{"ip":"187.39.118.69","total_events":17499,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"17,499 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["17,499 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,681,628 bytes sent","bytes_sent":3681628,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T07:28:40","last_seen":"2026-10-05T20:44:46","events_24h":490,"events_7d":5874,"geo":{"country_code":"BR","country_name":"Brazil","region":"Rio Grande do Sul","city":"Canoas","lat":-29.9228,"lon":-51.1744,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"bb277645.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":39131,"events":2}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T19:59:00","last_seen":"2026-10-05T20:21:13","recent":[{"timestamp":"2026-10-05T20:21:13","port":39131,"src_port":48093,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:��|\u0012�ɮ���`\r�\fWk�F^\u000e9:info_hash20:��\n�\u001fe�6B\u001c�\u001e��f���7[e1:q9:get_peers1:t2:j�1:v4:LT\u0001/1:y1:qe","payload_hex":"64313a6164323a696432303afab87c12d3c9ae8afbec600d960c576bb2465e0e393a696e666f5f6861736832303afab60ab11f659c36421c951ea9d266d5d9cc375b65313a71393a6765745f7065657273313a74323a6a92313a76343a4c54012f313a79313a7165","sni":"","session":"0bed060e-f1bb-49f5-8b91-dd35ad8d62e2","bytes_in":104,"source_verified":false,"enriched":{"digest":"68c84e8187695ceb","strings":["d1:ad2:id20:","9:info_hash20:","7[e1:q9:get_peers1:t2:j","1:v4:LT","/1:y1:qe"]}},{"timestamp":"2026-10-05T19:59:00","port":39131,"src_port":48093,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:��|\u0012�ɮ���`\r�\fWk�F^\u000e9:info_hash20:ܝ��C[�\u0013W�\u001f`�ק�\u0002\u001b\u0007�e1:q9:get_peers1:t2:�\r1:v4:LT\u0001/1:y1:qe","payload_hex":"64313a6164323a696432303afab87c12d3c9ae8afbec600d960c576bb2465e0e393a696e666f5f6861736832303adc9df18f435bf21357831f60eed7a7fd021b078d65313a71393a6765745f7065657273313a74323aa30d313a76343a4c54012f313a79313a7165","sni":"","session":"5ea5952e-def5-49c7-be4b-2c2fd09bc7c4","bytes_in":104,"source_verified":false,"enriched":{"digest":"9a1730e51ea63ce3","strings":["d1:ad2:id20:","9:info_hash20:","e1:q9:get_peers1:t2:","1:v4:LT","/1:y1:qe"]}}]},"top_ports":[{"port":39131,"proto":"tcp","label":"","count":17499}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-03","count":298},{"date":"2026-09-04","count":484},{"date":"2026-09-05","count":1101},{"date":"2026-09-06","count":1083},{"date":"2026-09-07","count":1082},{"date":"2026-09-08","count":1104},{"date":"2026-09-09","count":1086},{"date":"2026-09-10","count":176},{"date":"2026-09-12","count":62},{"date":"2026-09-13","count":1079},{"date":"2026-09-14","count":745},{"date":"2026-09-15","count":615},{"date":"2026-09-16","count":444},{"date":"2026-09-26","count":270},{"date":"2026-09-27","count":1100},{"date":"2026-09-28","count":1042},{"date":"2026-09-29","count":388},{"date":"2026-09-30","count":1142},{"date":"2026-10-01","count":1093},{"date":"2026-10-02","count":1110},{"date":"2026-10-03","count":956},{"date":"2026-10-04","count":634},{"date":"2026-10-05","count":405}],"recent_events":[{"timestamp":"2026-10-05T20:44:46","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-RzgOUPKZZejc","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d527a674f55504b5a5a656a63","method":"","user_agent":"","ja3":"","session":"2520eb6b-60f2-40d3-be0d-6ac8e432748b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"31eb764285c86c91","strings":["BitTorrent