{"ip":"189.63.227.121","total_events":637,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"637 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["637 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"130,259 bytes sent","bytes_sent":130259,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-28T15:59:43","last_seen":"2026-08-20T21:21:08","events_24h":77,"events_7d":77,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"Ribeirão Preto","lat":-21.1734,"lon":-47.8023,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"bd3fe379.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":637}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-28","count":257},{"date":"2026-08-01","count":131},{"date":"2026-08-02","count":4},{"date":"2026-08-03","count":38},{"date":"2026-08-04","count":63},{"date":"2026-08-06","count":67},{"date":"2026-08-20","count":77}],"recent_events":[{"timestamp":"2026-08-20T21:21:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"x���Lb\u001e\f�2�M�$e]--�e~F<.4��\u0000A�2��'j\u0004nZ���3\u0002-Hx�ŧ��0�\u0012\u0018���)��\u00070������W\u000e\u001f���5�����*���Y��@.]�q��\u001b�/9��\u0019��OL.8\u0019Q��\u001dԍ��™P�\u0019�q��%\u0003���j8�&��2���\u0005��\u0018T)�\u000e|� �\fE*\u0018\u000e����F\u0013\u0005��\u0011��ĚϢx���p\\��B�2�ǧ�\u000fcf��8N\u0015\u000b����\"S`�o���\u0013\u0011\u0012Ԛ�y�赫�⍔���B\u0006L�^�\bZ0��ˆl\u000e\u0006�/+�MKƙ�E�}���\u0018T���m�b��y�\u001d����f;�,ޟ=~�=#<���.v��'\u0003È�>���9<���Zn��Ĺ��V3�+���F~񌄍n�'6�q�ݷ\u0005����£���\u000fC�f��M*:\u0018\"\u000fg�U;)���\u0015��<P�G6Oݳ{��x���M���������\u0002�,�ܹq��!�\u001d�2hƋ~\u00059\tݘ<M�(gY`F��e�%>�>L�AVl/�4�","payload_hex":"78c2c9fe4c621e0cfa32da4dcc24655d2d2d96657e463c2e34bdf20041e932b2f3276a046e5a9ee18233022d4878f4c5a7d3f730ba1218bd84c3299ed10730f1d6cbe9c1a3570e1f8cb2ec359b8a9faac72a9bbff75992dc402e5d9b71c7ee1b882f3983ba19a1e84f4c2e381951fed71dd48d8989c29950da199371e4912503b9f1856a389226ddc132b395ca05a3a2185429b90e7ca220c70c452a180edec5ffbb46130586aa11f792c49acfa278a883c7705cd9ed42d832d6c7a7c60f63668ed4384e150b8cd8f2ac225360a86f8f89c71311127fd49ac679d8e8b5abd4e28d94ef8cda42064ce85ee0085a308ebecb866c0e06d42f2b8f4d4bc699af459f7dd8f8bb1854b2e09f6d806294af79e11d9fc7e6fe663bb22cde9f3d7efa3d233cb2aba92e76a7d42703c388f03ee0fc8a393cc0abde5a6ea9edc4b9998b5633ab2baebed5467ef18c848d6ebb2736f3719addb7059ebfc5c4c2a39fb0830f43a566eda34d2a3a18220f67e8553b299df9c915f8d23c50ba47364fddb37b8cfc7895a0c84dadededeac8d7ddd2df029d2c85dcb971acde218e1dbc3268c68b7e053909dd983c4d872867596046ddef6584253eea3e4cd741566c2f9a3492","method":"","user_agent":"","ja3":"","session":"03a27da8-c7b8-4bcd-9967-5c7a418a3e9a","seq":1,"duration_ms":102,"bytes_in":446,"bytes_out":14,"enriched":{"digest":"5949fd966b5c4add","strings":["$e]--","e~F<.4","OL.8","(gY`F","AVl/"]}},{"timestamp":"2026-08-20T21:19:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-T)jJC-iB.b.y","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d54296a4a432d69422e622e79","method":"","user_agent":"","ja3":"","session":"b3cf0410-80fe-4628-bf2b-de345b8d2f27","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"901378b04aeeb7e7","strings":["BitTorrent protocol","<-qB5000-T)jJC-iB.b.y"]}},{"timestamp":"2026-08-20T21:16:44","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"A\u001f����niJru�unFR���w/:���y�@�aK\u001d���V$�2ߦ{!