{"ip":"191.183.39.113","total_events":131,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["131 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 28,822 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"28,822 bytes sent","bytes_sent":28822,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T22:34:20","last_seen":"2026-10-02T01:53:27","events_24h":0,"events_7d":131,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"Osasco","lat":-23.5312,"lon":-46.7901,"asn":28573,"org":"Claro NXT Telecomunicacoes Ltda"},"source_domain":"bfb72771.virtua.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as28573","label":"Claro S.A. (NET)","category":"isp","url":"https://www.peeringdb.com/asn/28573"},"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":131}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-01","count":67},{"date":"2026-10-02","count":64}],"recent_events":[{"timestamp":"2026-10-02T01:53:27","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"p_�%�X(S\n�~F��\u0005\u0018��\u0019����/v��\u0010�\n\\��N\u000f\r\u0005�A�K�^�H\"ԍ`7O�r\u0014��fZK��_T�$ԩ�;l�#hv\u0011F��y���\u0010G�Ak�\u0018��.i\u0004 ��e��߳\u000e+4u�GS�\u0001<�<\\Q*5(/xE�/6\u0007��F%�~\u00019�ޔa�9�'ւw[\u000e����