{"ip":"181.196.12.38","total_events":48,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["48 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 10,895 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,895 bytes sent","bytes_sent":10895,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T15:07:49","last_seen":"2026-09-17T19:21:21","events_24h":0,"events_7d":48,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Imbabura","city":"Ibarra","lat":0.3512,"lon":-78.1178,"asn":28006,"org":"CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP"},"source_domain":"38.12.196.181.static.anycast.cnt-grms.ec","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":48}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-17","count":48}],"recent_events":[{"timestamp":"2026-09-17T19:21:21","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N--W~gaKDP5Gq4","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d2d577e67614b445035477134","method":"","user_agent":"","ja3":"","session":"bb0a6365-54f0-4d05-8445-631942ba1bd8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"fa3be3b1c22101fc","strings":["BitTorrent protocol","<-UW160N--W~gaKDP5Gq4"]}},{"timestamp":"2026-09-17T16:08:47","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-wI.52VLNjede","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d77492e3532564c4e6a656465","method":"","user_agent":"","ja3":"","session":"f8558109-c2b3-4d0c-967f-c2ac0a986aea","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"baf8ccb9af4403bd","strings":["BitTorrent protocol","<-UW1605-wI.52VLNjede"]}},{"timestamp":"2026-09-17T16:07:35","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�9��\u0014����\u0013��$\b%�.𖒇X+��\u0017�@�S3V����Хʵ��u�ÅS�\tpƛ����pm\u0016�H�~��u�tq\t���I�9z�ۙ�`\u001b\u0012�s�\u0010‡\u001f9����%U�J6�\u0003�]a���@� o�o)���H�P�\u001cO�\u001e,�����HN\u0012Ո\\�\u001c��\u0016skR���≇\u0000��4\u001fr�\u000b\u001dY�-m�\u0005kY�i_��\u0006\u0004��@������n4���E`\u001f\u001d?�++\u0019\u0007�����D1iԀS�\u0003\u001c���C)ù���W�z��-��9L�k!\u001f�U�","payload_hex":"fb39fcf814d9eafdff13e391240825f02ef0969287582b91d917d940da533356b9f087d3d0a5cab5f08c75b9c385538f0970c69b97e2d4ec706d16e648967ebafe75f7747109848fb54989397a82db9997601b12d873c610c2871f3996b6beb02555834a36c703f55d61f9bcbd40d2206ff06f29ff81b148f450cb1c4fd41e2c8b81e0cefa484e12d5885cb91c95a416736b529ba7d4e289870093c8341f72d60b1d59b22d6dbf056b59f3695f80a70604947fa140e58af7ba96b86e349ee4d145601f1d3fdc2b2b1907bdcedffdf5443169d48053dd031ce9fff64329c3b9b88eef57d67af3f72db1e0394cc26b211fd755b4","method":"","user_agent":"","ja3":"","session":"7520baf6-0988-42cd-9563-1a33de143754","seq":1,"duration_ms":101,"bytes_in":243,"bytes_out":13},{"timestamp":"2026-09-17T16:06:05","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-EWXFxfhDluWx","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d45575846786668446c755778","method":"","user_agent":"","ja3":"","session":"c7207d12-a5cb-4544-ac32-1fac12852853","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"1cc8667fd46c3f26","strings":["BitTorrent protocol","<-UW1605-EWXFxfhDluWx"]}},{"timestamp":"2026-09-17T16:04:54","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{��2�Hݎ�\r��r=j���S����I�.�N><`t��6�^\b�K0*�]\u0018��3�����k�\u0011b�\n��&���\u0017\r9͏u��>\u000b~��\n��$Ϙ��́b\tG�@�Jg��\u0012��LkP��\u0010�=�zTr%�Q����y�[�\u001a��bҋ�[e�g\u0017��R\u0019�5E�;��rDF��\u0013Pe�\u0011\u0019E��\u0018B�\u001d*P�~4\"+/������\u0002_}�f�\u001f)B\u001c\u00042д�Gw�n�����)O^0����m\u001bI�I�d��^2e�.��-Hp��E��JLZ�\u0003@\"��j��\u0005\u0000\u0018(�۰��{h\u0001G(��E��?