protocol","<-qB5140-RzgOUPKZZejc"]}},{"timestamp":"2026-10-05T20:43:35","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Hm�{x�����wŠ��JѦ\f��e�=�>\u001e�\u001e�\u0005d�8��dݸ*\u0006%L\u001f:�\u001a}!\"m5������%�%�˖a�2\u0003\nS�LTˡޣ\u0013_�,�*�=���/\u0014�\u0005��L2E�\u001f��l�L�\u000eL�Ux��CYw�:�=T���\u0011��{a�D�\u00182�J6�>\u001bCG��ʛq G\u0016�\u0007 ן��·�\n��4�����!\u001c�b��ʝl9�=��<�W�0yM�?����\u0016�m\u0016$ဥ6X��F��'I�\nF0d�\f��W��\b��\u0003z713�6\u0014��c/J��s]\u000e�i�A3<�U�^��$�q�\rɟ�>7`\u000e��\u001fz�\u0016 8�t�\u0005G�\u001e���f��|[\u0019M\r��p\u0018U\"�m����|\u000f\u001f�ޔEP_4��\"�/}\\̎��_/::%��>�&�iY�tS��`؛ĉ\u0016��\n<�\u0014y�F\u0002+�\u001f\u0003c¡\\��.*V#.%d3\t��~w����","payload_hex":"486d867b78f6a78da6ac77c28ac0ed4ad1a60cf19965d53db93e1e8a1ed9056484389abd64ddb82a06254c1f3ab71a7d21226d35b3e2fd97a58e25a125d1cb96618a32030a53fc4c54cba1dea3135fd62cf72ad03dece4a92f14d405e2f04c3245d01ffbde6cba4cc40e4cb55578f1b4435977e43afe3d5495f5cb11a28a7b619d44ea1832d14a369a3e1b4347e5d1ca9b71204716fc0720d79f8286c2b7ed0ae79e34b7c5f8e883211cd062fb92ca9d6c39ee3d9fd83cb3579b30794dc73fdaf48acd16fa6d1624e180a53658f19c46ffaf2749de0a463064ff0ccdd357897fe7089bee037a373133c736149ff0632f4a80b8735d0ea469ec41333cc7559d5e8ace24ae71b50dc99fc83e37600ee5ba1f7aa3162038bd74bf0547dd1ef1cacd6680c37c5b194d0dfddc70185522e76df39c9ecb7c0f1f91de9445505f34d2ca22e72f7d5ccc8ef88f5f2f3a3a2589c63e8c26986959cf7453a9db60d89bc48916b1ae0a3cf514799846022b861f0363c2a15ca7942e2a56232e25643309c3e97e7797f5e9e4","method":"","user_agent":"","ja3":"","session":"ac2c893e-6b9f-4493-87e4-3cff755f4381","seq":1,"duration_ms":100,"bytes_in":390,"bytes_out":13,"enriched":{"digest":"3f95a1dbd2b9a0bd","strings":["}!\"m5","z713","EP_4",".*V#.%d3"]}},{"timestamp":"2026-10-05T20:42:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-iZhg(Rr4Ar!i","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d695a68672852723441722169","method":"","user_agent":"","ja3":"","session":"fdfaa557-b8c6-458d-b2f6-b12f91896154","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"626b17ed0d1aa8fe","strings":["BitTorrent protocol","<-qB5140-iZhg(Rr4Ar!i"]}},{"timestamp":"2026-10-05T20:41:11","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�݌��\u0005�dK�]5\u00105�\u0016��s�l�԰\u0006S,\u0016�_֯.�\u0010T\u0013\u0012\u0017\u0006�A��\u0011�!/q��RXE2K���z������\u0016�� *���?�g�\u0002i<\u0017ŷ��'6k\b��\u0018\u000b��mOf\u0000�\u0016��[��_\u000f��\b�5b[X�\u0003�\u0014�j�\u001b(���F�b\u0006\u001c���\u0014P�j�/I\u0001߷����r\n7l)��g~;���+1;�\u0011��/���I�\u0006�F\u0011���\f\u0002δ[���gv\u0004�_h�`s\u0012�}T���^\u0013��H���L|W�3��h���D{io2�1l5t\bs]\u0015��o�R�v��T\u0016��\u0004BB�%�+�Q��|\u0016�X?