{"ip":"181.27.80.200","total_events":1170,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,170 events across 1 port(s)","confidence":"medium","network_type":"enterprise","why":["1,170 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"79,560 bytes sent","bytes_sent":79560,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T23:24:17","last_seen":"2026-09-28T11:36:55","events_24h":0,"events_7d":1170,"geo":{"country_code":"AR","country_name":"Argentina","region":"Buenos Aires","city":"Haedo","lat":-34.6265,"lon":-58.5989,"asn":22927,"org":"Telefonica de Argentina"},"source_domain":"181-27-80-200.mrse.com.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as22927","label":"Telefonica de Argentina","category":"enterprise","url":"https://www.peeringdb.com/asn/22927"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1170}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-24","count":11},{"date":"2026-09-25","count":154},{"date":"2026-09-26","count":290},{"date":"2026-09-27","count":557},{"date":"2026-09-28","count":158}],"recent_events":[{"timestamp":"2026-09-28T11:36:55","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�t>=]{�q\u0017��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9743e3d5d7b8d71178e81","method":"","user_agent":"","ja3":"","session":"175f6fcd-4006-483d-8935-b9e82d8309f0","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"d63c79a6c61d70a8","strings":["BitTorrent protocol","<-BT7b0W-","t>=]{"]}},{"timestamp":"2026-09-28T11:34:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��oA��\u001e\u000b�u�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9806f41e6d01e0bdc75d7","method":"","user_agent":"","ja3":"","session":"fe3147c0-28c6-4126-8b0a-d49be05e8470","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b9d770e605b5963d","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T11:31:05","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�D��a�u\u0005�r�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb944bcac61be7505cc72f3","method":"","user_agent":"","ja3":"","session":"06c6bd7b-8bcf-4355-876f-3104cf726d3e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c96a5a85b0eeac26","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T10:58:21","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��gb�E��\u0003-\u0001","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb99e6762e845faf8032d01","method":"","user_agent":"","ja3":"","session":"79ebd433-bf88-4d68-b3b1-2fdd936deb03","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"bb6b3dd32a9ee24c","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T10:51:39","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�����\u0015.(\u001d�\n","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9a2c8caeb152e281d800a","method":"","user_agent":"","ja3":"","session":"2bc5fcc4-4175-4ffa-94f8-4a37a6a04d03","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"56c0fb46db093dae","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T10:46:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�|k\u0007���#er�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb97c6b07a8dff6236572ee","method":"","user_agent":"","ja3":"","session":"c09bbfb1-629a-4d0c-8db5-dc5d4e3b40f5","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"285fba988370657c","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T10:44:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f��%3$N\u001a�YY�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9e52533244e1ae85959da","method":"","user_agent":"","ja3":"","session":"4759a681-7055-4c4e-942d-98d0da2f5972","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"5177efcb5c596ae1","strings":["BitTorrent protocol","<-BT7b0W-","%3$N"]}},{"timestamp":"2026-09-28T10:41:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f����0�]��\u001a�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9f1b4ed30df5dacb71aba","method":"","user_agent":"","ja3":"","session":"b6d3d128-425d-415d-ab17-77f07f6e883f","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c1fc8c1b8bfdb305","strings":["BitTorrent protocol","<-BT7b0W-"]}},{"timestamp":"2026-09-28T10:38:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�\felMN\u001e��M�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb90c656c4d4e1edfd84d86","method":"","user_agent":"","ja3":"","session":"76462970-3839-4769-9d1d-1b612db0a3ce","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"a3bfb24254445948","strings":["BitTorrent protocol","<-BT7b0W-","elMN"]}},{"timestamp":"2026-09-28T10:36:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-BT7b0W-\u001f�&�r�7��7\u000f|","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d4254376230572d1fb9268172c337f782370f7c","method":"","user_agent":"","ja3":"","session":"a4780616-60e4-4da0-ba09-01dd4e73e890","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"510abea5b592af7e","strings":["BitTorrent protocol","<-BT7b0W-"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T15:01:51.312190+00:00"}