{"ip":"191.7.100.105","total_events":8351,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"8,351 events across 1 port(s)","confidence":"high","network_type":"route server","why":["8,351 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 1515s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"692,581,500 bytes sent, longest session 1515s","bytes_sent":692581500,"session_seconds":1515,"persistent":true}},"first_seen":"2026-08-09T14:34:59","last_seen":"2026-08-09T15:00:13","events_24h":0,"events_7d":8351,"geo":{"country_code":"BR","country_name":"Brazil","region":"Sergipe","city":"Tobias Barreto","lat":-11.0803,"lon":-38.0226,"asn":263596,"org":"GRV FIBRA"},"source_domain":"105-100-7-191.grvfibra.com.br","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":8351}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-09","count":8351}],"recent_events":[{"timestamp":"2026-08-09T15:00:13","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��O\\+d.��\rYәS�\u001dW\u0019\u0015F\u0006���\u0017�퍮t��3\u0017)���C0�f[\u0017��Y�A����\"�\u0003V\u00143� \f�\u0006��B�\u0001�\u0000�_���{q�>��X\u0000y��dq��9�w�IJ;!k�K��z�j�\\]�D�\u0003>\"�iu�\u001f�z\u0002=\ra�������l�#C��\u001ctK��\u000e6a���\u0016<2\u001f��~�@\u0013��_7ƃO\u0012�or���\u0012l�9��I\u0018�\u00137��*�N\\:�N�l<&�r�֞P��=r]��n�i���\u0016h�-�W�L>\u0010�\u0015�Jq;$R��<ya�\u0019�C��p�a�-*Z\"�\u001b]�]�Ơ.S�\u001a\\{����������������9ʰ\u0017�_�!�-\u001c��\u0010�\"�4]\u0005��WW��\u0015$�\u0001mf40��T�C\u001a\u0017\u0015��z�KdN}a�\\���z��<m9\u0005!3�mU^�L����,<x�-� �d�ݴ\u001e+kx\u001e���j�RĀk��P��0�\u0013Ʉ\u0010\r�\u0013��C5\u0015�p6\u0011�۴\u001e�%�\u0000���\u001f~���\u0000�nY1�\u0001��:�\\�oU��ؚv�����z����7�E�=�\u001c�c���3Z\n����|�牍���U�P�o�\n,4(�!a\u001a�5\u0017#�@��|�h䅨��X*�\u001f\fԳ&\"hP�2�P������� �\u001b��\n-8�\u001b�!���\u001dO��R�Oc\u0012\u0002�C\u001c�!��z5��G���\u0015�C���Z}��\u0011����Ղ�7���&D\u001bb@� �\u0000(�1NT'S�q\u0018�t\u0007!�>g��H\u0013���4�����jTw�xZ\u0002�D)I���OL�\b���4Q\u0016�^�D�4!��\u000b$���D�\u0011d=?��j3*�\u0001�H��=\b����`��~�f-�����11I�����d��\u001c���\u0019�1\u0016앾ǫ)k\u001c��@b�0�a�\u001f㽡v���=W\nY��d��2V����51Й�j�\b���/����","payload_hex":"9fad4f5c2b642ef8f60d59d39953a81d5719154606808af017b5ed8dae74e5ac331729d9fae243308b665b17f5f859cf41e79ffbd322e403561433f0200cf806ab9b42b801de00bd5f9383fd7b71b03e7ff7b55800798fec6471898d398977d8c4b23b216bf34bffdc7ac56a975c5dac44e7033e22a96975db1fbb7a023d0d61bbbf8ecdc8e0a06ce22343f9b91c744bc2d00e36619bacb7163c321ff3ee7ef34013948d5f37c6834f12a36f7297a388126c9c3999c24918e01337a5ae2aee4e5c3a904ec36c3c26cd7f729dd69e5095f53d725dfbff6eb0699a8fab1668ed2db857b64c3e109115cd4a713b24529f9f3c7961d719e143d8fc709361fc2d2a5a22de1b5db85db2c6a02e53ac1a5c7ba7a1979ca3bc928fb6abbcd0f9e29fc139cab017b15fc421902d1cef8310b22293345d05a7ee5757e69e1524e4016d663430b9eb54ed431a1715c1a67add4b644e7d61c75cc8faad7aad923c6d39052133be6d555e9b4ccee2d4c32c3c78d62dda20b964f0ddb41e2b6b781e9afdf46afe52c4806b99f050a0df30d413c984100dcf138b90433515bf703611ecdbb41e92258100f1c0c91f7ea1b8da00bf6e5931b701ecb63abc5c8c6f5584b0d89a76c2f9b1b0a47a8486a29f37b745c03d8c1c7f8763819aa2335a0af0facef37c95e7898de9d2d755