{"ip":"191.88.171.96","total_events":780,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"780 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["780 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"167,435 bytes sent","bytes_sent":167435,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T08:23:24","last_seen":"2026-09-07T06:48:27","events_24h":0,"events_7d":780,"geo":{"country_code":"CO","country_name":"Colombia","region":"Bogota D.C.","city":"Suba","lat":4.7485,"lon":-74.1205,"asn":13489,"org":"UNE EPM TELECOMUNICACIONES S.A."},"source_domain":"Dinamic-BA-RES-191-88-171-96.tigoune.com.co","known_scanners":[],"scanner_tag":{"key":"peeringdb:as13489","label":"TigoUne","category":"isp","url":"https://www.peeringdb.com/asn/13489"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":780}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-05","count":243},{"date":"2026-09-06","count":399},{"date":"2026-09-07","count":138}],"recent_events":[{"timestamp":"2026-09-07T06:48:27","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-8ECN9Pq3vh_V","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d3845434e3950713376685f56","method":"","user_agent":"","ja3":"","session":"09387fa2-b165-4d50-903d-a69a5d51e5d0","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"ef40a3fe11fb9aea","strings":["BitTorrent protocol","<-UW160P-8ECN9Pq3vh_V"]}},{"timestamp":"2026-09-07T06:47:15","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001c��\u0001*��v�_\u0001���\u001ca����mY\u000e(%�+�;���ê��Z��KuF���Ùil\f0��@Dk\"qL�=2��\"n���gX\u0012\u0016��CdS���\u000eJ���6[�<\u0014���!��:���\u0007D�1>��\u0012x��l%�0�[\u0012e�(�]��\u000fM\u0019-��Q��PCK�f#��Pm�2�?��àu�o���n��\u0007��j~�Õ��k�\u0014\u0018��K\u0011�>׫<�\u001f@�?=�B>�=\u001c^3����Ibu�\u001e","payload_hex":"1caab8012adfc776fc5f01a4a2991c61a7a290c66d590e2825892bcc3be2eea3c3aafca35af3f94b7546dcfde8c399696c0c30d9c040446b22714cac3d32d1e6226ee4c6d467581216c08043645393a3d00e4af7d6fb365ba23c14f8a8a62180b43aa4b8c10744c5313e84e91278b1bc6c25e230b15b1265e128965da1df0f4d192db8fe5197e850434bec6623d2e1506daa329c3fe7cbc3a075e06f88af966ef9ca0786b06a7ee1c395bca86bf3141893974b11b53ed7ab3cd01f40863f3dc1423eb83d1c5e338787edb04962759a1e","method":"","user_agent":"","ja3":"","session":"915d8d38-985d-4f25-9255-2a2a6f2757b3","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":13,"enriched":{"digest":"eb0bef850506a137","strings":["@Dk\"qL"]}},{"timestamp":"2026-09-07T06:45:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-Nt.eaDxzgHXA","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d4e742e656144787a67485841","method":"","user_agent":"","ja3":"","session":"20eb2b9e-1309-4efa-b401-345877f55cf8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e18ff0d23698004b","strings":["BitTorrent protocol","<-UW160P-Nt.eaDxzgHXA"],"iocs":{"domains":["uw160p-nt.eadxzghxa"]}}},{"timestamp":"2026-09-07T06:44:30","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���\u0000;����\u0001\u0017����[%�u�BE��R\u0001�d%��В�kMm+��\b�%�M\n>�r\bۜ���-\u0005vF��\n�\u001a\u0019h�s�Dc��\u0001B�@�*\u0019\u0004y��\r�����\u001b�OB$�������\u001d@*s:[�\u0004�v\u0004_���&�,%%ZGv��A�n_VRm,'��\f�K\u0006#3j�_z9\u0010R����?