{"ip":"187.13.11.116","total_events":22,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["22 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,582 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,582 bytes sent","bytes_sent":4582,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T00:49:05","last_seen":"2026-09-29T03:14:55","events_24h":0,"events_7d":22,"geo":{"country_code":"CO","country_name":"Colombia","region":"Bogota D.C.","city":"Bogotá","lat":4.6115,"lon":-74.0833,"asn":212238,"org":"Datacamp Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":22}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":22}],"recent_events":[{"timestamp":"2026-09-29T03:14:55","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5240-8iOGu.p.ruCD","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353234302d38694f47752e702e72754344","method":"","user_agent":"","ja3":"","session":"a2b50bda-86f5-410e-bd4f-7c499b868b15","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"c74ec07b6d66e588","strings":["BitTorrent protocol","<-qB5240-8iOGu.p.ruCD"],"iocs":{"domains":["qb5240-8iogu.p.rucd"]}}},{"timestamp":"2026-09-29T03:07:20","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"j�\u000fDZ�$�n��$\"��������2��/\u001a���\b����m5�\u001f�\u00138��l�P��B\u0006ձ\u0007U�aט\n�|�`_�\b��\u0000D�\u0002�� ��Q!գ��_N�g��x�Fٿ\u0010�0r\u0001�wʨ�W�EE�8�!��k%��>)�۶�x������50��7��?G\u001f��q�C1��\u0017��\u001b\u001c���C��`A�����q'QٷD�\u0000�0.O_�\u0005����T?�\tZzw�̲�❷�\u0004��Ϸ\u0000xnp\u0013Mu-�,\u001esC�H%{��8�\u000f�A\u0004(������Pr�ݰ��\u0001Z�\u0003_\u0010��\u0016Ki`X�Y�y��o?���E�N\u000bL\tI�oƮ���\u0013T��TM1\rG$-n�����~L\r�\u0003\u0019�j�,�Z�\u001a�6�\u00004`*�å,턚:f�FB!\u0002TR�\f\"\u0018���x���_\u001d�\u0007�՟���?z%�4\u001edʐ�\u000b�H\u0013p�\u0013�~\u001e��Y=E�o`@&��k�\u0017��!e��4�G���::�*_\u0018?\u0005}���,x�Y��w{���?V4�vk|lL�t)\u0017e��v��\u0016�b����@��P@\u0015o88Aa�)�\u000e���M\u001a��#���\u00135\u0006Ɉ\u0001��i\fB\u0019ِ9��+�\u0003R����_p\u001a\u0005\u001b0\n\u000fy�\t����y!lG�:dr�\r�6�\u001bo���(��2ǵ�\r�v�iE��P\u000b����T��A�\u0018�I0��Gy���e�+(k��;\u0001�������ш\u0006\n#\u0001Va\n��2]","payload_hex":"6a9b0f445ae824d76efa9c242298b1f5d1efd3e086328ce82f1ac2c5f408d3defaf46d35c61ff17f1338a2cd6cb950eada4206d5b10755f761d7980acb7c8a605f9408ccf30044e50285a420baa25121d5a3d6fc5f4ecf67fcc878fd46d9bf1094307201ba77caa8a057974545e538f921dbd76b25a9be3e29e9dbb6c1788ab18d9decab3530fafc3791cc3f471fb08771c643318aea17bfc41b1cf78e8443e7ed604194f1e7ff85712751d9b744ab00f4302e4f5f9505c1ee8cdb543fa3095a7a7798ccb2a4e29db7fc04e5aecfb700786e70134d752d842c1e7343e948