{"ip":"187.39.118.204","total_events":3105,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,105 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["3,105 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"649,755 bytes sent","bytes_sent":649755,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-12T17:39:44","last_seen":"2026-08-15T12:49:09","events_24h":0,"events_7d":1806,"geo":{"country_code":"BR","country_name":"Brazil","region":"Rio Grande do Sul","city":"Canoas","lat":-29.9228,"lon":-51.1744,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"bb2776cc.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":3105}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-12","count":303},{"date":"2026-08-13","count":1122},{"date":"2026-08-14","count":1109},{"date":"2026-08-15","count":571}],"recent_events":[{"timestamp":"2026-08-15T12:49:09","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-unyTYCy2DqdX","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d756e79545943793244716458","method":"","user_agent":"","ja3":"","session":"e18f97b7-8985-42e7-ad02-6011e2530c44","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"5022178600f13c9b","strings":["BitTorrent protocol","<-qB5140-unyTYCy2DqdX"]}},{"timestamp":"2026-08-15T12:47:49","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"1�\u0004�v\u0017sE_c0�w�\b�\u0001W\n\u001d�}pm\u0010$y�3�\u0014fz��\u000e�;m'�A�\u0006��nh\u000fJ7�� �=�\u000e(����%�H��\u00048����CB�\u000f���!?�[E�7�7�\u0014K\f\u0001�G�����=Ww9\u001f�K��E\"��k\u00068!_Ü���c1\"{�Q\u00075�3�8S���UuX�9���%�o�AB�\u001f�[Y��\u0004��'�\u001c�DO�/D=Z9惦U���k�:\u0003\u001d��+�\u0018v�L�aAl�#����˖�\u0007����|�w�c0�Q���H��V�H,T��.\u0002uPc\u0000��X|��{�\u0011�)8Sk\u0014��\n��}�?|�'|O��%������\u0001�\f1��z���h8?����5'8nP�v�N\u001ap�\u0006=���'|\u0000�,j;TI�\u0013*�-,�f�\rU���W?\u000e=���a�eO#h;R��\u000f\u001c\tCϟ<����\u000e��\u001f�GZ#�������3Gu�.04�,z&�aP����u�\u0002n<@������v�~R\u0006]e��\rn6�$D��YrS��\u0011�\u0007����O\u0012k�a�\u0013ݐ��Ѫ�\u001c:���oz�d\"z�Dj\"l\u0004wP*��\u001fnQ\u0014���~��׉����\u0005�>�΢��;T���\u0013d39","payload_hex":"31980482761773455f6330c877a908aa01570a1da97d706d102479a433df14667aee950ef03b6d27bc41d70687d16e680f4a37e08820dc3dc30e289ad9d6f325b148a48f0438c1d4deda4342a70f86aae6213fbb5b45a037c837e6144b0c019847e4f1dcdbf13d5777391fe54b96dd4522e4a36b0638215fc39cf7bcc96331227b8f510735ac33cc3853be858a557558f039b98dd925d66fde4142851fef5b59bdc104cadb27ec1ca3444f9e2f443d5a39e683a655c0a0f36be73a031d91942bcf1876e44ce661416cf92381809dafcb96ca07e3a1c9f17cff77c06330f6517ffaa3cc48a6d356eb482c54b1ea2e027550630090c5587cab957b9911b12938536b14e0900ae6d47df93f7cf2277c4fa6ac25b4cacfe2d5d701dd0c318fa37acef0a968383fcbf7b8a63527386e50dc76e44e1a70c0063d93b1ee277c00d62c6a3b5449fd132ad72d2c9a7f669c0d5588aa9a573f0e3dd9e0a9619f654f2368cdbe52e3b80f1c0943cf9f