{"ip":"190.131.140.70","total_events":2258,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"2,258 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["2,258 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"477,014 bytes sent","bytes_sent":477014,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-30T15:37:33","last_seen":"2026-08-19T03:27:56","events_24h":0,"events_7d":791,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Guayas","city":"Guayaquil","lat":-2.2038,"lon":-79.8819,"asn":27738,"org":"Ecuadortelecom S.A."},"source_domain":"hfce-190-131-140-70.customer.claro.com.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27738","label":"Ecuadortelecom","category":"isp","url":"https://www.peeringdb.com/asn/27738"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":2258}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-30","count":29},{"date":"2026-07-31","count":26},{"date":"2026-08-01","count":31},{"date":"2026-08-04","count":172},{"date":"2026-08-05","count":199},{"date":"2026-08-06","count":138},{"date":"2026-08-07","count":219},{"date":"2026-08-08","count":177},{"date":"2026-08-09","count":309},{"date":"2026-08-10","count":139},{"date":"2026-08-11","count":28},{"date":"2026-08-14","count":156},{"date":"2026-08-15","count":53},{"date":"2026-08-17","count":237},{"date":"2026-08-18","count":242},{"date":"2026-08-19","count":103}],"recent_events":[{"timestamp":"2026-08-19T03:27:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-z7w_)O4M7BF~","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d7a37775f294f344d3742467e","method":"","user_agent":"","ja3":"","session":"430f622b-6254-47d5-b3e2-40235c674c60","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"c5ae39ddfcafbe8f","strings":["BitTorrent protocol","<-UW1605-z7w_)O4M7BF~"]}},{"timestamp":"2026-08-19T03:07:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"GF�˛*�Mo1uoqq�O�R��;;�ЮR���ZJ\u001e�I\n�Ϗ�!&\u000e��U\u001f0�9}�ۀ�lMR����mD�\"TK\u001c�\u0010�\u00188[�W�^�T\u0013�Qb��\u0005z�1\u0003�\u0000f=,r��\u00155�f��ۺ#�\u0018]�����D+�ۃ\u0010�\u0003�\u0006p�\u001b�]�+Ԑ�h*�\u0003�b��h$b�\u000fq���L�e�\u0013G\"۩v0N��f\u0017|_\u001f\u0012\u00190N��=�G ,\u0006_��ϭR?1m;5�\u0016\u0012\u001a-��L\u000e_2�K�\u000f���ll��p�\u0014��\u000bA\u001d�6�؊�\u0015�\u0000\u000bj\u0005�4�-���\r\u0011�����r�M�ɴ6Y�G\u001f�N[�����}l�F��\tj�h]'�����F�n�3I'�c\u00190���/�9��}���R�5k�q\u0012\u0011Tf�\u0000E߶0B�[K�����$!�ٹ\u0001�\u0006�c��\tx|��{�m����ж�Ӽӝ���P&^��\n\u0019k\u0018M�ܾ�Hl���΄�Y/�W�V�X)A��\\�\u0006s.q��,V��>rѰ[?M\u0004Jw�y������]\u0004/","payload_hex":"4746d0ee87a3cb9b2a824d6f31756f7171dc4fde5287ba3b3bdad0ae5294e9935a4a1eb1490acdcf8fcc21260e99ea551f30aa397d90db80b66c4d52aa81a4a56d44be22544b1cda10db18385bfc57b55e9a5413f251628fe1057a913103ed00663d2c72e0d71535ab66f6d5dbba238d185dcff9a496a9442bf6db8310b0039a0670b71b945db62bd490f3682aaa03e562829f6824628c0f71f8f6ec4cfe65f4134722dba976304ed8fd66177c5f1f1219304ef0bb3dd447202c065fa0c6cfad523f316d3b35d716121a2db5a34c0e5f32e54bca0f9a9dfd6c6cd2dd708414cdee0b411dba36a7d88a8d15d5000b6a059a34a82debd6c00d119fa7c08db472c14dcdc9b43659a6471f924e5bf9b1ede9d37d6cd646bdce096ab4687f5d27f4887f998ba646a86eb2334927c9631930bce3892fd739