257bf99a38e00f9f410428fe94f988b5ce5072ebddb0c1cf015ad9035f10e7e3164b696058c059f67997b96f3fe393d445984e0b4c0949f36fc6aeb8b7ea1354c0bf544d310d47242d6ef2e8d7ecf37e4c0db20319986ae82ca75ad91abc36f00034602ad3c3a52ced849a3a66f5464221025452950c2218beb9aa78a0fd8e5f1dae0791d59f9fcaf63f7a25b2341e64ca90c30bcc481370f113b57e1ea2da597f3d45b56f604026f1d46b991790ac2165d5d134e6478499cb3a3a882a5f183f057d89f9982c78e6598cbc777b9ee2d93f5634f4766b7c6c4cc27429176597c67683b116ef62b3d3dece40f7f05040156f383841619129ed0ef1d2c34d1a93ac23dcddc8137f3506c98801f4d0690c4219d9903998882bff0352bfe485e55f701a051b300a0f799b09fdb382fd79216c47833a6472f50d9736e11b6f97947fea28eca532c7b5ee0de176c76945b889500bbaf4e4cc54aeb441dc18a14930ceef4779b9efc965872b286b878d3b01befa9eb59dfadad188060a230156610accfa325d","method":"","user_agent":"","ja3":"","session":"d9587f24-25dd-4399-adf3-2998f6799efe","seq":1,"duration_ms":100,"bytes_in":608,"bytes_out":13,"enriched":{"digest":"671105732acfaf69","strings":["0.O_","Ki`X","G$-n","o`@&","vk|lL","o88Aa","y!lG"]}},{"timestamp":"2026-09-29T03:00:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5240-y10WfPo6.EKN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353234302d7931305766506f362e454b4e","method":"","user_agent":"","ja3":"","session":"e8ebc4bc-7099-4992-8023-975e8c1898f3","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"25669767a0442d21","strings":["BitTorrent protocol","<-qB5240-y10WfPo6.EKN"],"iocs":{"domains":["qb5240-y10wfpo6.ekn"]}}},{"timestamp":"2026-09-29T02:54:51","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�,rd\u001a��Qy\u0016O`ʖx�\u000f;MT��5\u0005��OS{�d��2�\u0011�\u0005%��A�ئy��G?YD��K�\t�\u0001\u0018gڒ$\u0014A��\u0005,����-\u001c3��5)�&K#-�\u001a���kME�~}d�=o��\u0007���ԫJ�Pͤrfn�R�'p��!�[\u0012zK����S�f\u0015˷\u00130ms/\u0019PX�O�3�c9���@�)a�|o����Qkv����^Qꜚ�kX#\u000e,Q���N�ҕw��S��q\t0���?�o\u0007�W]�ܬ���w��\u0019�\u0016*[\u001a޷���$�#����PDGSd\u0001�\n\u001cU�O�đ���\u0004�pO/�2А$X&�\u0007)�\u001e`�\n��\u0015��^�i=��7�%�ήi\bp��Y��>\u001a��D5ξұt�\u0005 �^�1b\u0016���D6�\f`|L�'�\t\"\u0016\u0017���Tq�E�us��0�c0�\u0012\u001a��\u0006�1�\u0001yߖ�'\u0005F\\:�ͪ8�e;�\r?/�=","payload_hex":"f22c72641af0fc5179164f60ca9678e00f3b4d54b5a03505b8f34f537bf564979e328911b8052585cd41b1d8a67982bd473f59448bcf4bd509da011867da92241441b3dc052ce1eef0e22d1c3391d63529ea264b232db51aa49c916b4d45e87e7d64963d6fe89e07b586a2d4ab4ae450cda472666eaf52af2770ebd221f25b127a4bdbc4eec253a76615cbb713306d732f195058df4f9233946339f1b3d8409f2961d67c6f80dde6aa516b7686c6e0b25e51ea9c9afd6b58230e2c51f4f6c84ebed29577968153abd1710930d7cdda3f976f07ed575db1dcacf28d9577ebbc19ef162a5b1adeb7c1d8de249a23eb99f2c0504447536401c80a1c559e4fb6c4918ad0cc04a0704f2fb332d090245826960729f71e60f10abcc11581995ed6693d97e737e925d0ceae690870c3d659eddb3e1af0f94435cebed2b174f305209f5e9e3162168cfcdd4436ce0c607c4cbf27ff09221617babb885471a345f4757389bb30d36330a1121aefd106bd31d50179df96b52705465c3ad2cdaa38ae653bee0d3f2f983d","method":"","user_agent":"","ja3":"","session":"3aa9524a-34dd-4f63-af85-ec6dcc6db2b6","seq":1,"duration_ms":100,"bytes_in":389,"bytes_out":13,"enriched":{"digest":"2e81c03ca285ac14","strings":["G?YD","&K#-","0ms/","PDGSd"]}},{"timestamp":"2026-09-29T02:49:28","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5240-9oS9z6xob13t","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353234302d396f53397a36786f62313374","method":"","user_agent":"","ja3":"","session":"132ca5e5-083e-4966-a233-3fae6adeb97b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"4b6124170d51071b","strings":["BitTorrent protocol","<-qB5240-9oS9z6xob13t"]}},{"timestamp":"2026-09-29T02:46:28","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��J6���Uy�W��y���p?\tH�,��!��vE�kƅeR\b�^�)\u000eBw��z��x������̈\u0011X>\\t�h8_�\u0011��)H\n��f���u\u0010ZUԋo��\u0011̃◡�ޒ=Nu�\u0018\r(��\u001b8���!J��(Ö��Y�}S����\u0013��H�H�\u0004��k���Q�fZR�\u0016_�\u0000jo\"Ȓ���hXE`�H\u000e@���\u001b�=�����y\u0017����E�\u0002�����묠��X����� *�(�ܚVy\u000b����y΋k��p��+uVPJ�\u001f\u001af��j���@�\u000e������8�s��+�\u0011�.V�\tp��H�\u0017������\u0002�<�C\u0016퐮����;$7�V��$���?\\:�\u0006ˆ��oF¶�=FL8{g�gf��7�\u0001�����+�{~}���@B-�Yp|�?��*\u0003�]��_\u0001�G��ļ�\"���pz�\u0010�Л�������������bA)h�v\u0015 s��-F\u0014�\n\\�\u0014��w���ѪT�u�H�?�&9Oޅ=̇��5��u�\t`<���\t\\�[nL\u001cF.e�%�ܩ\u0002�\u0003�5L(��_~��\u001fJ\t�-=K\u0014�I�\u0014,g���P1\u0004��@��A/_�\u0012�\u00025���m\u0011\u0017�aB�]B\"","payload_hex":"e7df4a36a4b8cc5579a0579f8a79e2f9a6703f0948ca2ce58b2198ef7645e56bc685655208bb5ea3290e42778c9e7afeed7897bea8cac3d9cc8811583e5c74b768385fe111f99529480a908366bf89ad75105a55d48b6fb19f11cc83e297a1ebde923d4e75f1180d2890ad1b38bafefa214afcae28c396daca59947d53a4e8e3c313c2d5489f48b2049ef86badb8d851d6665a52c0165f88006a6f22c89280b19e68584560cc480e40eaeb8e1be03db694aabcd87917a9a9ada945ee02c7e0fba3f9ebaca088ef58b4a0f9bbf4202a9e28addc9a56790bff9d88cf79ce8b6ba0c070d2e22b7556504ad61f1a668bec6a90bed940e20ea6f587f08b9738c273bff72baf11992e56e90970fac0489e179f829db4dadf02fa3cdf4316ed90ae8f8c94cb3b243782569dc424a783e33f5c3aa806c288858a6f46c2b6c73d464c387b679c676692ea37b801bf89a5ab9e2bda7b7e7dbfa0ed40422d9d59707cc53ff2ac2a03965dd2c95f019447f58cc4bcf822ee8b98cef7f2707aa310b9d09ba9b