{"ip":"190.113.88.76","total_events":1612,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,612 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,612 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"329,541 bytes sent","bytes_sent":329541,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T20:22:49","last_seen":"2026-10-07T01:37:31","events_24h":249,"events_7d":1506,"geo":{"country_code":"GT","country_name":"Guatemala","region":"","city":"","lat":15.4974,"lon":-90.2525,"asn":264637,"org":"Blue Consulting Group, S. A."},"source_domain":"88.76.blue.net.gt","known_scanners":[],"scanner_tag":{"key":"peeringdb:as264637","label":"Blue Consulting Group","category":"isp","url":"https://www.peeringdb.com/asn/264637"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1612}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":106},{"date":"2026-09-30","count":79},{"date":"2026-10-01","count":98},{"date":"2026-10-02","count":341},{"date":"2026-10-03","count":237},{"date":"2026-10-04","count":301},{"date":"2026-10-05","count":201},{"date":"2026-10-06","count":207},{"date":"2026-10-07","count":42}],"recent_events":[{"timestamp":"2026-10-07T01:37:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-6*(PIxBGqGfJ","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d362a2850497842477147664a","method":"","user_agent":"","ja3":"","session":"3c8fb4f2-7777-49f5-b097-5dbde53761e6","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b982eb50f33d0432","strings":["BitTorrent protocol","<-UW160N-6*(PIxBGqGfJ"]}},{"timestamp":"2026-10-07T01:35:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L��E[i8�Z]\u0002�3K�\f`@��o���B�yk�\u001c}s�\\������\\�f8\u0014�������\u001dAg��.�^TX ~��g���\u0011�ͧ\u0005�Jr/��\u0006�����\b\u0004�T�ᢃ��\u00141(��\u0017��\u0005����D�h����O��%�'��P�G��e�\u0016�����\u0013cV\u001f�!��`\u0004:���\u0010��\f>\u001bU}�}\t�\u001bn�������\r�`;<\b","payload_hex":"4ca086455b6938cc5a5d029a334b9e0c6040dcd66fb3edd942f4796ba31c7d73885ca7bafdebb3ef5c9c663814ed8ddbf6f49dbf1d4167bba02ea85e5458207e8ca067c9fbc811d0cda705be4a722f85e60688fcc2e9b40804da54bfe1a283f4a4143128e9a917f4b005b4e6ffe344e56893d5e4b64f87f725bf27c1ae50d1478f8265d71698dcd5f1be1363561fe921e5a560043ab0d7c81099bf0c3e1b557de87d09991b6ebca78988b39dae0df0603b3c08","method":"","user_agent":"","ja3":"","session":"72bfbd9c-4e6f-41f5-888f-cdeb2565619a","seq":1,"duration_ms":100,"bytes_in":179,"bytes_out":13,"enriched":{"digest":"1ea60a6be52ab72b","strings":["E[i8","^TX ~"]}},{"timestamp":"2026-10-07T01:32:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-!wYdXclB*OrE","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d2177596458636c422a4f7245","method":"","user_agent":"","ja3":"","session":"b94768b7-cd2e-4815-baac-3365a5781046","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b86b0ee4fc08aa85","strings":["BitTorrent