a2a57ddaf2e05290356b807112115466b10045dfb63042ab5b4bf3eb95c7f22421f5d9b901b106896398e809787ca78a7bcd6deffcadb9d0b6a2d3bcd39df9b5ac50265ef3fd0a196b184d89dcbef5486ca5c5cece84b2592fe2578b56b3582941f8f55cf306732e71d8de2c568ca93e72d1b05b3f4d044a77c6799685bb8bf3af5d042f","method":"","user_agent":"","ja3":"","session":"d45f99b1-83b8-4981-a8db-31673195ce1f","seq":1,"duration_ms":100,"bytes_in":441,"bytes_out":14,"enriched":{"digest":"a073df1eb078e0f3","strings":["Mo1uoqq","f=,r","R?1m;5"]}},{"timestamp":"2026-08-19T03:04:36","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-KEndbayTfqGN","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d4b456e64626179546671474e","method":"","user_agent":"","ja3":"","session":"6677da26-658f-47e0-af33-2e3bde8b3154","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"493fec7b06246b4f","strings":["BitTorrent protocol","<-UW1605-KEndbayTfqGN"]}},{"timestamp":"2026-08-19T03:02:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"~V�&�\u0005��б��S���/��\bV\u0000��fE��V��hs+k?\u000b\u0012Y�m��G\u001ds\u0011���9H�Vm^`g��־��*�\u000ezI���]�a��̹|y�:��r\u0014y|\u001a\u0012e�^��\tv� \nzh�W*$�\u0006��Z\rY{������v�\u0005�Zֲԥu+\u0004͌xJ&8\f����V]ku�T]��F�ۡ�<���B�'","payload_hex":"7e56c526d605d2ead0b1a8be53ee99df2fe98a085600ff8f664596f356a1fc68732b6b3f0b12599b6d86cb471d7311ace3d3394884566d5e6067b6e5d6be91fb2ad00e7a49f2beb35df361d5f2ccb97c79883ad1e87214797c1a1265955eebb50976d1200a7a68de572a24cc06a5ea5a0d597b8282e1deccdc768805b75ad6b2d4a5752b04cd8c784a26380c82fcf2fe565d6b758c545d97d94692dba19d3cc0c0c942c527","method":"","user_agent":"","ja3":"","session":"b77adf93-bd2a-418b-be0a-d3b8caac6e74","seq":1,"duration_ms":100,"bytes_in":165,"bytes_out":14,"enriched":{"digest":"0c60dae50ba7f4b0","strings":["hs+k?","Vm^`g","xJ&8","V]ku"]}},{"timestamp":"2026-08-19T02:59:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-2s)*AQ_B9y3t","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d3273292a41515f4239793374","method":"","user_agent":"","ja3":"","session":"64a6831d-a8c3-4545-a4f0-2b9f01aa1e98","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"87b09eb2e86a00c5","strings":["BitTorrent protocol","<-UW1605-2s)*AQ_B9y3t"]}},{"timestamp":"2026-08-19T02:57:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�I��!�(\u001fy0\u000b�BE�ȝ��@KW\u001d\u001b�;\u0019p�t�k��{�\u001e�'i�B.$9\u001a\u001b�8m\u000f`<�\r�\u0015�0��\u0015���R\u001d��\t�G�Ƣ�\u0019�Kő^��Ab�v�r5_�<~!\n��\bO�!k(��e�T����Y��\u0014�\bU�AGZ=#�@�kv#K�G�-�!\u0018a�H����Ū*��\u001e��\u0018\u0014��!�P�k${o\u0006�����.r�%Cՙ��\u0011Zԛ'P�UK�g[�\u001a6�\u001e.�ZK\u0018ؔ�杂d��Ģ�p���\u0010m(��\u001c��ی�1�y��j)�Z\u0006�H\u0003��a6Iy\u001aCq\u00149�&�n��|��׿p���q�\r��3-\u0014;a'�~n��N�s%�|��B�T��I\u001a�+\u0015����\\���Me7z�=0^}�\u0004`u�M1�a\u0002G\u0013����P�\u0015���U���W�����\u001aW�\bʍ>�\u0002����G�?�����0�����Y���\bT\u0019��1����\u0012�����}$��\u0002�\"�$|)�\r�<�ji�>̒�/N�$]�49�^&��»}e�ߣ�\u00111�vU����>\u001bT9(Uq^�h2lN�'�l��\u0011=Z���/κ�S���d��Vw���\u0016���\u0010��p�1!�\u0011�焇��e�p\u0013\n�H$�_�}����2�]\u0017d�;�\u000e�c\u0011\u0013GiA*e5���uoDj&��*K�2\u000e\u000e��u:ԝ<�C�^(1^�!�ˠЌ�P���!