{"ip":"186.205.19.95","total_events":32126,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"32,126 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["32,126 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 4694s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"11,945,251,776 bytes sent, longest session 4694s","bytes_sent":11945251776,"session_seconds":4694,"persistent":true}},"first_seen":"2026-08-11T05:12:59","last_seen":"2026-08-11T06:31:12","events_24h":0,"events_7d":32126,"geo":{"country_code":"BR","country_name":"Brazil","region":"Rio de Janeiro","city":"Rio de Janeiro","lat":-22.9072,"lon":-43.1883,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"bacd135f.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":32126}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-11","count":32126}],"recent_events":[{"timestamp":"2026-08-11T06:31:12","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���+M�zA��","payload_hex":"8ea4e52b4dc57a41cae8","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32015,"duration_ms":4693520,"bytes_in":653339,"bytes_out":416179},{"timestamp":"2026-08-11T06:31:09","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"2F�-�}-i","payload_hex":"32468e2d837d2d69","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32014,"duration_ms":4690777,"bytes_in":653329,"bytes_out":416166},{"timestamp":"2026-08-11T06:31:08","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"̓@A_��v\u0016�","payload_hex":"cc9340415fbaac7616ca","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32013,"duration_ms":4689356,"bytes_in":653321,"bytes_out":416153},{"timestamp":"2026-08-11T06:31:07","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{�߹","payload_hex":"7bdfdfb9","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32012,"duration_ms":4688654,"bytes_in":653311,"bytes_out":416140},{"timestamp":"2026-08-11T06:31:07","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ⴜ�I\u0014V�_","payload_hex":"e2b49cc7491456ce5f","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32011,"duration_ms":4688516,"bytes_in":653307,"bytes_out":416127},{"timestamp":"2026-08-11T06:31:07","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"˄f�","payload_hex":"cb846697","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32010,"duration_ms":4688073,"bytes_in":653298,"bytes_out":416114},{"timestamp":"2026-08-11T06:31:07","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u001d�0","payload_hex":"3a1db630","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32009,"duration_ms":4687953,"bytes_in":653294,"bytes_out":416101},{"timestamp":"2026-08-11T06:31:06","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�5�����1�","payload_hex":"f735a2bff1fee931a4","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32008,"duration_ms":4687670,"bytes_in":653290,"bytes_out":416088},{"timestamp":"2026-08-11T06:31:06","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\f���\u0019�","payload_hex":"0ca5e98219fb","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32007,"duration_ms":4687397,"bytes_in":653281,"bytes_out":416075},{"timestamp":"2026-08-11T06:31:06","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\r#\u001fv","payload_hex":"9aad0d231f76","method":"","user_agent":"","ja3":"","session":"249106a4-ea58-41bb-a110-21d8fb1a97ca","seq":32006,"duration_ms":4687100,"bytes_in":653275,"bytes_out":416062}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T23:43:18.068402+00:00"}