3cc7fdbebd0ee2991ff7475a23a3af99a896b6e7334775f42e3034aa2c7a26b3615093909b8d75c1026e3c40a09e919fc4cd76a07e52065d65ace50d6e36b524449fc6597253cfc111eb0781f1e4fa4f126be061da13dd90a9fed1aafb1c3ab8cbee6f7af864227a8a446a226c0477502a94951f6e51149c868c7e95a6d789ffd1d3e705d73ee1cea2f4a83b54d4f9fd13643339","method":"","user_agent":"","ja3":"","session":"cbb5f810-9ea0-4f8f-9c34-19bdf5400430","seq":1,"duration_ms":100,"bytes_in":510,"bytes_out":14,"enriched":{"digest":"14449ee1f9b1135b","strings":["sE_c0","=Ww9","c1\"{","/D=Z9",")8Sk","5'8nP",",j;TI","eO#h","Dj\"l"]}},{"timestamp":"2026-08-15T12:46:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-nS-)qy0J.L57","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d6e532d297179304a2e4c3537","method":"","user_agent":"","ja3":"","session":"bf2ab132-c119-4909-a711-ce9d37653eee","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"c11f054f528dfd53","strings":["BitTorrent protocol","<-qB5140-nS-)qy0J.L57"]}},{"timestamp":"2026-08-15T12:45:00","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"w*��$\u0003Q�Z�̐gz������np��ei�^�\u0005�\u0013�����/�hVW.\u0002����?\u0013=�z�\u0014��1&fuF\u0011sx��Ԙh�I/N*����лсB@�>;%��ߏ\u0002O\n\u0005n��\u000f\u0006�(?\u0007T�\u001b|��!_ �1��]�J\u000f@��&V�V���Z([Rû2\u0017���\u0002Z��ŸE�:�*��!�ݨ�\u001b����\u0016P�&��\u00057��x�`w�7�\u0016�<\u001a�Sc��\u0017}�\t\u001f��\u0010�\u0016����SF\u000f�\u0013j\u0003�'67Y�YC>\u0017�T֛�\u0010唿z��\u000e���\u000ey\u0017�}�G�Nw\u001a`;����Ё��h���9G��XkBnu��\\��Znp��\u000f\u0005\u0007*�w�'g���\u0005�i9","payload_hex":"772af2df240351fa5af3cc90677aa092b6ab84de6e70e1bd6569b15e9705a0138ea4fcf3fe2fe16856572e02e8a4efb73f133dbf7ae114c9e33126667546117378a7b5d49868b1492f4e2aba8ec080d0bbd1814240b63e3b25eb84df8f024f0a056e99b40f06ff283f0754951b7caba5215f209931bed65dd54a0f40ee9e2656e6568480d15a285b52c3bb3217e3bdde025a9f98c29f45f83aa52ad0d621e3dda8c51bbfb37fb4d61650cc2690d80537e3aa78c46077cb37a916ce3c1ab75363e881177f7dfd091f868310e516888be4c253460fff136a03b427363759bf59433e17f154d69be210e594bf7abe9e0e8ed8d60e7917a17dd3479c4e771a603b9ae0c8e5d081caf46885d9f13947a1d9586b426e75f8d45ccece5a6e709bdf0f05072abf77a12767fceda905f66939","method":"","user_agent":"","ja3":"","session":"0fdee6e4-a310-45a1-a92b-74087737de7b","seq":1,"duration_ms":100,"bytes_in":302,"bytes_out":14,"enriched":{"digest":"6bedda20d41e9840","strings":["hVW.","1&fuF","I/N*","Z([R","'67Y","XkBnu"]}},{"timestamp":"2026-08-15T12:43:46","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-zH3Z7veMhh16","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d7a48335a3776654d68683136","method":"","user_agent":"","ja3":"","session":"7ad53e4f-7670-415f-8320-e2f10ea4cc01","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"8033d4a3f10d7618","strings":["BitTorrent protocol","<-qB5140-zH3Z7veMhh16"]}},{"timestamp":"2026-08-15T12:42:25","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Ӷ��1\u0003m�A\u0003�u��N�\u001d.