn3J9Qqk","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d414d216d6e6e334a3951716b","method":"","user_agent":"","ja3":"","session":"faa3531c-af30-4ed5-b171-5ffd5077f41d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"07b703d7244c1e24","strings":["BitTorrent protocol","<-qB5140-AM!mnn3J9Qqk"]}},{"timestamp":"2026-10-03T01:31:10","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���ϐx�\b�\u001a�@\u000b�/I�J���2n\b��\u0002��\u0002-���b\u001b���ǑuǪ���m�B��v��f���Cê�'[u��y�\u0018^��������\u001a��a�\u0001�dž�КF\u0000��\u001c��$N�D|\u001e}���;�(\u0016�&K9��\u0006u��H���\u000f�4�[\u0011�\u001f���MŮ[��Q�\u0013ou�L���~�q3�-��\n��V�B\u0013������h�q�\u000e\u001c�\u0016d�K ��f|�%�r�\u0000�p��+sx\\�4&c\u001fPxVj�","payload_hex":"cdec97cf9078c908eb1aa2400ba62f49ca4a9adee8326e08e3cc02fbf0022dd1d6de621b9ca9d6c79175c7aa9fbfae6df342ead776ae9366e2b5c243c3aaa2275b75e6ab79f0185edbe8f3caf58893a51aa69461b6018ac78691d09a4600c6cf1cbe95244ef1447c1e7de4e5853b822816c2264b39aad206759cb048b7b8de0fb034975b11b31fa9b7954dc5ae5bf3f951ec136f759f4c92baf87ecf71338a2da39a0abbb856cc4213939ed9f583df689071f40e1cb47f1664fd4b20ebb5667cf7259472dc00a27090842b73785cf73426631f5078566ad5","method":"","user_agent":"","ja3":"","session":"c912a42a-96c6-4074-b463-231497e0da08","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":14,"enriched":{"digest":"1a8d148ebe6d171e","strings":["+sx\\","PxVj"]}},{"timestamp":"2026-10-03T01:29:41","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-NK)qjEm~IjXT","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d4e4b29716a456d7e496a5854","method":"","user_agent":"","ja3":"","session":"0029f054-1660-432d-a966-00eb1bb2fa33","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"86e76fda72be4ca9","strings":["BitTorrent protocol","<-qB5140-NK)qjEm~IjXT"]}},{"timestamp":"2026-10-03T01:28:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"0C\u000b\u0018�\nwy2�bĤ�;�����[�2���-���1�ĝ�n���|�\u0003CQe�����D� 1�]�@���v�\u0002:\u001f7�\u0003'��\"�\n>�6�[\u0007l��m\u001c�?���\u001f`�w���:6(�%}eŤ�\u0016\u00187_��\u0014ˈ\\z��e{\u0013�S�_�����Iey0�s�Р\"(\u001d\nՈ\u0002�\u001d��d�'6�R3\u0011:\u0003���\u001f``�0\u001a\u0018��VVbĸ8\u000f���`�ˠ�\nn���y1�\u00127����u(\u001c��\u0012����y5���p�!*�\u000e������h׹M�ɝW@m\t.ˋ�j$\u001a�","payload_hex":"bd74e676d1a2eb33175a7f44caf68d90007957309ba59949f248d410a6ad98d5ec6342e6ffcfc73457206ba145f1ef3b9785f321ba28c880d72589e8ee6ddaadc6c0ad1eaa9bdb2b8a9e842cd171ec987ce07f93e413773950940cf783caab23523658c4df90ef9b8cdc01f3dfcd0628ad4a2b0c2220a42a0bbe8f90bb2f889679d61a1fcf0fc3b9015a479105b6d0f6f6474e7ee8fa02b3c5a02cb4513a3ee61f6060e7301a18cbf2565662c4b8380fb2d8eb60e9cba09b0a6ec0f1e27931811237b6cbc8ca75281c9bc6129a90f8d07935ab84fb7095212abf0eaafa86bf94bd68d7b94ddcc99d57406d092ecb8bb76a241a8a","method":"","user_agent":"","ja3":"","session":"b5d77982-61d9-4215-82d2-93adb46fab9b","seq":1,"duration_ms":100,"bytes_in":244,"bytes_out":14,"enriched":{"digest":"82f2eebbf763ce8d","strings":["4W