/�0�`�\u0018M����\u0019���aPE���=��/\\��\u001d���5|K?e6a��$�B��$�R�OA�}m��������H\n.O�ƈ�\u0016E�A�)\u00063�7��0Q����=B_\u0006x�č�8�vLL\u0005���\u001d�=����\u0012N\td\u000fR�\u0019ۏ�\u000eL�o\u0019��kp��\r�jCL-q���\u000e\u0007\u0000\u0007��W�\u0002Qrp���{\u0016u�C�~�5\u00184\u001a�*\u0018\u0013��i��WV\u0001|�5�֫��\u0017��G�}U'Rn\n�����&\n�ʆƛ��mG�\u0011��\u0000j���\"�xH���VZJ�gښ�\u0015XG�\u000eLni�BNJ\u001eT�}�\f+�\u0001m�\f�'�","payload_hex":"411f96b3acfd6e694a72759d756e4652f088c6772f3a88bdf979be40be614b1d9be8bd5624a432dfa67b212fe3309c60b9184db7d7d3f1198483d46150459ea0ca3db3d12f5cb2901d96839b357c4b3f6536618bf224c242d0f124d3529c4f418d7d6d9bfeae8c83a492ab480a2e4fd3c6888d16458941b1290633d43798c0305182e6daec3d425f067899c48d843888764c4c05e1a5db1de43df397e180124e09640f52ff19db8f8f0e4cb16f19aefb6b70c2db0de96a434c2d71b0eaf90e070007b0fb57ea02517270a1e9b27b1675b77f43ae7ef83518341ad42a181382fc6997f75756017cb83588d6ab828f1788cc47e07d5527526e0ae6fcf5f895260ad5ca86c69bba8b6d47bf1186c9006aa0e3dc22c67848a49f9a565a4a8167da9a92155847e90e4c6e69d6424e4a1e54fc7dc50c2be9016dc60cb2279b","method":"","user_agent":"","ja3":"","session":"7fb262fe-1cf0-4982-9e7b-f90b6c6d387f","seq":1,"duration_ms":100,"bytes_in":316,"bytes_out":14,"enriched":{"digest":"3527761ed67f550b","strings":["niJru","unFR","5|K?e6a","jCL-q","}U'Rn"]}},{"timestamp":"2026-08-20T21:14:23","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-2)EZx769iqPG","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d3229455a7837363969715047","method":"","user_agent":"","ja3":"","session":"1db08e43-f3fa-44a9-8588-4bcba340ecdc","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"f0a295db5360bccb","strings":["BitTorrent protocol","<-qB5000-2)EZx769iqPG"]}},{"timestamp":"2026-08-20T21:13:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0002v������\"�\u0019COK�6\u0001�3������m�؆\u0012�E!��\u001f$�h�=ʚ��\u0002�0g�'q�@�S�+\u001f���\u000b\u0019�\u0012�Y\u001f��;9��8�_�\u0011�1>��̞\u0014y\u0003�lo/��#\u0010�L{\u0017�%�]*���\u0006�1��wW\tM\u001bE����Y���\u000b\u0018","payload_hex":"0276c4f5bdc3d5fd22bd19434f4bfe3601b233fae4bcfbf9d56d9bd886129645218da41f24f868fc3dca9ae78f02a03067ea2771f8408c53fe2b1feef1920b19dc12b2591f86d03b399be138ba5ff211b7313ebdb1cc9e1479038a6c6f2fc0932310d04c7b17e125865d2a8a99ac06f431e3cf7757094d1b45b5ec99f7599fb8ba0b18","method":"","user_agent":"","ja3":"","session":"8c6e3ffc-61c5-44e1-9a45-a661bf42ca93","seq":1,"duration_ms":101,"bytes_in":131,"bytes_out":14},{"timestamp":"2026-08-20T21:11:57","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-Jujz_pqW-F!C","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d4a756a7a5f7071572d462143","method":"","user_agent":"","ja3":"","session":"afc4432e-2922-477e-958c-1bc50e60cdcb","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"8ff05b68acd514bb","strings":["BitTorrent protocol","<-qB5000-Jujz_pqW-F!C"]}},{"timestamp":"2026-08-20T21:10:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l��Vj�\u0014�!