�\u0003tf��Sh1S�ES�\u001d‚���q\u0017�(;\u000f�W�E�e���s�ZrS����a���'}o(-u\u0017�K�\u0018Vuv\u0010G!����\u0017��{�\u0005�c�OW`$ܾ\u0004�����\u0010a\u001d\u0019�k_?\u001b��6\b��^\u001d�8��W)���W]y�@\u0015>6\u001b�T*Wz˜��\u0013��W�%C�rvn�X\u001a6Ժ�-k�v~���<�4UZ\u0018��\u0016�U\u0002��~D��h�aw�$m��i�uZ�����tǃ���\u0014\u0013[�d�18\u001d̘B��\u000f\u001b1pY0���W�\u0019_� �0��J',0���|�\u0010�K��C�\u0004�ɟ��*\u0012���4w�h�nO9�Q95=�s� 9b�5�q���M�\u001d�\b�����\u000e��\u001f��\u0019�kwV���3w�","payload_hex":"a8a0cc003b8ce08ffb011782acb8865b25e175a0424588de5201826425e3e5d092b56b4d6d2bd8e208da258c4d0a3eba7208db9c93f3a62d05764680d50ade1a1968c773ff44638ea60142e140952a190479efa50df284bbcac41ba14f4224ac8ca78dd2eae41d402a733a5bbf048c76045ff6fed026c92c25255a4776e3c741b36e5f56526d2c27a4d40c8e4b0623336a9b5f7a391052f6c187ff3ff7037466cfd153683153e44553b71dc2829f97f07117ec283b0fac57f645aa65ac8f9e73f75a725386b1a8be6185c1d1277d6f282d7517c14bf218567576104721aa87afa017e9867be305a563e64f576024dcbe049da5b6dff410611d19ee6b5f3f1badf236089bc75e1d973898ee5729ec90f3575d797f9440153e361bda542a577acb9cfcbe13dccc57af2543ea72766eed581a36d4bafd2d6bb0767e93b8d43ce234555a1889a11698550293a37e4490bc68b661778c246dc9d369dd755abecdc7efa974c783e195f614135bad64b731381dcc9842d6dc0f1b31705930cfcfe757a4195fee20a630f0974a272c30b5cbd67cfc10f04ba5ce43b804b9c99ffafb2a12f2bdd33477ed689d6e4f39e15139353dcc73a3203962ce35a871ccc1c64d821d8508c3c7e3d0f30e9ad81fb89b19b96b7756b5f9d13377a7","method":"","user_agent":"","ja3":"","session":"433c1a80-adbd-48b5-9d66-d6cd8acad7dd","seq":1,"duration_ms":101,"bytes_in":472,"bytes_out":13,"enriched":{"digest":"079e01d22e8f4606","strings":["kMm+","@*s:[",",%%ZGv","n_VRm,'","Sh1S","'}o(-u","OW`$","T*Wz","1pY0","J',0"]}},{"timestamp":"2026-09-07T06:43:01","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-!amOmdvkI!C0","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d21616d4f6d64766b49214330","method":"","user_agent":"","ja3":"","session":"be774b9d-27f3-41fc-a48d-0089ef944bea","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"cc7cd4496bd40cf7","strings":["BitTorrent protocol","<-UW160P-!amOmdvkI!C0"]}},{"timestamp":"2026-09-07T06:41:50","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":".�&�\u001d:����1����g\u001dKN\u0016]t2|��'�݀��n����A���O�X�\u001al̾�&����Ɛ<R\u000bP���7�3�h�6��6j�i�3\u0019ǃ�uF$.\u000f&�a\u0007����zLL�\u001fΐl\"\u0019<0��\u00151�|�\u0007�,%\u0011�W��]�X=��)��{(^T�G��I43�4D�\u0005��\u0015Gv����u\u000b\u001c\u0014z�\u0013���kĴ]��n,\u001c5��q:� \u001bMsZV�i���#�\u0012IVo���U�7JD�����G샼�Z�����X�\u0017�4�#�p۷\u0005�=���Ɛ��,~��1\u001dq�WZ���4\\C�]�6���\u001d�*������e���y\u0018x \u0014.=�)_@���)rQ�XUHb#zc�l\u0002�Q�ց=�\u001e�^Q�o\u000e\u0005L7�.x]/�:!�{��\u001c4?���\t�٢��h �)!塽���\u001d�\t_\u0000�.5Q@�\u000b5\r�5�N\u0007Y\u0018\r��hץ.