{"ip":"190.226.252.145","total_events":1303,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,303 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,303 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"88,604 bytes sent","bytes_sent":88604,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-06T15:56:06","last_seen":"2026-08-13T20:52:06","events_24h":0,"events_7d":932,"geo":{"country_code":"AR","country_name":"Argentina","region":"Corrientes","city":"Corrientes","lat":-27.4685,"lon":-58.8313,"asn":7303,"org":"Telecom Argentina S.A."},"source_domain":"host145.190-226-252.telecom.net.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7303","label":"TELECOM ARGENTINA","category":"isp","url":"https://www.peeringdb.com/asn/7303"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1303}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-06","count":94},{"date":"2026-08-07","count":197},{"date":"2026-08-08","count":225},{"date":"2026-08-09","count":403},{"date":"2026-08-10","count":124},{"date":"2026-08-11","count":60},{"date":"2026-08-12","count":137},{"date":"2026-08-13","count":63}],"recent_events":[{"timestamp":"2026-08-13T20:52:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-|��B`T:�\u000f�t\u000b","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d7cb8d84260543ad60ffb740b","method":"","user_agent":"","ja3":"","session":"384180b8-869b-45f1-acd2-9d73ee9d1e98","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":15,"enriched":{"digest":"19fc1d314f681f79","strings":["BitTorrent protocol","<-UT360W-|","B`T:"]}},{"timestamp":"2026-08-13T20:45:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-|�@�Ѿ