{"ip":"187.189.240.168","total_events":279,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["279 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 58,422 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"58,422 bytes sent","bytes_sent":58422,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-16T22:52:49","last_seen":"2026-08-17T04:56:58","events_24h":0,"events_7d":279,"geo":{"country_code":"MX","country_name":"Mexico","region":"Mexico City","city":"Cuauhtémoc","lat":19.4491,"lon":-99.1574,"asn":17072,"org":"TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V."},"source_domain":"fixed-187-189-240-168.totalplay.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as17072","label":"TOTAL PLAY TELECOMUNICACIONES AS17072","category":"isp","url":"https://www.peeringdb.com/asn/17072"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":279}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-16","count":52},{"date":"2026-08-17","count":227}],"recent_events":[{"timestamp":"2026-08-17T04:56:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�,GrJV�hM\u0014��e>&jP(ى�x���%�\b\bJ��\u0014c2�NƋN��Z�\u0016\u0001���!����\u0015\u0017�������8��O�g�� �W��(�{��\u0017�P\u0003\u0000�@�\u000eh-�]ӛ�d\n\fq\u001eZ\u001b\n�R0$��µ����%����Dl:4������\u0019� �t��I�]j6\u000b7�s�ɻ\u0006t��v��\u001c\u0013��5\u0016I�\r�\u0019�k�,Իً���\u0005��\u001d�s�r�����U��iDT�`�����&\r���`��1����؎,�C��RC��������:�\u001e)񑙬�~�\"(i���,���\u0013\u001c�������;�wO�F�T]��\r\u0004\u001e>�\u0017�)�'��\u0006M�\u000f�\u001bZ��´$��.�I,\u0007���V���4F\u000f�?T2��U�\u0001�\u0014\u000e�����c�pN\u0013c�)��p!_.��t\u0000`�e\u0007u~EB�b]���\u001d&��9��lj6R&jP(","Dl:4","p!_.","u~EB","6R��\b���|�\u0018��\f\u000f���R���$�����\n�\u000e;,�Ź�G�/]>��\u0002D;zt����\u0012�\u0017\u000e��GE�>�Ri[fϺWd\u0000�R���.�\"��td���Ky����<\u0011\u0013R\u0012\u001a��\u0005Cz�(�V�\r��F2:d�0q���ʊ\u0002�+�\u000e\u0018��p��3�|C�&��q1~��`\u0014���\u001c�}8:��O\u000b��o�*�\u0006on��}�s����x�\n\u0010��I_�O�w��n;��\u0011�\u0004���W\u0000}fr��\u000egu������\b��mc�+W��\u001c\u001e�\t���˴S@�C�U��\u000b�Rn�=�(o��b.��x��t\u0007��\u001f��0�#���X�gw৑@J\u0004v���ą�������\u0017G��\\s+���\u0013��*õ�\u0014μ�\"뮜�\u0005s6�6��~s��\u0016��\u001d˒@��=Rj*�&�����\u0014\u00113�����\u0005\u0000\rz��\u00001IbI\u0002��^֓�._\u001a��=^���-x.�\\ۤ\u0006���nA�0�<�0�m�r);�#Nv\u0011�S#WZ}\u0018\u001e�t��\u001e龙|���!�m\u0001�\u001d\u0004��ϑG\u001eS�P��\"31�����q<\u0018m8\fm��&j;a�5/�","payload_hex":"9656e635ae6d4f12a1c46c6d68e6ba78773d1aa32cffaaba45ca56aaef5b73eb522f3172fca0c5065849bc6e4ec111905be0142a80f1e0a7fe2f1b942b3301555e083d81ffd93367d082744b409262ac228471024d12e8d5b9dea49391d9a6a76570c7264f54a454bb10047d838b41e7f496914b0105e0b24e998bdb1013b0ed6701a91133ef8341f6488fb6affdb5959923b97a37a93759074658df879e863f87303bd7a9be2bd3829a6806b9baf3ab26aa1278919b5be6c3ca05a2d7189da25c622115da67ba6ef486316d8d4004f77f063c0660595695090e600e731984ce52ef92f2e6675ae6002e56d405b76ec6cfedd3abb89b810328b7bbed7ccd483f2aa0d42131bb973b8dd66890bb6a75cd9aa7a7092c4b930bf04e3ceed48f7c928857b33ff94371392da3e131dfe95a2a427d9b36476a5fffe308dc64ee4f36f90cb6ac43c99057aec0aad3d3e5d1d76ae61d6bc2e2e4a8a93372773e11ce5323575a7d181efe74fda61ee9be997cfad1cb218d6d01dd1d04c4fccf91471e53f350c9fc2233318fd5f0a196713c7f186d380c6ddad8266a3b618f352f93","method":"","user_agent":"","ja3":"","session":"fdf462f5-dabc-48e6-952f-fd6163f1fbf6","seq":1,"duration_ms":100,"bytes_in":413,"bytes_out":15,"enriched":{"digest":"bdb04a00cd076043","strings":["R/1r","Cq9-","Z*B}","6Gj_","3rw>","S#WZ}","&j;a"]}},{"timestamp":"2026-08-17T04:44:25","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1609-KGagzU*ZYvO8","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630392d4b4761677a552a5a59764f38","method":"","user_agent":"","ja3":"","session":"368a867c-79eb-4bdf-adb0-e31c7f0acf01","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"cc68e4298c49805c","strings":["BitTorrent protocol","<-UW1609-KGagzU*ZYvO8"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T19:30:16.705196+00:00"}