protocol","<-UW160N-!wYdXclB*OrE"]}},{"timestamp":"2026-10-07T01:30:36","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"b\"򪀯y�4�o��\u001d\b*Y�A��K�\u0010U���mD�s���jT���Ɛ\"��R��\u0000,u���\u001eI�U�h\u0002\n+t�գ��!:��r��^�Z���ԙ�^�Q�a�����Q�OU~��\f‘��\u0012[͛�\u0005Pn\u0002\u0014A�\u0001f��.G�/��٘ߧ痚��Iԍ�t�\u0015q���\u000b�'������6�cL�,>�\u000f~\u0001\u000e���\u001b�M�7u�CI\u000e\u0014N\u0016�\u0007M�곂��V��\u001a��l)\n�b\u0004T�\u0001�\u001cns�q�j��vL[�]^�����Z*�\u001a쭒K�l�Ov\u000b�D��Xl�Q��d޼�b09S:����\u000b?�p�\u001dl�1�yD�>��\u0010OpSF=h���%�(��v����^���k�\u0005�r\u0007��Ğ����7\",\u0003�����MH(�R\u000b�Y������'�\u0019��\u0006�\u001c�_�q\u0015��d;\u001fK����/�\n��\u001eK�B�#���V�\u000e�9�\u0001\u000eLw��8�-\u0019Pg\u001d<7\u000f�ћ�{�,\r)��ށ�D��ECØ\u000b�̌º�!���g꿺�-z\u0011��W�\\��\u000eѓ������\u001d\u0005M��%qR<��I��\u001f�풣m��o=}dӰ�ⶀ\u0007�\u0006\u001bQ7ٰ�Ħϯċ��������aU%�j��hy�����O\u00137�M�,�*G�w�8��<\u0005�\u0007=���kp$\t�H�\"d","payload_hex":"6222f2aa80af79e034c26f899d1d082a59f141c1f84bdd105588b2d46d44f17396ebdf6a54dfd6e3c69022a89f52bbaf002c75b589e11e49e455bd68020a2b74e0d5a3e8b2213ad8f572afe15ea95aedf6d7d499b55eef51bc61f69ed8d5ce518a4f557eaa820cc291eaaf125bcd9beb05506e021441de0166ebc72e47962fe6b6d998dfa7e7979aebf549d48dfa74ca1571defbf80ba1279f84e08299ac369a634cd02c3eed0f7e010e94aba81b904d9f3775d843490e144e16f7074d98eab38288f056b2f91aa6986c290ad3620454f401d61c6e73887f71b26af4de764c5bd95d5ebe9abefde15a2ac21aecad924be06cc84f760b8f4482ed586c9851a4f764debcc1623039533a85a3aacd0b3fdc70821d6ce831a27944a43e99cb104f7053463d68bb80e225c128afd376edb3a4b25ec3f2a56bbb05cc72078ddcc49efa99f8e437222c03b7fcefa7de4d4828ca520ba0599596cbe2f29e279619fffe06a91cb95ff27115a0e5643b1f4be4f3a9a32ffc0adac11e4bbe42f723ebecc756f40ed939e8010e4c77b0f038f52d1950671d3c370fe4d19b817b8b2c0d29fba5de81ae448bcf4543c3980bb6cc8cc2bac121ebfbb567eabfbac62d7a11b8e957f35cd3cf0ed193fd8dfd8fc9ee1d054dcbd42571523ccad749a5a61fc9ed92a36dffae6f3d7d64d3b097e2b68007ca061b5137d9b0f7c4a6cfafc48b8596f6bdffefa3d7615525b36ac0c468799edee1fe824f13378c4de62cfb2a47d07782389bd93c05e4073df7badb6b702409f048b92264","method":"","user_agent":"","ja3":"","session":"68d06abd-4b86-45dc-bddf-e7b11babf2cc","seq":1,"duration_ms":100,"bytes_in":563,"bytes_out":13,"enriched":{"digest":"99ac5f58dc01bd0a","strings":["b09S:","OpSF=h","%qR<","o=}d"]}},{"timestamp":"2026-10-07T01:28:05","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-b7B(qPsAPTi-","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d62374228715073415054692d","method":"","user_agent":"","ja3":"","session":"c36375c5-013b-4e65-b933-c05d598506a6","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"a89942289a113eef","strings":["BitTorrent protocol","<-UW160N-b7B(qPsAPTi-"]}},{"timestamp":"2026-10-07T01:25:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"#�dɃ�p�� �4u��d�Y��T�\u0010<j��/\u0015\u0016\u0016|\u0007����6'��C}�U�*ަ�eeRx8�i�b(n7>>�@r�n��\u0005���\u001f���+XJG%BW�m��L�;Nsex?