�;кD�L����'[LYj�`��2#��E��./����Zj��쫯�?-l��Cl���”\u0011��2M)�\u0004_�qO��q\u0004\u001c=�4�\u0018�I�j\u0012:��!\u00046\u0014�K�A�\u0006\u0019��.���\u0004�5J��f;~V\u0001B9bB����d>�\u000bʌy&�\u0011�\u0012�\t���{J�<ߣ��vrͬ\u001b1�!�����\u0011���O��pa�7cĉ~�΄��\u0000u�\r-��̋�>�� ߝ.o��\f�K�O<�&!P\u0019���u'�S�������C\u0000��E�ϲ\u0007�+�K:=�w�x���=���1��N��9�>�\u001b?\f�������γ���\u0003a?\u000f�\u0001f�e�|@:1��[��lx~.�7\"�0�!c=�\u0004��VO��\u0000�}�_\u0005V'ݭ)�Ttj��Kym�\u0002�\u0012�","payload_hex":"d3b6e38931036dbf4103de7594be4e9b1d2e983bd0ba44a94cdceab1f3275b4c596aae6085933223aea445bfd62e2faaf8a8e75a6aedf5ecabaf8a3f2d6c9683436cafedffc294118ac4324d29f3045faf714f978e71041c3dfd34c9189349d66a123afaf621043614d14ba841cd061981e92eb1d4d40493354af8ef663b7e560142396242a0eb9bcd643e850bca8c7926a211b912f809c7c09c7b4ad83cdfa3c0c77672cdac1b31ee2190b1e2a0c211e1f6ce4fdfdb7061b93763c4897eb9ce84feb00075d60d2ded8fcc8ba73e8be820df9d2e6f92ac0c8d4b804f3ccc26215019bdf3d77527ee53b4b2888df3d9fd4300fac345adcfb207912b9b4b3a3da777d778d2e7ac3df0ebc931c7cf4e97bf39923ef81b3f0cbeb18ab5a9bac6ceb3f7acfc03613f0fc90166fb65c47c403a31998b5b96d86c787e2ebd3722e730b221633d8404f9d3564fb3ed00ec7d8a5f055627ddad29b154746adadc4b796dad02c712bf","method":"","user_agent":"","ja3":"","session":"16f9f62a-33e8-413d-a2d5-9429595b7e86","seq":1,"duration_ms":100,"bytes_in":356,"bytes_out":14,"enriched":{"digest":"f745728ffc4cb1c7","strings":["'[LYj","f;~V","B9bB","|@:1","lx~."]}},{"timestamp":"2026-08-15T12:41:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-ikn7haFtl74p","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d696b6e37686146746c373470","method":"","user_agent":"","ja3":"","session":"76506688-cd1e-4273-a00d-9a5c0954c5de","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"0b50a08f3fceb661","strings":["BitTorrent protocol","<-qB5140-ikn7haFtl74p"]}},{"timestamp":"2026-08-15T12:39:28","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ܕ��\\�U %�\u0010�\u001c�OH�\fu�LՃ���҇�\u0011�\u0019\u0018��\u0018e�ivT�%���S�\u0014�϶��壃\t\u0016����O$Xq��[����\u0006\u0012�\u000f;�4)!����sj��]\u0006d�rM�)bD&@�\u0014\u000b�hʹ�p\u0000<\"�","payload_hex":"dc95fffa5c8e552025f510d01cd44f48b70c75db4cd583d7f187d287d011aa1918bbdd1865a1697654962595bf9a53a4149acfb6b0d4e5a38309169be8d5cb4f245871e6ca5ba8cdc6f60612c30f3bbc34292188eeb1c5736aaff75d066496ef92b7724d8d29624426409f140b8668cab98d70003c22ec","method":"","user_agent":"","ja3":"","session":"485e5fd4-0828-4ac0-a29a-390a85151527","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":14,"enriched":{"digest":"bc9a6e7fcdbb4c10","strings":["O$Xq",")bD&@"]}},{"timestamp":"2026-08-15T12:38:15","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-nPx1rTCp.QQ_","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d6e507831725443702e51515f","method":"","user_agent":"","ja3":"","session":"0844add5-3ba0-43b2-abce-b3b4bc6a232f","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"ff8f3ac983e9a456","strings":["BitTorrent protocol","<-qB5140-nPx1rTCp.QQ_"]}},{"timestamp":"2026-08-15T12:37:03","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\n��ѝ�r�[�#vs�\u001fp�2�sM x\u0002z\u0011.