2b0ebe8c3e1cefaacc4e78e62412968ad761520739be52d4614f60a5c8f14bfce77d5c4dad1aa54e175fe48ac3ff426394fde853dcc87e1de35d0dc75db09603cc3f6b3095cae5b6e4c1c462e65fb25fcdca9029d03a7354c28ebf55f7efcdd1f4a09d02d3d4b14c24981142c67a1aed2503104e1fa40d5f2412f5f8312c50235a094d66d1117a56142f95d4222","method":"","user_agent":"","ja3":"","session":"5c2c36d4-21eb-4686-b3a4-5191f06a44c9","seq":1,"duration_ms":100,"bytes_in":525,"bytes_out":13,"enriched":{"digest":"c17328b4c25b6feb","strings":["X>\\t","hXE`","+uVPJ","=FL8{g","bA)h"]}},{"timestamp":"2026-09-29T02:39:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5240-6Z8zAD!oPNLC","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353234302d365a387a4144216f504e4c43","method":"","user_agent":"","ja3":"","session":"4be32e13-05e1-4647-a16c-21ae4236c685","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b12d87f1582d16b8","strings":["BitTorrent protocol","<-qB5240-6Z8zAD!oPNLC"]}},{"timestamp":"2026-09-29T02:30:55","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"us.�]��\u0010�\u0018�=M:fm(�\n[��v��B�\u0000V��b��n{@{��Vd�Ԍ��״��կm\b\b�W��{SP���#��2���u������\n?�\u000b�\u0000\r�MC�C@\u0016.\r\u001fʥ{\u0013\"N�������_��sQ\u0014z��,�_\u0003�r���9f.�m���+Vr�r%�&|�7�\r\u0006y�jn ~}���&\u0013���I\u0005fh`�����o�a�i���\u0013`!�Z��\u0007\u000e��ԧ��S�u:���\u0017-�M�׃@\u0011��B`�3����ө��\u0000�(���֏�t\u0005\u001a\u0011�ʁǫf\u001b��Gg\u0002����!�s��,H4\\���\"\t������݃$�Y}��w����40�)��/qG���)�h���&�%Mg`j\b���|$�)�","payload_hex":"75732e915dd0f910f118d83d4d3a666d28c00a5bd2f276f09b42c80056f58962a8d06e7b407b95ff5664c0d48ccedad7b490e0d5af6d0808c857bab77b535093e1bb23b5f8329e8bab7586bc847fa193e10a3ff70bf0000d9a4d438c4340167f2e0d1fcaa57b13224ee0d4def7f1e3c15f8d9a7351147af5e62c995f03bd72fa898339662ecf6dd2d0c52b5672e77225cc267cc8379b0d0679846a6e207e7dd1dee22613c9e69749056668608a84c0eb8a6f9361c76994f8d3136021c95aeda2070e83d3d4a7f5c753f6753ac5ccdc172df24de9d7834011b5934260e733a2a9afb9d3a9faf9008a289bd4fcd68fbf74051a11dbca81c7ab661ba2eb476702ebf6eba621af73e6802c48345cb7a59f220981f29ae8efb8dd8324a6597dbf9c779db3b48134309129febe2f7147c0efb629cd68f9fa9826dd254d67606a08b1989e7c24b6298a","method":"","user_agent":"","ja3":"","session":"cae3fcfb-c562-417a-8cac-39d57834612a","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":13,"enriched":{"digest":"c32685cae56203f2","strings":["=M:fm(","n{@{","jn ~}",",H4\\","%Mg`j"]}},{"timestamp":"2026-09-29T02:25:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5240-SEvJuYqxD8)!","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353234302d5345764a7559717844382921","method":"","user_agent":"","ja3":"","session":"0cb8bb82-d3b0-43b4-a272-f9116586899d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"a643a16bfa9b6e47","strings":["BitTorrent protocol","<-qB5240-SEvJuYqxD8)!"]