����\u0013W������PR�Q샖�2��RB��\u0012\u000ezR�A�����/~ :��d�\u001f�,�l�\u0018\u0002\u0004��9\u0014\u0014��ݴ\f�O�hL4P̈́���c߆���ڜ\u0005L,�8��\u0012��R��-��%;s̄����S.�.����H!vU�I��#>G��\u0013X�PT�,�1�\\j��h\u0010��\u0011����{Q\u0017܃gaܦw�g�aBK��t�J�������&K#�@���CV��\u001e�C�����[޿r\fPՂk���65\\�\u0005D_*���{��:����d̴\u0003\u0017�s","payload_hex":"23a464c983f070e1dd20a3347585b964c559ec9e54ef103c6a87922f1516167c0795d6eda83627f0c1437dd855ae2adea6ff6565527838e069c962286e373e3ec04072ee6ecef6059feb7f971ff9d5d42b584a47254257df6d91db4cf03b4e7365783feeb0d0cf1357be9db7eafc9b5052ae51ec8396d132c19b5242b7a0120e7a52b641d8cde2fdd52f7e203aa5df64eb1fb22c916cb6180204d0ef391414ece5ddb40ce54f83684c3450cd848fe4a363df86aee3f0da9c054c2cb738ada912a9b9528fd52db79c253b73cc84d47fa6a7f1532e922e9086918a48217655b04981ab233e479a8d1358d05054d92cd231b35c6aefc56810a5b111dde6f8bd7b5117dc836761dca6779767ea61424b9bd0749e4aa39bbaafc1b9e2264b23c640ad95ec4356fed91e9543accce6d2f95bdebf720c50d5826bebd2e636355ce705445f2af4f5f17bd9e63a9daab0f464ccb403178673","method":"","user_agent":"","ja3":"","session":"0843b0c0-f484-48ab-a5c9-8717645d4ad5","seq":1,"duration_ms":100,"bytes_in":340,"bytes_out":13,"enriched":{"digest":"84ada2540c4b00f7","strings":["eeRx8","b(n7>>","+XJG%BW",";Nsex?","hL4P","H!vU"]}},{"timestamp":"2026-10-07T01:23:21","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-t!7vsiHU1sBB","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d742137767369485531734242","method":"","user_agent":"","ja3":"","session":"add731a4-d037-4604-9f22-c78ffe1b5800","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"051b77bc86ace1f2","strings":["BitTorrent protocol","<-UW160N-t!7vsiHU1sBB"]}},{"timestamp":"2026-10-07T01:21:09","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"),o![&1�4���gϖ\u0001�J�\u0003V���L\u001c�?\u0017�@���U��D�ݱ���\\�}Q�3�H�[z�`��8�\u000ep�frp�ʭ�]:Չaq�\u0002\u001a�A\\4\u0006\u001e\u000e0=�r,\u0005��N5f5D�ٚ�8~��M�܀\u000f�&\u0011p���h|\u0000����p�B�\u0007\bi�/�(�Y���\"\b��h��%m\u0004��K�&Q��U\u0011u�{�lI�Un.S8Z�ij��jR7z\u0002�He�s��q������C\u0001��\u0011\b\u001e�J��Ξ����\u0018'ޗzɽ{0�7|U�ؤ�r\u0004?\u0015��Q.��ӯ�%O�^\u0012�\b\u0019�E'\u001c�46(\u001d\u001c\u001f�k�g\u001d�\u0018�̍\\�\u0018!_���]��%�I�\u0002��\\��\b���Ф��g�$S!zN�GK�n���\u0011�]5��!Y�Tܖ\u001a������\u000f)�Bߞ�d\n�ٜ=۷�&\u0016��I*��n\fַ�0�\u001df��$�\u000f\u001fDބ�\u0017Ȉ�v\u0000��&|wCS�����K�\"L㽒b&\u0013�qj'¾a���D�E\r\u001c��\u001f!