\r�fV��\u0015�����Qz���#��:�^\u000eR\n5��{�K#\u001f\u0016?\u0005ԿwP���+�\n\u0001�\u001d?A{�\u001b\u0011z\u0006~����\u0017t�_\u0010����U�\u0010�#Cܹh\u0015f�\u001a�� �L��HDfw[��\t�\\�-���!:@r���HN{O�g{�>��l���U�k�/\u0002�\u001f�^\n~�ģa�oV�\u0011�N.\u0004�\u000b�[�\t*M>�\u00101�oV#QQ^�Y�6�m\u0002|�'O���]՗P�_f\u000e^\u0003���.�k�k��j\t��os�S��]��P\u0010u\\�m\b����Ҋ��r\u001b�j˥�\u001d�\u000b\u0017e{T>(��5�\f�p���kQ���7\u0012\t\u0018j\u001e��&��!��4���F?�l�����\u0019�\n�;T3+W�J\u0015\u001fb�c�\u00015�򋿠�\u0002�$\u001a\u0005�i�\u0003 O����'�,�\u0007��7�\u000e��~\"���\u0010�\u0012��e�.J\r}9�\t�w�d&>ܔ\u001bb�\u000fi2��+���\u0015L�0)J���\b<�U5�\u0004Q��L�\u0010�\u0001\u0007�\rZ��;L:\"������\u0016��o\r7}j��+�i\u0015\u0006O��A%f�\u0010���+�?G���l|�\u001f2�M�S?$�\u0004���\u0000���! �*�/\u0001]��!\u001a����`J��\nAQ�$\u0014����\u001fRߑ�\u0006�\u0013?�Y\u0005I}���̤I��pç��s{'\u001e\tpȁ�\u001cc�\u000e:�O9�wE�_j���\u001f���ߕ\u001b��r\u001b�r,�9:}�\u0003O\u0016�H$�\u001a�\u0004\u001dg*%5��~��L����t��+��^�Z&+��R�>��M!�\u00053x~\u0018�������� �\f\u0015���i�","payload_hex":"e559e88566ff7fa0d46f3612b58400278ffb34e872ae41c662294771e9ac1e4070a4d6bc3c4f2ccaca7bfec04cd2e643beb1495f1bf6c0a1829ace798ed5fe8c57d131d509231b8ac37ce3cfb6f4f83a312a8fddc51671cf2332628f8fcba06be7a34bd8a8a35cee8976059745cacd3a28728f554bedc1c85ae905eaf4a2dbfe18d476da2fef89d739aeae6d59033e0e5e03bef4ca2ed16bbb6b96d06a09b8cb6f73fb538f8d5de3ef5010755c9c6d08d9f6a78e7fd28a88de721b8b6acba5ae1de20b17657b543e2881fc35be0ce170f9f7ce6b51facada371209186a1ea7d52684c9218d85348085e2463fdb6c97f8b6ad9819f80ad53b54332b57e94a151f629e7f63b10135b5f28bbfa0ba029d241a05ff69aa03204fbdfee99827972c9607c1a537880ee6b77e22c2ddd0108b129287658e2e4a0d7d39e609ee77c664263edc941b62bc0f69328dea2b8cf5b3154cca30294a83feeb083cf855358a0451a8da4cb0109b0107ea0d5a8c833b4c3a22ebb2f6cee5b2168cd26f0d377d6aaeca2bbe6915064fbcf8412566be10fca7932b973f47fc86f06c7c911f32a74d98533f24960489eb97008a96f72120dc2ad02f015ddbdb211a89ac98ca604ae2e20a4151e62414f2aa9bc61f52df91bb06f9133fa25905497db5e7eecca449eefc70c3a7aded737b271e0970c881fa1c63d20e3aea4f39f17745fdef9d935f6ae2eb8c1fbdd8d8df951bdacf721ba4722ccb393a7dd8034f16904824b41aad041d672a2535ddd87ea9c74cd0e0efaa74dee22bbad95ea45a262b86dd52e33ec2fc4d21cd0533787e18c1988afcfebd8cec20c20c15a6e4a869c5","method":"","user_agent":"","ja3":"","session":"0578e5f8-6e31-4c49-adce-4f654177541b","seq":1,"duration_ms":101,"bytes_in":601,"bytes_out":13,"enriched":{"digest":"1d0820e79ffdb2ae","strings":["b)Gq","e{T>(",";T3+W",";L:\"","g*%5"]}},{"timestamp":"2026-10-05T20:37:35","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-GmpjZnEB5JKh","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d476d706a5a6e4542354a4b68","method":"","user_agent":"","ja3":"","session":"0449aa16-4225-4d73-bae9-db7d56d977ac","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"afe49c65ae616c22","strings":["BitTorrent protocol","<-qB5140-GmpjZnEB5JKh"]}},{"timestamp":"2026-10-05T20:36:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L7�4\nv��/�\u000b՟?