�\u0017�\\�h��b+�~\t��p䇨\u0018\u0015?WMvA�)��}��\u0002�6y��U�/��A���\u001fz�3�����іΏO\u001c\"\\I��2U��9-�\"��AH\u000e\u0016�\u0014&�\u0004�]�","payload_hex":"2ee026f01d3abcc7e2da31aaf3b1e5671d4b4e165d74327ca4e427dcdd8082b56efeaebfad4197f4d14fa658ef1a6cccbeda26fba9ebfdc6903c520b50b2e4f037d533db68f436d3ce366abf69f23319c783ed7546242e0f26be610797fef9b37a4c4cc21fce906c22193c30b8bc1531e77ce707a62c2511aa57dbde5df2583d97da29e69e7b285e548347f6f64934339534448e0586b2154776bd9996ba750b1c147aba13ebc1a76bc4b45db79a6e2c1c35acee713abf201b4d735a56bc69fdb5af23ae1249566f86b5ed55e9374a44aaccf6cac847ec83bcc15ab6beede68f58bd17d9348923cf70dbb705e63d84ac92c690abe82c7ef2a0311d7182575aeca0e7345c43ba5db836e5d9d31df02a8ea685a9899d65c9cde17f79187820142e3def295f40c0858f297251ac58554862237a63956c029351add6813dc01eb55e51976f0e054c379e2e785d2fea3a21e17b7fd6c01c343fded0d6099cd9a2f8916820862921e5a1bdeff2ff1d86095f00a72e3551409e0b350dec35f84e0759180d9aab68d7a52e8917ed5ca068bccf622b7fda7e09a9b370e487a818153f574d7641c129c7ea7d93a102a5367997fb55ac2ffbb041f1c7c61f7ae633edcbe1b2e1d196ce8f4f1c225c49c0fa3255e4f3392dae229edd41480e16e41426bf04d75df3","method":"","user_agent":"","ja3":"","session":"7168d576-fa78-4cde-bda0-a360eba0e37f","seq":1,"duration_ms":100,"bytes_in":482,"bytes_out":13,"enriched":{"digest":"a26246af828d4127","strings":["]t2|","uF$.","{(^T","MsZV","XUHb#zc",".x]/",".5Q@","?WMvA"]}},{"timestamp":"2026-09-07T06:40:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-iG8z!ABorGNF","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d6947387a2141426f72474e46","method":"","user_agent":"","ja3":"","session":"a7e64e50-c4d8-41cc-942d-237dfbc961b6","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"ac1f391779b6ba42","strings":["BitTorrent protocol","<-UW160P-iG8z!ABorGNF"]}},{"timestamp":"2026-09-07T06:39:07","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"y _�V\u000e�7R\u0000���qB�ٚB��){�\u001c��K\u0006\n����G,\u0019��\u00063�ip��\u0002o��\u0019���l�#�ʿ��5�\u0016ޣ����.rPר�\u001c:�>8��)r4x��ׯ�.���@�,M%�c\u0002���{�>ݭ�\u0004�Y���#Ô�<7/?˱HL�D�����mr�n3|';�t���çEq\n\u0013I�-��@����`���\u0003�ֱo^�0��\u0017���\u0016�Rс����N��AO<�e\u000e9\u001ek̜Ѩ�~�\u000f�#�ی�\u0005J\u001d����F�|��k�S�,�\u0000���\u0002\u0014����G\u001fB`�p\u0012��\u000e\u001b���q���\u000f�i4\u001f��g/\u0007�\u000e߷D��hܠ��ǀ{����M�F����\n�RQ\u000e\u0015\u001e�����,ܻZ�L\bӿ\b1.�=�\\?[F+�1l(�\u0003������:'+h���o���S�ه�gz#�:�H$0��ԪG��ljl\u0012յ��)l��`J6��\u0018�T7�q�%Ux�zt=!\u00194\u0017���^���\u0017\f�\b�̱jB��(S\u001d���\u0014��|R\u0012w���\u0007�x��{q��\u0002o����_'��\u00028�\u0010GHtIa�\u0017E��zb�\b�{@t����T=v����\u0012��\u0015�<��\t08&Ū{�:<0�\u000f�i5�\r\u0010F�[�\u0006n�D*>�t7�>��?i\u0016Z8\u0010\u001aGi�B�f\u0012��f\u001e��i��\u0001�C\u000e��","payload_hex":"79205f96560ed5375200b8b9bd7142fdd99a42bdc3297bee1cf5a44b060ad7eaa9e6472c199dea0633cc69708ecb026fd6eb19ff83e26c9b2389cabf8cb835d716dea38fac80e02e7250d7a8e31c3a813e38c1fd2972347896dfd7afc52e9c8bff40d82c4d25eb6302e9fb807bf23eddadeb04e559ff81f023c394a03c372f3fcbb1484cd64498879aa39c6d72b26e337c273b8b74ac8298c3a745710a1349902dd2e9408dbb889e60b69f97039cd6b16f5efa30efb517afe7be16ba52d181aee3ff874edcec414f3ccd650e391e6bcc9cd1a8c77ea30fae23dcdb8c81054a1dd8d0fc8846f37ce99b6bfa53992ca700b89dc00214e7a5f6c7471f4260c37012a5d10e1b91999b71f6e6c60ff369341ff4a4672f07fd0edfb7449bf068dca09ff8c7807ba4fda7b94dbf4688b8e5910abe52510e151ee2e9acdcc42cdcbb5ab84c08d3bf08312ec23da85c3f5b462ba7316c289a0381adb3b4b3e83a272b68fead8a6f8aa5ed7f53abd987df677a23b83a9d4824309eacd4aa47bcdbc7896c127fd5b5bfc5296c99b4604a36c4df18bc5437f071bb255578be7a743d21193417909f895e8db697170cdc08f0ccb16a4289c028531d82e0911491fc7c5212779dedcf07a378ae837b718d8d026fbed3c6c35f27a1ce0238961047487449618817458efd7a62cf08cc7b407480b0b38c543d76e595fce91291be15c83caffa09303826c5aa7bac3a3c30ef0fe66935d10d1046cf5baf066eb5442a3ea57437cc3efca73f69165a38101a4769be42856612cad4661e85926997b701b7430ebe83","method":"","user_agent":"","ja3":"","session":"b8d8fa86-e11b-4597-8437-7d6046dff8f7","seq":1,"duration_ms":100,"bytes_in":575,"bytes_out":13,"enriched":{"digest":"46fd716976584290","strings":[")r4x","<7/?","n3|';","\\?[F+",":'+h","zt=!","GHtIa"]}},{"timestamp":"2026-09-07T06:37:36","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160P-PGwZEtzb5yMG","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630502d5047775a45747a6235794d47","method":"","user_agent":"","ja3":"","session":"adc683b7-2c08-4a00-ba79-ab01e64858eb","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"8c787544c57abf46","strings":["BitTorrent protocol","<-UW160P-PGwZEtzb5yMG"]}},{"timestamp":"2026-09-07T06:36:25","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�x\"\u0019\u001fki���@�����H��$o����\u0010�\\�6\u0005�|0r��\u0005��pT%\u000b�\r0����*���st$\u001b����x���l���֮���{����,)\u0004!\u0003��9~Ԧs\u0016\u0001��z��\u001cj���@�o��R���\u0001)\u0005}�-��\u0015\u001e\u0012{�\u0016\u001e�_i�Wy\u0001Z��i��5E�����YM����q���\u0018��''�=�(XzԺ?\u001a�4b�a�i\u0006N����F�\\�ꃢ���C��=ۑ��\u001bB��\u001a\u0014���@��_�~�3ˀZ����{?9�U���\u0013f�f6�\u000b�u`\u001a���C�*�3,�n�\u00002e\u000e\n�\u0005��f��\u000b�uxa�\u0015� Q��7�\b,T�� ��O�b~\b�O<\u0015�(9��\u0010W��\u0000����쫿\fYB���\"`o���\u00193~x���`\u0014s��q0�&�0p7.�Ĉ�N��R�ԻS!\n�R�t��\u001a;��D�dV��X����1d\r�\u001a\u0010��}�����hP��\tZE�<�#��pڈZ<rU�J5���\u000f�*�R��\u0016�'F��\u0017j�ZtiCG5����\u0003�-\u001e<��h��\u001dڜ��\u0015\u0006�ȸo$�4Əz�\u001cA�b,\by�Q\u0016��?LŶP�\u001d�}�(��W��k}�ޫ\u0001_","payload_hex":"ec7822191f6b69b6b7be409590cec6f848b69e246fb0b9f6d510cd5c9c3605927c3072b3ad05f3a17054250bb70d30e5fa8cc62a97b1927374241ba1e09390789fe29e6ca1a38ed6ae8c8ab87bf2a6b0e82c290421038281397ed4a6731601869e7aea8b1c6a88dbf740c06fa2df5280cef40129057d9f2dbfaf151e127b90161ec15f69e55779015a95dd6984bd3545c1abf3e5e7594dbbbe82d571d4ede618aeed2727d03deb28587ad4ba3f1ada3462e3618e69064e8ce7e3ed46fb5cffea83a2c8f9d143fdde3ddb91978a1b42e4c51a149a96da4088a55fcd7e7f9b33cb805ae98eeafb7b3f39f8557f83c1d01366b96636d50bc375601ac2efcc43ef2ac4332c7fc76ef80032650e0abb05f5db66e8ac0be1757861a815bf2051c6df37f8082c549afc2087934ff1627e08d34f3c15b1283992f11057f5b400d5fae7adecabbf0c594294f1aa22606fe4f9ba19337e78e2bccc601473e69f7130e826923070372ed5c488a14ea7c352b6d4bb53210abe528674a19b1a3bb5b144916456ad9758f8be968031640dce1a10cff87d8fbafab6d9685085e0095a45a63ca523efa870da885a3c7255e74a35e990d00ffc2aa352c4ed16fc274681ab176aa25a7469434735b0b291bc03982d1e3cb5fe68f5b71dda9cb5fd1506c6c8b86f24f234c68f7ad11c41f0622c0879985116f8953f4cc5b650c21ddb7dd628c8dc57af986b7da6deab015f","method":"","user_agent":"","ja3":"","session":"3551f184-b790-4860-8bba-85500c2cfc37","seq":1,"duration_ms":100,"bytes_in":520,"bytes_out":13,"enriched":{"digest":"7f277855e02bfd9d","strings":["0p7.","Z<rU","ZtiCG5"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-09T06:43:11.356407+00:00"}