{"ip":"181.27.50.103","total_events":987,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"987 events across 1 port(s)","confidence":"medium","network_type":"enterprise","why":["987 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"67,116 bytes sent","bytes_sent":67116,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T13:09:33","last_seen":"2026-09-30T08:42:21","events_24h":377,"events_7d":987,"geo":{"country_code":"AR","country_name":"Argentina","region":"Buenos Aires","city":"Haedo","lat":-34.6265,"lon":-58.5989,"asn":22927,"org":"Telefonica de Argentina"},"source_domain":"181-27-50-103.mrse.com.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as22927","label":"Telefonica de Argentina","category":"enterprise","url":"https://www.peeringdb.com/asn/22927"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":987}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-28","count":247},{"date":"2026-09-29","count":546},{"date":"2026-09-30","count":194}],"recent_events":[{"timestamp":"2026-09-30T08:42:21","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��ʥ��\\\u001fJ��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9e0caa5879c5c1f4ac1b6","method":"","user_agent":"","ja3":"","session":"80eafeb0-cb43-48ef-91f4-3fdb211e297d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"f1f6fb746c79c68e","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:35:44","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��I�^�\u0001\u0010\u001f�B","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9cb49c25e9101101fd142","method":"","user_agent":"","ja3":"","session":"0daf87d0-b19f-4264-9e20-363af6ccbb10","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"9977930afb033a3f","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:30:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�ԡ�M\u001bJ�UU0","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9d4a1ae4d1b4abc555530","method":"","user_agent":"","ja3":"","session":"c33187b1-46d7-42ab-82d6-45566bfb261d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"bbf9854286b99416","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:28:12","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�$\u000b�\u001ch\u0019\u0002��!","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9240b981c681902e3ce21","method":"","user_agent":"","ja3":"","session":"ff8e76e2-8348-431c-8d8c-3a51c967e930","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"237f6e90ac9112d2","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:25:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�\\�h�L\u001a�87\u0005","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb95cae68a44c1a9b383705","method":"","user_agent":"","ja3":"","session":"8dbe8228-5b7b-4a52-984e-f581756ae5ff","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"dfb707d54a98ddf6","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:23:53","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�����\u001d\\�f�\t","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb98bbfaaed1d5c9266bb09","method":"","user_agent":"","ja3":"","session":"06a4f55a-d7f6-4043-9e75-0e1d819d4fb2","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"6d5de4aae385d12a","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:22:14","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�k\n��\u0017ڇ���","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb96b0aeab917da879dffcb","method":"","user_agent":"","ja3":"","session":"0045ea63-0e69-463e-9551-48450855995b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"1614952cafe93128","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:20:50","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�:ʛm��)��6","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb93aca9b6d93c029b4b836","method":"","user_agent":"","ja3":"","session":"29dc11db-3673-43b8-a674-8ff3619cda0c","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"dea350c87ccd786d","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:19:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��#\u0007m\fID\u0004\u0003�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9e723076d0c49440403c6","method":"","user_agent":"","ja3":"","session":"65e30c09-265c-4de8-94fc-0836289e1d87","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"f0838ec21b5ae7d4","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-30T08:17:25","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�\u0005��\u001ak�\u000b�\u0013\u0014","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb905a2cb1a6ba80bea1314","method":"","user_agent":"","ja3":"","session":"1a91debf-0616-48bc-86fa-99019f9cb4ea","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"a3c6dbff06067c12","strings":["BitTorrent protocol","<-BT7b0W-"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T15:04:59.386727+00:00"}