k","#R6X"]}},{"timestamp":"2026-10-03T01:24:49","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-IOI_cwC0V_5C","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d494f495f63774330565f3543","method":"","user_agent":"","ja3":"","session":"09ab4e85-89af-4e0e-a08e-53395e306f0e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"c0d9f8bcd1dc93e2","strings":["BitTorrent protocol","<-qB5140-IOI_cwC0V_5C"]}},{"timestamp":"2026-10-03T01:23:38","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Y���@����P�2@'2��Ѧ�}�Mx�z�pL��\u0015����}�J�W�d6���\r[�+\u0012RٍnK\f��\u001bxKl~��_\t�\u0013��7\u001c3��@U�m�l��;7�)gA���\f8�ȍ�\u000e�.K��'௞��\u001b�7�I�G�;6?\u001a����d�\n��C~l`�Q\ty\u001c�@��\u0000��\u0006oK8�\f͢\u0015u�\u0002'Q�?nB\u0006Iߤ�a\u0013S:X��p�#C,��q�-\u0016\u0005\u0012\"�\n\tY��&��zn\r�\u0002\u000e�d��O�:�X[N�\u0018��k;.M���R\\�Q׹6�-���8\u0019ٚ؏�S�\u001b\u0015pP�Y�#�>��+\u0016\u0019�KK[U�c�h.M�q�\r�?�\u001b�h\u000f�Y�\u0017�w�h�\r4�\\\u000br�9��3�Ź�����ف�M\u000f�\b\u0012��\u0010�����O��x��\u0013�A�4\u0011�\u001f֛\b��\u001f�\n���\u0000b����@X�\u0002l��� �ņ\u0016�}\u0012/5Q���\u001b�\u0003���u\t�p�csv��=\u0006\u0004�Z\u000bw�����\t���q���e|T����\u0000�v�\u0017\u000f\u0002�g�ᔞa�\u001bT\u0011\u001d�Dž�dQ��\u0004\u00044\u0019���)Tk�\u0010CP;�Ѹ�u]K�lI��#�\u0018\u001c�Ԭ5]o\u0018�\u0011R����wj\r6;��Z�d�0������f��C���T�J��\u0000�cH�����\u0001��\"��n\u0017��\bU~H\u000eY#�)>8�","payload_hex":"855999a7a640dee4b6d150c032402732b8ffd1a6a27db74d78e87a9d704ceacd15c9fb88e27d844abf578f6436938ad90d5bfe2b1252d98d6e4b0ce7dc1b784b6c7e97ad5f09a31392d1371c33ee934055d26dd36c87fd3b377fe3296741af83a20c38f1c88d940e952e4bd0f827e0af9edaf81bae37fb49fb47d33b363f1ae08c83bd64a80af3fe437e6c60815109791cf84096a600f8d1066f4b38990ccda21575cb022751b33f6e420649dfa4bc6113533a5894a670e023432cb3b471b92d16051222b40a0959c3f6267fd9ee7a6e0de9020e9264d8c54f983a81585b4ecd1882956b3b2e4dc8efba525cfa51d7b936be2de1e8ab3819d99ad88fba53931b157050aa599b23a23ef4b02b1619f94b4b5b55ae6396682e4dfd71a40dc23fd41bc6680f937f59c317d177d668cc0d34d15c0b729a39edcf33fac5b9a7ffdad2fbd981e64d0ff30812f6e810b181a73c6dc5869eb51cca75db26441742fc797a9ceaf5a05b06c2e400e59cd4f11d5e347eb40900773d3e96994fa0ee78f1ac13eb41fb3411931fd69b08b58e1f9e0a809dd100629682e4b14058d9026cf7f7b320a0c58616807d122f355192ea9c1b98039485e87509d170fc637376e39b3d0604975a0b77f48bffd6e809bff0b771fa98b2657c549c8cb68000aa76ec170f02d367b7e1949e61b21b54111d9ac785a5645191900404341990a1c029546b8d1043503bb0d1b8cb755d4bb06c49e1af23cc181cf3d4ac355d6f18bd1152bfedfc93776a0d363be6ab5ab164f5309da6d5dae7b366dbdb43bfbd9154fc4ae9f200c56348a5abe085ef01c7f122f9c96e1783be08557e480e597f23af293e38c6","method":"","user_agent":"","ja3":"","session":"f15b59f7-5af9-4097-8810-764b6e3b3e29","seq":1,"duration_ms":100,"bytes_in":607,"bytes_out":14,"enriched":{"digest":"fa5c86b5427678b5","strings":["2@'2","xKl~","C~l`","k;.M","KK[U"]}},{"timestamp":"2026-10-03T01:22:25","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-.WNsSaT_U5Bp","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d2e574e735361545f55354270","method":"","user_agent":"","ja3":"","session":"b31cffee-7117-4691-8ad2-15cd3c51cd88","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"d2d5417380fe9f16","strings":["BitTorrent protocol","<-qB5140-.WNsSaT_U5Bp"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:50:03.786169+00:00"}