�[U\u0016�\u0002\"W5�pq�\"1\u000eP�\t灆8\u0014��\u001d%�\u0002�/i6Ѱ�\u00008�X) �\u0005��<둹��k��:����y���ʑ��\u001c�.~E��'~�\u0007(~�\u0000��p�QN��� ������\u0012nb��~>r�t�s^\u000b\u0012O5ࢯ1~���\u0019��\u000b\u0003j5���e����\u001c�X���\u000e�\u000e7�\u0001���h\"Թ�/IfI�","payload_hex":"4c37b5340a7694872fd00bd59f3f9e5b5516c402225735b57071ae22310e50ca09e781863814828a1d25cf02b82f6936d1b08c0038a35829209f05e9833ceb91b98c906bb99c3aa79fd4fd79b3d57fadca91f1cf1cd52e7e45c5d3277ed907287edc00f69470e7514eb3bbe820d2f5e3e7bcea7f126e62cdf87e3e72bb7484735e0b124f35e0a2af317eabb9fb19a6bb0b036a35b8bdf465b19486d31cf2589ac5f40e860e37d501b6f0c26822d4b99a2f496649fb","method":"","user_agent":"","ja3":"","session":"4de7d4d1-a85b-4aad-a052-c733e3b6492d","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":13,"enriched":{"digest":"c347151e5ac01118","strings":["/IfI"]}},{"timestamp":"2026-10-05T20:35:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5140-JzRI6roZ)MzB","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353134302d4a7a524936726f5a294d7a42","method":"","user_agent":"","ja3":"","session":"4928786e-f7ed-4edb-bab4-4a7842e12197","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"65951b21dfeb5762","strings":["BitTorrent protocol","<-qB5140-JzRI6roZ)MzB"]}},{"timestamp":"2026-10-05T20:33:53","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���X����9iǑ�;?\u000e~�����_d��\u0012�t���{� ��%0\u0012\u0012���\u0004���꼌!\u001dǔ��_�\"\u0010ΰu��\f�Q�\u0019���܃��ȅ�l�8YХ�g_��\u0010�\t\u0016��CQO�\"f(̰�)�.���\u0006o$����\u000f>��08D9�t�����\n���:��!i3Q ��7�\"m�!�R��v���J��q[+\u000b\u0005\rU\u001eX-�'��u��%C��b�\u0010n�Vӏ.�բ�R���yu\u001b�\u00014���<�E��\f��i�Ɠ��+����Q��\u0015hG\u0012̵)t�\u0016u\u0001Tb!�\n�\t?�\u0012�\u0019��ͩ�I�� �_<\\�0P���\rH���ꜵ%\u001c�‡�E��p=y*���P�RT�)j��(���Da�\f�Pf��\u0007�h~��:b:��V\u001fS�<4r�\u0003S^9%~@�\u000e\u001b","payload_hex":"85b79b58edf39bb23969c791ff3b3f0e7ea8f6f57f8ce05f64aaff129f74c2e5be7b9020a5dc25301212b99ef804bea5d3eabc8c211dc794b6a65f9f2210ceb0759ec60cb151d119f5e082dc83f580c885e46c8a3859d0a5aa675f9bc210cb0916f69743514f87226628ccb09629c92eddf3f2066f2489b1868f0f3ecadf30384439c2748693f681c80af09ab93a98c42169335120e1a337d1226d96218c52bfa476f9c4db4ab1cb715b2b0b050d551e582dd027e69375808b2543fff66287106ea856d38f2ebbd5a2ff52ade1e679751bdc0134afa19e3cd34584800c858f69fcc693dff62ba48e83b251d8c015684712ccb52974b5167501546221a80adc093faa12e719d8c3cda99a49a3ef20c55f3c5cab3050b595e20d48e0c6e0ee9c89ea9cb5251cddc287ad45aba6703d792a8b94b050df5254c5296a8ee228af977f8b4461c80cb97f5066f2ec07b0687ea4913a623a95d6561f53843c3472b003535e39257e40d30e1b","method":"","user_agent":"","ja3":"","session":"85044cea-6a85-4360-9129-cf2820470e86","seq":1,"duration_ms":100,"bytes_in":360,"bytes_out":13,"enriched":{"digest":"70b5e23e331ff02d","strings":["08D9","!i3Q","p=y*","S^9%~@"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T20:54:16.856018+00:00"}