\u0013fbUR�S�����B=�?F��>]1]�X����\u0013��t\u0010�Ϣ߰��|1>@��\u001c�\u0011��:ߙ�-�K�1��w]\u0019�oq\u0015Y8�`r\u0019\u001e_�O�`���4�a[�V�O��ܑ�\u0007�<H�X�uަ��n�Y�~���\r�8ص�D:��\t\u000e%\\�ʞ�6v��L8@�|����T���ld��\u000f�U��z@�\u000e���{�\u0003􁛻H\r\u0016\u001f\u000b�\u0014`@��\u0019]����\"\"\u0012������>�\u000e@Z{�:�l�X���\fF.�\u00122s1���\u001b\u001a����\u0000Q�4\nn1X��Pv��m5��M�y謇9BŸO\u0013�&�\u0010\u001c ;\u0013�\u0011��S��5u�QB�/�O�\u0001���'gc\u0000O0\u0005W��+x��@�u�\u000f���vX1��\u0016����,�\n��Y�W��!���\u0018��k�QD��\u0000\u0000�\u000fFs�","payload_hex":"6cc9e1566acb14a62113666255529953859af5bddd423dc53f46a08d3e5d315dc758bb98d2c113f0f9741086cfa2dfb0908c7c313e40f7da1cdf117f97d93adf99df2dc24ba1319ef6775d19ed6f71155938f86072191e5f9e4fa560d7ced6348c615be856f14f9984dc918a07f63c48ad58b275dea6e3c56ef159fe7ec098bc0d9938d8b5db443ab0c2090e255cd1ca9ee836769f914c3840ca7ce6acdefc5488957f936c64849a0fa35597e27a40eb0efda7a37bb203f4819bbb480d161f0bde146040c47f87195d97f7a0a7222212c0c0969eb79c3ef10e405a7bc23aab6c8c58cfd8cf0c462e8d12327331a4fa8d1b1a977f96bede005180340a6e3158cfd4507697e76d35a1c14db779e8ac873942c5b84f13c42683101c203b13d111d4ea53aca53575cd5142ad2fdb4f9f0192faa7276763004f300557b0972b78c2f9408575950fa4dbc8765831f2e016a1c0b2ea2cf30af3ee59d657cceb217fc9edaa1897e46bbe5144a6e30000b50f467388","method":"","user_agent":"","ja3":"","session":"b083e226-571e-42e2-84ed-541a551b4881","seq":1,"duration_ms":100,"bytes_in":369,"bytes_out":14,"enriched":{"digest":"20a45c640fe9a2a7","strings":["fbUR",">]1]","|1>@","'gcO0"]}},{"timestamp":"2026-08-20T21:09:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-cR1Y~zjUhHIJ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d635231597e7a6a556848494a","method":"","user_agent":"","ja3":"","session":"1057b932-6c84-4bd6-aac5-12609d241414","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"2f4d8cfa379f9b71","strings":["BitTorrent protocol","<-qB5000-cR1Y~zjUhHIJ"]}},{"timestamp":"2026-08-20T21:09:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-cR1Y~zjUhHIJ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d635231597e7a6a556848494a","method":"","user_agent":"","ja3":"","session":"1057b932-6c84-4bd6-aac5-12609d241414","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"2f4d8cfa379f9b71","strings":["BitTorrent protocol","<-qB5000-cR1Y~zjUhHIJ"]}},{"timestamp":"2026-08-20T21:09:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-qB5000-cR1Y~zjUhHIJ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d7142353030302d635231597e7a6a556848494a","method":"","user_agent":"","ja3":"","session":"1057b932-6c84-4bd6-aac5-12609d241414","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"2f4d8cfa379f9b71","strings":["BitTorrent protocol","<-qB5000-cR1Y~zjUhHIJ"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:22:18.890359+00:00"}