��pI��l�{aW\"�'�A�|(���U�\u00127��s�8�\u00040�p�2��\u0015���K\u0005\u001c��\"�-����`����L\u0016������y����ދ���0�0��%�|�e�9\u0010�-BQW|o�ǬD-\u0001��\u0003Z\u0010\u0003\n5\u0003U�L�G��\u000f��\u0017�Q\rRb��?�\f��\t�.���!����xU��������%N\u0004�I\bF�=�Kg#�\u0002������\u0018P��u�XV��G����LD�\u0003 #R��Q�\u0018����P���Z��\u001b�lj���u�!��>e���l]��\u00160wZw�\u0018Ü\u00103���⫟�\u001cB$\u0014�n�\u001eWRؼ\u0000S��\u001a��Q�\u000f��=v���z�\u0016���@G:��\u0018��s��ޤ�]w\u0015�� V���[��\u0003$e\u0011�׻��bG\u001cx[�\u0000§�\u0005�H:��ŕ��֗D�e�h~�.wh���ı\u001a+�XSNnJu\fLZ���\u001d\u0013Q�\u0018*g��}�F��ۦ�F�]\u0011�\f���l\tY]��Α8ĩg�G���\u000e�{�]f���w\t�h�[��*��҇��\"����\"1�V\u0003�8l\u000f)f�V����_\u001d,Ou��\u000f��~�4�^\u0005�։0�e�U\u0017\u0011:�7paڲ��|�\u0007����UN~�\u000e�2����S\\\u0013�D��%�5�\u0015�e#H\"W3�z�n�\u0000���ύ���P7��wV.XTr�g���\u001b��~�i","payload_hex":"dcd20a9cfed19de472f85bda237673c41f70fa3281734d2078027a112ee5e4704990906cb17b615722b327da41db7c2894f3e855821237ac9673b738a004308f70a232b4d015a9f2814b051ca8c922e52dbbe3abf860aaf7b3cf4c16f0f6f4a7a8d079b3bdcaffde8bf8bfa630e030aaf225d67c9b65933910c52d4251577c6fa7c7ac442d0198bd035a10030a350355ad4c9847ee820f9fa617c1510d5262b7d53fee0cbcd309c82eb9bab821adb2b5f67855f9b4f78daa99f6b6254e04f6490846bc3d9e4b6723c9028b85b78da3b71850f7fe7584585689e94796fe88ae4c44ac0320235299ac518b1894b0f1bb50af87c35ad9d91bf46c6ab4a3e775c521f0ad3e65c5d0ce6c5dba851630775a77b818c39c1033b3fdefe2ab9fd11c422414846eb01e5752d8bc00538e981aefbe51e60fa8c63d7697b4a07a9a16a89aa340473a949218d8da73a5b6dea4f55d771582cf2056b1ac915b918a03246511d2d7bb89af62471c785bfe00c2a7f405c7483abf9cc595eec77fd69744e06580687eff2e7768d1dacfc4b11a2b8158534e6e4a750c4c5abcf38d1d1351a9182a6785c97dd546f1afdba6e646e45d11ae0c938fb76c09595da6c0ce9138c4a967d347aca9fa0ee57bbb5d66a8ddef7709b1689a5b99c12ae0d1d287b99522f09bfcfb2231945603f3386c0f2966d356ea91ffa05f1d2c4f75a3d50fd8ff7ee134aa5e0598d68930da65f45517113ae8377061dab289e67cbc0788ffcfcd554e7ea60ee232bf8ee4b6535c13e944eac225c635ac1596652348225733917a996eec00f3eec0cf8db7a5d65037b9a477562e5854729467fbb6d81bb3a27ec769","method":"","user_agent":"","ja3":"","session":"2d94b97a-ad6b-4a43-9c27-e4e29fbe4162","seq":1,"duration_ms":100,"bytes_in":605,"bytes_out":14,"enriched":{"digest":"fd51f0ee53eff9f5","strings":["sM x","{aW\"","-BQW|o","0wZw","XSNnJu","e#H\"W3","wV.XTr"],"iocs":{"domains":["wv.xtr"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:23:15.477822+00:00"}