��I[�\u0007�������^\u000b\u0018�f��\u001de�h4�","payload_hex":"4c716297f9f1379f927a61c5448ce05de6cd48e80b6df375ea35c6df8ed664ab2424c4dad440f5e58b70da95c1eaef2645482dc5ae5969b21332be6134753160c6f42101545806f08df51c3afebeddf08b849036a0ff49239e2e3ac2006bf7f767fc4142d74cf527ec4393bedcde20559127862a7a1505786344b288dd655d7753470206fe6f219b4afd6a7890fed3a66c0da488e89c25afb3d5518027109ad9bb7d960deb9be3fdd2739d65f07359747855603b2ad83d42632b5fb02ec1ceedcb4a11a5df193d7eb245af0b9d59a2dbb4c0e2f72e9aff6da92d161dc3b27bb8247cc75141583d97951d0a971081a212de60e0670f4e0339d9ee5ea3176f39b1ad2c2567e9704c923ed52f4ec8245dde3439d65e26ae9bc2bb7d65dddfa3d81131f3765580b5aab93e1b54392855715eee68326c4ed027ee6cb895113d5af6e4f52fcebae8539a929564b6c45677b4b8cc16908bc91090b770a231219b1189e78487f1cc659770130a964824e45fb17db590efdd32e35d1764953bdc0ef96311134769412a65358ca3a4756f446a26beab2a4bc2320e0ef1c3753ad49d3cd943af5e28315efb2188cba0d08cc850f9b9db21adb6495b8207ba91bbbec6f7975e0b18a666bfe31d65b36834c6","method":"","user_agent":"","ja3":"","session":"7587fe60-2889-4068-8106-bf16faf11e86","seq":1,"duration_ms":101,"bytes_in":460,"bytes_out":14,"enriched":{"digest":"d224cf331c6ae324","strings":["&EH-","a4u1`","e]wSG","sYtxU`;*","=Bc+_","QAX=","T9(Uq^","h2lN","GiA*e5","uoDj&"]}},{"timestamp":"2026-08-19T02:50:30","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-55var466.Hw8","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d35357661723436362e487738","method":"","user_agent":"","ja3":"","session":"44f1e3d3-b934-4b18-9b75-7e68745db65e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"37bb726b973f47f8","strings":["BitTorrent protocol","<-UW1605-55var466.Hw8"]}},{"timestamp":"2026-08-19T02:47:38","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"5\u0011�\u000f\u001e\u000b�\u000e�/u\u0018��i��&��\u0015\u0003cpgI\u000b�\u000b�\n�\u0003����{_\u0015��\u001f^�\u0005ԾI\u0018�� �@i�=���#$��\u0018q�H�L\u0015/K��\u0017�l{��c�X\\F+x,�Ҽ)�A�\u0014m\u001e'q��ى��d���T�.��p������!��/}$d�n#\u0003ڎժ�\b�\u0019�WQ\u001a���\u0000}�>\u0007_�+>�{fϽ\u001d�6��\u0003���LK�gD��eu���6\bj�q�����AV\u0019ɼ�\b�\u001e�\u0015�88d��D'�\u0010�\u0014O1-~\u001f��H7\n��ڇ6G3�����\u0006J(�?a����0�ۭ}�q��ʻM\u00135q%CYƚHc�\b\u000bC�(����\"�U\u0003�����w\u0003)\u000f\u0013Q�]�\u001e'Tt\u0019Ҁ\"�^[�GF��';���","payload_hex":"35119c0f1e0bd40ed92f751880b769dfcb26e2d91503637067490bc70be10a8a0388c1a8807b5f15c0b61f5ef405d4be4918fbac20f34069fc3d9ab3d02324f2db1871e5489d4c152f4bac9b17f66c7b90a0638e585c462b782cf6d2bc29ae41a7146d1e2771caf4d989fdc964e28bee54b82eb4e170979cc9dac5ff21f6db2f7d24649c6e2303da8ed5aac308d419a357511ae6efeb007dfd3e075f812b3edd7b66cfbd1dc736b586039ce7bb4c4be46744a4cd6575f0c1bf36086aad71b1dadaebd2415619c9bc9408b61eac15ed3838649adf4427f910ea144f312d7e1fa6ff48370abb91da87364733fce1b5c1cc064a28b93f61b3b7bf8b30ebdbad7ddb71a39ecabb4d133571254359c69a4863f2080b439f2882d5f7b2227f9a5503f7ac8db6897703290f1351ea5d851e27547419d28022dd5e5bac474682ba273b84caf6","method":"","user_agent":"","ja3":"","session":"dcbeec11-79d5-413c-afcd-d20fa0358c07","seq":1,"duration_ms":101,"bytes_in":322,"bytes_out":14,"enriched":{"digest":"4a4c71c4795df41d","strings":["cpgI","X\\F+x,","/}$d","O1-~","5q%CY"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T15:26:52.095950+00:00"}