�k0!�5���]\u001ea�\u0014<LR���S�>*�\u0012�\u001f\u0011\u0018(���sQ�\r��%\u0013�>\f�Y�� )HMx��_\u0006k]","payload_hex":"292c6f215b2631e434d9cbd567cf9601f14af20356f3bfa64c1cf43f17b040ab8ac255838c44a8ddb192d7d95cd67d51a033f548ad5b7aa660f8d438d00e70d5667270fbcaad805d3ad5896171f6021af7415c34061e0e303dc0722c05b7fc4e35663544ddd99ad5387ef8914df5dc800fa52611707fc0b396687c00fab3a8d070a94287070869e42f8a28f359b79db82208afea6880b9256d04e69f4b802651bbd0551175e57bc86c49d9556e2e53385a9f696a86ee6a52377a02fc4865f173a4b371acacb391b2fd4301e9fa11081edd4ac5d5ce9eb9deddc61827de977ac9bd7b30e4377c5585d8a49972043f15a6aa512eafa4d3afe3254fdf5e12b40819f945271c893436281d1c1f8a6be7671dc4188acc8d5ce718215fe2c1fa5d91b825a949e602a7be5c90fb08fdbbe7d0a4e8cf67cb2453217a4eb6474bcb6ea5a0bc119f5d35f5ff2159fb54dc961adaec99f9a4d40f29b942df9ea2640a96d99c3ddbb7822616b8a4492ac6eb6e0cd6b785308d1d6693f3248f0f1f44de84da17c888ea76008094267c774353a0ac96aefa4bda224ce3bd92622613ee716a27c2be61d0f79f44cb450d1cb1e81f21dc6b30218835e5eaac5d1e61d4143c4c52cbe5c653f93e2ab912d61f111828b2e5ba7351be0dbadf25139d3e0cf359f2bd2029484d7890be5f066b5d","method":"","user_agent":"","ja3":"","session":"9d9a095f-0152-4898-87fd-6c579c3a2e53","seq":1,"duration_ms":100,"bytes_in":490,"bytes_out":13,"enriched":{"digest":"050e30ff0eba867f","strings":["),o![&1","N5f5D","Un.S8Z","jR7z","$S!zN","&|wCS",")HMx"]}},{"timestamp":"2026-10-07T01:18:39","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-OA.pifCyhC6i","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d4f412e706966437968433669","method":"","user_agent":"","ja3":"","session":"4807b45d-4865-433a-bb9a-973cab608027","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"68aba7b54a478320","strings":["BitTorrent protocol","<-UW160N-OA.pifCyhC6i"]}},{"timestamp":"2026-10-07T01:16:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�(W�\u0004X\u0018I�\u0007dQ��/��Z\u001dxB���\\d�\u0019�rzU�\u0018��KIӈ)\u0006�\u0004h\u000e+�{�j�=L_�zԻ��\u0000��\u0003�\u001c�f?�$\u0018��N��ύ\u001b>\u000f��B3\u001e��\u001a�b��\rS��๻#m�\u0004���MAq\u0018��Q�b({�U��}-hZ��(�S�\"��hj\u0003t𛑬���\u001a��","payload_hex":"8328579e045818498e076451b9a12fb5935a1d7842f6f0ca5c648019d7727a55a9188f894b49d3882906ff04680e2b8e7b8d6aa53d4c5ffd7ad4bba5e80097d103c61cbc663f9b2418bde84ea9e4cf8d1b3e0fa3c942331e84a81ab662dff70d5381bee0b9bb236dda0485f1fa4d417118878351a462287b8b558ee97d2d685ae0e028d753db22efc7686a0374f09b91acf88fa21a92cb","method":"","user_agent":"","ja3":"","session":"1dcfcc3a-878e-40d7-91e2-0d0bbc3dc9ed","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":13,"enriched":{"digest":"5c6410d3504afc54","strings":["}-hZ"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-07T08:12:34.700069+00:00"}