�3s�3�7V���؜<`t","zTr%","~4\"+/",")O^0","pM.cQi"],"iocs":{"domains":["pm.cqi"]}}},{"timestamp":"2026-09-17T16:03:24","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-Th-.C_r)k8(q","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d54682d2e435f72296b382871","method":"","user_agent":"","ja3":"","session":"8840a1d2-5266-4858-a83b-91543553c56d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"8c723a5d66fd04b6","strings":["BitTorrent protocol","<-UW1605-Th-.C_r)k8(q"]}},{"timestamp":"2026-09-17T16:02:14","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001b�K8��h�E\"�\n7(ǧ��|�=L\"�H\u001a\u0013]�\u0005\u0016���\u0007�\u0005���E��]�\u0006���9���n\u0013�Ų}Cp[�D؉���3Ƕڗ���Զ���~z�>~ w�\u0015�'\u0001��\"\u0001~�e���x�5�k�\u001a�\u001d�a�\u000b�컆\u0011\u0011�s\u00073وֶ���\u001b����~�\u0013<;�\u0002\u0002�m��\u0012�9R\u0003%5EWU\u0001�W�����\u0005,K\"`\"�����\n\nc\u001e�\t��\r��ƶ�¹��\u0002�A�>\u0010��-�H�\u0000[\u0015�\u0003aU'\u0011�r\"=��\n���~h����\u0002��\u0010W�����Z�\f����g\u0017µ\u0004��c\\ϺsӨ��\"�,7\u001f��Xf��y�E}ƃ�\u001a?\u0014\u0015z��I\u00188[�0����jS�\u0006��\u0016�\u0010\u0005\u0002�\u001bG�b��w�:__��6�q�H�C�\\oY1��\u0011�\u0004�\u001f}\rb\u0006��Uw{0�/�i)�D�⾳���7�!\u0019Ü\\���Ek�?�e�--�������K��_\u0010\u0004Qi���P��gV\"{�\u0015�\u000f�����$����L���Y�G4�Oq��\u0014\u001e��]#gF얮����u��נr���~�KM���\u001b�);��\u0000ʍ*�0���q&�`\u0005xD\r\u00013ߪ���X�����oh�\u00155S\u001b�m�\u001dm��o\u0002s�+\u001a4N�̨���Ԋ­F��KV��S•����(��kʍ=n��|�JD\t�㑀@�\u0011�1�\u000b�S�Z��\u0001�\u001a","payload_hex":"d51bb84b38d0dd68ce4522870a3728c7a795c47cea3d4c22ec481a135db40516eef5b307cd0590c7e645b9925da106eacdfd39f6bc816e13f7c5b27d43705b9244d889e5beca33c7b6da97bda0e3d4b6b1b3be7e7aa03e7e2077d715f02701b8c622017ebf6585ac96788d35ff6be61aec1d9361820bdbecbb861111d6730733d988d6b6aed6ef1b8b8d8cb87ed8133c3bd60202856dd0d612c3395203253545575501de5781a3dfc6cf052c4b226022fbe9a6fead0a0a631ea809e7920defdcc6b6fbc2b9b08f02fb41ad3e10e6872db64898005b15c20361552711ce72223dfbcc0aa8be8b7e68a39696be02d7f11057e3a2dbedc35a9f0ca2d9f3bf6717c2b504a8d1635ccfba73d3a89ce722892c371f958b5866a7e179af457dc6839e1a3f14157acbfd4918385bd630f49bc8e86a53dc0699cc1691100502aaeebba91b47c062baab77fb3a5f5feba5368a71ee48f943f65c6f5931dad511a204d71f7d0d6206999555777b30ce2f876929f3448be2beb3f2f29a37cb2119c39c5cbbe4c2456be83fc565922d2d84fc9c859e95974bddcb5f10045169ac9ede50d3c76756227be615840f99839df9e524a782b5de4c82f9b259884734d54f718c95141ef2895d236746ec96aebca38fe275ffecd7a072c0afe57e9c4b4dafd7d31bca293bd6fb00ca8d2a8030e1ace671268e600578440d0133dfaad6fde7588bae84ba8e6f68cc1535531bd16da21d6dcae86f0273ba2b1a344e82cca8c5d2d6d48ac2ad46cdd64b56f1c953c295ab8e98de28a9836bca8d3d6efad47cb14a4409d3e39180408411ae318a0bd153ef5adffa01cc1a","method":"","user_agent":"","ja3":"","session":"aa8067c2-351e-4630-b65e-dc176a0dbbd5","seq":1,"duration_ms":100,"bytes_in":594,"bytes_out":13,"enriched":{"digest":"2ee6677055cfd53e","strings":["}Cp[",">~ w","%5EWU",",K\"`\"","\\oY1","Uw{0","gV\"{","]#gF"]}},{"timestamp":"2026-09-17T16:00:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-CEsgB-Mi2r)Q","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d43457367422d4d6932722951","method":"","user_agent":"","ja3":"","session":"c96ef201-f780-4fd8-b3f4-bded20796463","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"416d0817f7b778db","strings":["BitTorrent protocol","<-UW1605-CEsgB-Mi2r)Q"]}},{"timestamp":"2026-09-17T15:59:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001���2>\u0010=\u0017�qX>�����\u0012����dT\b\u0017����\u0005�d��vU/��rT`\u0015:h\u0002�Q��e\u000f����&�a\u000f8�X�<^��\n9^�{Ȑ���\u0002a:�y7./As�!�d`�\u001c��\u0001","payload_hex":"018b9fd0323e103d17da71583eb3dec0bd8412f89cf3fb6454081792c2f08e05c864809e76552f9c96725460153a68028751a8d2650fb8d3dae026eb610f38ed588a3c5ec0ad0a395eb57bc890a295a302613ac879372e2f4173a721ea6460a71c8bfe01","method":"","user_agent":"","ja3":"","session":"76aa58f7-d7f1-4c0d-be55-8b89b930d26c","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":13,"enriched":{"digest":"92a43be3eb177e85","strings":["y7./As"]}},{"timestamp":"2026-09-17T15:58:03","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-6izGP5N5K_b4","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d36697a4750354e354b5f6234","method":"","user_agent":"","ja3":"","session":"e6942a6a-31cd-4a80-b91b-6e41be11eab6","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"29e0306a0b8ab229","strings":["BitTorrent protocol","<-UW1605-6izGP5N5K_b4"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T10:42:32.363867+00:00"}