a6509d6ff40a2c34289421611af23517239f409cd37ce968e485a887ca582abd1f0cd4b326226850ca328150e9e298cbc0a2ac208b1bfc840a2d38b91b812194bba11d4f9adc529c4f631202cd431cdd2182d67a35eb8247edd3eb15c943e8eb9d5a7da2f111c5f8a18ad5829e37acc09c26441b6240dc20cf002883314e542753e07118ba740721a83e6789d14813d2ffd234cee6ecf8eb6a5477a4785a02c044294998d9e17f4f4ccb08e7bdcb345116f35e8744e23421bcb80b24f8eb9144c411643d3fff986a332a96018048808d3d08fae5c6dd60ade57ebb662da1a6f1eee4313149b9808ab7d864fedc1cb8afbe19823116ec95bec7ab296b1ca0a84062e530bd61a21fe3bda176a5a4aa3d570a59b0d664c3d8325698ecc0ea3531d099e66ac9089afc912fbc8d9eb9","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8351,"duration_ms":1514665,"bytes_in":178402,"bytes_out":108555,"enriched":{"digest":"3c7d85bc8870b038","strings":["O\\+d.","Jq;$R","-*Z\"","mf40","KdN}a","&\"hP","1NT'S"]}},{"timestamp":"2026-08-09T15:00:08","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"c!9��C;���\u0014�x&�\u0002�z�3��9��έ��_�\u000e��m��x\"g���MՉg��E\u0012ä\\�\u0000g�d�\fP4�C�'%1�O�\u0002��#OJ\u0002�vI\u0007���j|��}�q.�o�\u000ep\u001bC9ݖ�~�&��\u001erQޭ���","payload_hex":"632139b289433b809e8714b77826d002ee7ae833c09e39cedfceada9825fbd0ee1876df7de782267b9d8d14dd58967a9db4512c3a45ccf0067c864e90c5034ea4389272531a64fd302c6da234f4a02f2764907b5e7b16a7c85837d8a712e996fc50e701b4339dd96ed7ee226f6851e7251deadf893dc","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8350,"duration_ms":1509824,"bytes_in":177615,"bytes_out":108542},{"timestamp":"2026-08-09T15:00:08","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"[[\u0010i��x�\u001e\u001c������\t\u0013�ҐK","payload_hex":"5b5b1069a5b078ab1e1cdcd2c4f1f2e1091385d2904b","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8349,"duration_ms":1509491,"bytes_in":177497,"bytes_out":108529},{"timestamp":"2026-08-09T15:00:08","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"$g�$������e\u000e��D���\u0016^h\u0015��V9\u001a��nrz�5ѫ��\u0017���\u0003\u0004�\u0018�3�K\u0002!\u0004d�8���ؖ�x�m��\u0007ؕКEt�AD͒ew[��C\u0005wg�R\u0014�ȸ+\u001eiD!����΂��J�6\t1\u001b�D�^�dF�$��s0fg}\u000f@o�\tk","payload_hex":"2467ed24d3c9e182d3fa650ef98344f0e8cd165e6815c4f556391aa9fb6e727aef35d1abd1d517eed3cf0304d8188f338a4b02210464f738c8f187d896ca78aa6d8cb807d895d09a4574b84144cd9265775bfdd543057767885214cbc8b82b1e694421fd8ab88bce82f7be4afe3609311bac44f05eb764469024dcca733066677d0f406fec096b","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8348,"duration_ms":1509386,"bytes_in":177475,"bytes_out":108516,"enriched":{"digest":"fd9a0d7bff71ed1b","label":"Redis (RESP)","strings":["s0fg}"]}},{"timestamp":"2026-08-09T15:00:08","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�_���p�IZ\u0014� ؛��G��:.\u0013IO�D:�A�=m҉���H�G������.P\u0005�","payload_hex":"c05fd9eaf77092495a14a820d89b98ab47e2b23a2e13494fa8443ac141b63d6dd289d0ddcb48a6479cba97e48dc12e5005c8","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8347,"duration_ms":1509145,"bytes_in":177340,"bytes_out":108503},{"timestamp":"2026-08-09T15:00:08","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":",����\u0007�\u0001��|��L�k�}�Dk�L�)v\"N\u000b�:%���e�����*�\u001f\r�X�\u0017g���Q�C���ئ\u0002Z!