{"ip":"189.217.105.198","total_events":545,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"545 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["545 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"114,383 bytes sent","bytes_sent":114383,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T12:54:58","last_seen":"2026-09-21T01:38:55","events_24h":545,"events_7d":545,"geo":{"country_code":"MX","country_name":"Mexico","region":"México","city":"Naucalpan","lat":19.4692,"lon":-99.2974,"asn":28548,"org":"Cablevision, S.A. de C.V."},"source_domain":"customer-189-217-105-198.cablevision.net.mx","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28548","label":"izzi telecom (AS28548)","category":"isp","url":"https://www.peeringdb.com/asn/28548"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":545}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-20","count":471},{"date":"2026-09-21","count":74}],"recent_events":[{"timestamp":"2026-09-21T01:38:55","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-vcjNQB)vPxTO","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d76636a4e514229765078544f","method":"","user_agent":"","ja3":"","session":"7a534879-f68e-4aa1-9bd2-39f9989eb6a3","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"588ce9909ff3c525","strings":["BitTorrent protocol","<-UW160N-vcjNQB)vPxTO"]}},{"timestamp":"2026-09-21T01:37:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"1\bC��S�<\r�s�Oh�\u0003�\u0001CEF���\t���V\u0018v���F�A�F���=\nYm�\u0002\u0005\u0016M$�'��L\u0015D}w�y��\u0002��Moc����!ΊL\u0007%���SQ\u0013�΢���J{D�Y��W\u000b��S�C�Ta\u000bP}�}!��$��B�\u0019\u0017_U�\t�\u000f����:�� �[W�+�f�\u000e���\u001f\u0007\u0001�Le\rъ\u0018����\u0001��Υ�[���\u00121��AR���(�.\u000e�\u0011Z.Y0UWOK�CÓ0&�gӁ2��^;)�pM\u0016]\u0006)��z�\b�1�d'+Z�;��Op3;p֚\u0001E\t��\b\u001bWc�\u0003�;\u001ba,@�QO���츽=�\\l�B��D��\u0010e1�,�o\u0011�","payload_hex":"3108438dc553e43c0d8b73cd4f688703c00143454686bba109dbeebe561876bbf9b846e6419646ac94f53d0a596dd60205164d24e627efa34c15447d778c799bc402d1f34d6f63fc8db08921ce8a4c0725f4f8f5535113b1cea29a89984a7b448959b4b9570bd6c97f53de43bc54610b507db27d21fcec248faa42a719175f55c609b40f8ac1bcc03ac2fc20915b577f802b8166a60e87b1c21f0701874c650dd18a1897b1a9cf0187decea5b45bb3c4fd1231808c415296adf628c92e0eee115a2e59305557eea2b94f4b9643c3933026c467d38132feef5e3b29cc704d165d062990e77acb0891319664272b5aee3ba2c14f70333b707fd69a014509bed3081b5763fb039b3b1b612c40cb514faeb881ecb8bd3d845c6cc942bed344fdd9106531bf2c906f11b4","method":"","user_agent":"","ja3":"","session":"3cd5ccc6-81c7-4195-b35c-94dfed10a818","seq":1,"duration_ms":101,"bytes_in":296,"bytes_out":15,"enriched":{"digest":"1167359a9ea37063","strings":["Z.Y0UW","d'+Z","Op3;p"]}},{"timestamp":"2026-09-21T01:36:13","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-px~p)X6.R7_F","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d70787e702958362e52375f46","method":"","user_agent":"","ja3":"","session":"1da6d60e-a0ae-44b9-bd25-6c281d673c75","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"da6f04cc1bfb759e","strings":["BitTorrent protocol","<-UW160N-px~p)X6.R7_F"]}},{"timestamp":"2026-09-21T01:35:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"9�\u0010�)�wH�~FN�4Ozx\u001e\u000fq�A$��g\"��\u00160�����V\u001c�Ay��eV�>�i1_C-/|h,NF���\u0011\u000e��uN�\u0003�\u001c�q�\"��pG\u0002�Q\u000b�\u0016% ��d�I���{cx\u0019:2+�\u0011A5E\u0019%���\u0010h�B�/��9�\bD.