{"ip":"190.21.139.136","total_events":3325,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,325 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["3,325 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 858s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"42,038,607 bytes sent, longest session 858s","bytes_sent":42038607,"session_seconds":858,"persistent":true}},"first_seen":"2026-08-20T05:34:15","last_seen":"2026-08-20T05:48:33","events_24h":3325,"events_7d":3325,"geo":{"country_code":"CL","country_name":"Chile","region":"Santiago Metropolitan","city":"Santiago","lat":-33.4521,"lon":-70.6536,"asn":7418,"org":"TELEFONICA CHILE S.A."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as7418","label":"Movistar ISP","category":"isp","url":"https://www.peeringdb.com/asn/7418"},"cve_matches":[],"malware":[],"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":3325}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-20","count":3325}],"recent_events":[{"timestamp":"2026-08-20T05:48:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�����R\u000b�y�","payload_hex":"f5c19bec84520b82799e","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3325,"duration_ms":858157,"bytes_in":23471,"bytes_out":46532},{"timestamp":"2026-08-20T05:48:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�����z]�","payload_hex":"c0f1fed1d77a5da9","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3324,"duration_ms":857911,"bytes_in":23461,"bytes_out":46518},{"timestamp":"2026-08-20T05:48:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�ѶST���3$","payload_hex":"bdd1b65354d4ddd53324","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3323,"duration_ms":857660,"bytes_in":23453,"bytes_out":46504},{"timestamp":"2026-08-20T05:48:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�^�x","payload_hex":"bc5eeb78","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3322,"duration_ms":857384,"bytes_in":23443,"bytes_out":46490},{"timestamp":"2026-08-20T05:48:32","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�ɒ","payload_hex":"f8c992","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3321,"duration_ms":857120,"bytes_in":23439,"bytes_out":46476},{"timestamp":"2026-08-20T05:48:32","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��+ ��","payload_hex":"e3ef2b209ec2","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3320,"duration_ms":856850,"bytes_in":23436,"bytes_out":46462},{"timestamp":"2026-08-20T05:48:32","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0011�\u001a\u0003���","payload_hex":"11d01a0382e087","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3319,"duration_ms":856597,"bytes_in":23430,"bytes_out":46448},{"timestamp":"2026-08-20T05:48:32","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0019�+�v�Z{\u0017","payload_hex":"df19d62bce76d65a7b17","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3318,"duration_ms":856347,"bytes_in":23423,"bytes_out":46434},{"timestamp":"2026-08-20T05:48:31","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��>~Jp[","payload_hex":"f9833e7e4a705b","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3317,"duration_ms":856101,"bytes_in":23413,"bytes_out":46420,"enriched":{"digest":"6e178fb904da3941","strings":[">~Jp["]}},{"timestamp":"2026-08-20T05:48:31","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"u�9�","payload_hex":"7591398e","method":"","user_agent":"","ja3":"","session":"0597af36-29d5-42e6-ae81-8b25febda8a5","seq":3316,"duration_ms":855838,"bytes_in":23406,"bytes_out":46406}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T21:23:02.028855+00:00"}