\u001d�VsWv","payload_hex":"2cb699b1ee07e301eecd7c81cc4c956ba37d99446be74cab2976224e0bf13a25e7e0ad65b983bd97bd2aa91f0d8458ce1767a8f2e751e2439efbd6d8a6025a211dd156735776","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8346,"duration_ms":1509022,"bytes_in":177290,"bytes_out":108490,"enriched":{"digest":"3e0f3e41aa1eaa7b","strings":[")v\"N","VsWv"]}},{"timestamp":"2026-08-09T15:00:07","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����F�����\u0004=���!V\u001b��b��*�\u001b+�\"�\u0018v\t�n��S-\u0019˥�o��\u001c-�'����\u001d�Qr��\\�U#�u�8stުe���\u0011�l�(+���1S\b�k��:v��Fth@B����|��AW8�\t��\u001aj�L���\u0016�t�B��5�","payload_hex":"87a4e6b346a4d8f6f28b043dbbf4f121561beab56298ad2af61b2ba222ee187609826eedb3532d19cba5c16fcdf81c2d8b27ebe4bedc1da65172f1bf5ced5523cd75be387374deaa6584eea511c46c8b282b9ef5ef315308e46be3c53a76d4d84674684042aa8e848a7ca787415738ac099dc51a6aec4cf1f78e7f16df74a842d1e435d3","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8345,"duration_ms":1508813,"bytes_in":177220,"bytes_out":108477,"enriched":{"digest":"c169033115e00b17","strings":["Fth@B"]}},{"timestamp":"2026-08-09T15:00:07","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"j�\u0016��A����\u0000","payload_hex":"6adc1688d34193f7f7bf00","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8344,"duration_ms":1508570,"bytes_in":177088,"bytes_out":108464},{"timestamp":"2026-08-09T15:00:07","port":53,"proto":"tcp","app_proto":"","app_protocol":"dns","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Iu�\n�<\u001fL\u0003^(��Os�{n\u0004��\u0002'�&�\u001a������:3��\u0019L�Yd8��(\tv�\u00023)���x��;b\u0011\u000e���B�\u0003��\u0000�-z�\u0001�","payload_hex":"4975e80a9d3c1f4c035e28adc84f73e67b6e04b0d60227cd26a81aacf9aab288e93a339b85194cd4596438d9dd280976ae023329e5d9d378c5fa3b62110ececfd942c703c7c300ea2d7aa601b0","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8343,"duration_ms":1508465,"bytes_in":177077,"bytes_out":108451},{"timestamp":"2026-08-09T15:00:07","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�W8�q�\u001b]P�\u001a�iJ�m��4�R,\u0016�`nxJB�\b�U\u0016�nj�߳��/�\u001dz��AM�ڇ�\u0003��g3\u001e���t�@\u0013�\u0012\u000f/`~�P��\u001f���ޝ�5\u0000�\u0014�\u001b�\u0004w�jƬ0�\u001e�X�RW�O�@�3$���\\g�\u001d\u0011�\u0012I��q2��$�\u0017���Fg�����\u001bH�\u001c��\u000f%v�\u0006a%c���V�,��\u0014�\u0014�\u0013�4Y�F��U\u0012��A��\b�|�@A�H\u001eȳ��\n��\bG(�X���2","payload_hex":"c35738ff71c61b5d50d91ab5694a886ddec334d4522c16a9606e784a42c708fb5516cf6e6a7f87dfb389d22f8e1d7a80f4414dd1da87fd03b59267331e92a9ce74ee4013fb120f2f607efb5087d41f848ad8de9da83500d314f21b990477b26ac6ac30c71eaa58fe5257ec4fbf408d3324f7fcc55c67eb1d11831249a3d17132e1d4248c17d0efc4466790eef3d7dd1b48b41c85ac0f25769e0661256384ac9956f62cf5b37f14d914a113ce34599146e2c65512f28641ede508a57caa404195481ec8b3c0b40af0f3084728c758f2e3fb32","method":"","user_agent":"","ja3":"","session":"23d93bf5-d491-41b0-9820-8f7f074f1301","seq":8342,"duration_ms":1508308,"bytes_in":177000,"bytes_out":108438,"enriched":{"digest":"134076aaf778ee1d","strings":["`nxJB"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:13:28.402592+00:00"}