�\n8�Jb�/�`�T\f_y�E\n\u0015�f��H�j���辛�3��:�\u000193��m��1i9�4c*|�y�S�MaB�D��\"������qr�Y�ir�\"u��}�a\u0012��F\u000f�w1�e���;<���bF;�ئ:���\"�\u0011K�ęCp\u001b��=Z^�2�X�O\u000b0\u001c�Z�)3l�>�6�DVd�j2�.\u0015�{H�\u0007���\u0016<[4b���w\u0003$","payload_hex":"39b310f1297f9e7748c17e464eee344f7a781e0f71d2412491ef6722fdc71630f0fa90aecf561cd64179a3816556bb3ede69315f432d2f7c682c4e46dbcfde110ee68d754e8c03831cd671f1229def704702e3517f0ba0162520dee764cc49a7ade07b6378193a322b86114135451925e6f2a81068f042bc2fb2e5398208442ea00a38d94a62a62fe260bf540c5f79ae7f450a15bc66f79648a16abad8d9e8be9bdc33abbd3ab0013933a5ad6dbbc0316939fe34632a7cb779c053b34d6142d944999522c8efd9cbf1b57172a459fa69728a2275ceda7db26112b6b7460f8177319b65f8bd9a3b3ccbd8da62463bdfd8a63aa4828922ac114b91c49943701bc0983d5a5e9232c158b54f0b301c915acc29336ce13eb436a9445664cc6a32e52e15927b48b90781cbf2163c5b3462b1ebf4770324","method":"","user_agent":"","ja3":"","session":"a19c7830-d3ca-4412-9710-ceb186a2fd13","seq":1,"duration_ms":100,"bytes_in":308,"bytes_out":15,"enriched":{"digest":"a33fbb2bc25829f1","strings":["4Ozx","i1_C-/|h,NF","4c*|","<[4b"]}},{"timestamp":"2026-09-21T01:33:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-KDMl)rbqm~ZN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d4b444d6c297262716d7e5a4e","method":"","user_agent":"","ja3":"","session":"7551b0a0-051c-41f7-92e5-e65af235d082","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"65a60c50e78eea02","strings":["BitTorrent protocol","<-UW160N-KDMl)rbqm~ZN"]}},{"timestamp":"2026-09-21T01:32:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"'<#/iɉ\u001a�oUr�\u001c�\u0003Ko2\r8\u00179��4�*���<\u001f5���|\u0010X��/O��գc�9�+�S�Nנ1.ySFٺ\u000e v�{@�x�4��\u0017����٣N0�Bn�*�W��n�\u0001cB:L�A,m�&�(�\u0003���5!\u000bXGPnk jS���@m�ʔ\u0004��]nj�g����\u001bO��\u0019�hux\u0017�\u0007��59|�,1x�����\u0003Y�Ҵ\"\u0002dd��&^��V\t0c\n��N�L.�z�3��X��ݍ�\u0019\u0016{RYq\b=�?1`�%W\u0012��\u0017�q�6�^�4�l!f�Q�\u00000l����@","payload_hex":"b1e8f92269e55ba8da6b6c6f584d907fc9031ba6923c5e4bf97089ac2e6583a694b5a14f7326cf4624dfed78d3040d10e41aacbc3dc90b70bada5beffa492472ae3a6e1b7ea0a23be17a7e6680bafed078bcf7b3bc12562326e70e375ab4a1926a160064b11aedc9a9aaebadcf020a783b19b1b69dace15b45161965d995a87034c6d7d4f7151e68c421c61f979ff69ee4cf0a33872191fa8e88e23d1bf56394c8b93970d32f558e93fee0a3898aa960d0ea032fec9633d426a448be55261ebf9dc510a125087117f9815b12318fd992e78b82c3f53bc51248144e4a96b46f839a7db3a8367a3b26fa81bbfcfe815fa2ef0d50c140ea4bd1d9d16a158ead5f223097082933de2ff6d89936f479e4a2cff7cde127ede13fb6d6bc06adaa2c3dfa92825204e5ce1ce0084d244c91422578555f5ac0503cdaa99f9b10894075994db6c79613feebe6b9089a3d4bee77e4893e8fe8fed9a34e3080426ea12a98579eb86eba0163423a4ce8412c6de826e728dd03bfc8e735210b5847506e6b206a53aae3a8406dc7ca9404bcb05d6e6ae967f0d1d5c81b4f8ae019cf68757817eb07a1eb35397cd22c31788099daef880359fed2b422026464add2265ef3b0560930630ac0b14ea34c2ed97adb33b0f658a2d8dd8d9819167b525971083da33f3160e0255712be8117c171b936d55efa349a6c2166bc51b900306cf4c4f9b840","method":"","user_agent":"","ja3":"","session":"38d89b3e-e1ab-476a-975e-4dda618a51aa","seq":1,"duration_ms":100,"bytes_in":510,"bytes_out":15,"enriched":{"digest":"3dfc4386fccd7bc1","strings":["kloXM","6z;&","B%xU_Z","cB:L","XGPnk jS","{RYq"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T10:42:56.594111+00:00"}