}},{"timestamp":"2026-09-29T02:20:00","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�~g���d��\u0006����1�H�\u000e�<z���\u0017O+n�1�h��9\u0016�ڦ��\bwd�+j�E%�sa�\u001aDo�K$י�/V��x�J������}�T1�\u001a%,\u0012e��B\u000f%\"���(g\u0005���`��2�\u0016wn+\n1\u001d�M�b\u0019~�\u000fo�v\u00079�\u0006(�v�ڛ�^\u0016\u001a;!��s�]����\u00129փ\f���:���l��0�1���b6wz\\w\u0005\u0003N�\u0007�^\u001b�K����P\u0018,�r�'.ƫ��2��k��,9\u001b���ۍ�\n)�h�A[��;�w?M��\u001d}�����(���A\u001d��>�\u001d\u0011�j�,�Xy\u0004�I�\"��N[V*��TF���\u001c�X�����8�P�+@���>�QM5\u001f��\u001eJi|%ot�U�\u0013�\u0013)gF+\f1h�n[\\\u000e����X��Z4.A�n\u001buF���s�/\u001d�����S��^j&\"�OtK�?>��\\+\rC�n��^R������h{����c���\u000fQqV�~x�%�l \\����^�\\\"#m��\u000b\u0004{�J��A��;W��\u0000-�1!\r/\f�\nA�iK+�h��\u0002�\u0004����\u001f� {S�D�&�\u0017}r4�Z�\u0016�e�*nm��K\u001f�����&���3Ms��OOE�I�\u00001Ė\f][���#�E��0���ƚ\u0001��Rc�o�>�N#�:�c|��\u0015a��ۺ�p","payload_hex":"db7e67a4eee5647fa28606e67fc2faa8319348f50ede3c7ae7f9bb174f2b6ea431a968b0ad3916eedaa69da4087764e22b6a984525c47361b81a446fe44b24d799c12f5687a578c54a94ba90afabda7d8d5431f11a252c1265fdb9420f2522a08bd0286705a0e7b660eee732c416776e2b0a311dbb4dce62197ee80f6fb77607398d0628c176e2da9be95e161a3b21c8c473b35dfcbed2fd1239d6830cb2d1fa3ae088926cfdc230bb319192a96236777a5c7705034efa078c5e1bb44bfee1baf350182cfe7293272ec6aba68e32bec16baef32c391bc2e2ccdb8df40a29c268c0415bfae03bfd773f4de3d71d7db48f99c4f728a78de8411dafe73eb21d11e36ac42cf7587904bc49be22d4f14e5b562ac9c15446bbb6cd1cc6589f95a39cfe38f650d72b40fbef9fb2a59b3e97514d351fa4b81e4a697c256f74ce559913ab132967462b0c3168946e5b5c0ef3e6d9f958c0a05a342e41e96e1b7546fdd1e773e72f1dace7a6edd553bede5e6a2622af4f744bdf3f3eb7f05c2b0d43d96eb4a15e529ae6febbbde0687bbbd5ea8163b5d6d70f517156dc7e78ac25f66c205cbad7c3db5e935c22236db0ed0b047bae4a8f8741cef83b579bef002dbe31210d2f0cdb0a41b0694b2bda688f92027f8704cbe2dbea1fdc207b53c844fa26d1177d7234ff5a98168f65aa2a6e6dff934b1fbbd2fad2fa26819d82334d7395874f4f45ae49ff0031c4960c5d5bf2a385238e45e7d1309be69ec69a01ffee5263d06fe63e894e23813a83637c83951561f7c6dbba9770","method":"","user_agent":"","ja3":"","session":"1863fcd4-b17a-4945-a368-1dc989f49901","seq":1,"duration_ms":100,"bytes_in":565,"bytes_out":13,"enriched":{"digest":"95bbd61a1791f934","strings":["b6wz\\w","N[V*","Ji|%ot",")gF+","Z4.A","^j&\"","\\\"#m"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T23:41:41.586508+00:00"}