{"ip":"191.99.19.248","total_events":1471,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,471 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,471 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"313,035 bytes sent","bytes_sent":313035,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T23:06:46","last_seen":"2026-10-04T00:57:53","events_24h":103,"events_7d":1471,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Guayas","city":"Guayaquil","lat":-2.2038,"lon":-79.8819,"asn":27738,"org":"Ecuadortelecom S.A."},"source_domain":"hfce-191-99-19-248.customer.claro.com.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27738","label":"Ecuadortelecom","category":"isp","url":"https://www.peeringdb.com/asn/27738"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1471}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-27","count":1},{"date":"2026-09-28","count":420},{"date":"2026-09-29","count":397},{"date":"2026-09-30","count":231},{"date":"2026-10-01","count":26},{"date":"2026-10-02","count":230},{"date":"2026-10-03","count":123},{"date":"2026-10-04","count":43}],"recent_events":[{"timestamp":"2026-10-04T00:57:53","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�09-\u000eN�\u0013��\rx\b\u0001\u001e��Q5����4J���zx�*�y��&��aҌ\u0013P@\u001a�c�$�+8��\u0001��`U\u0018���*\t�0��\u0003�:��\u0007`��1\u0002-�,�(f�UV��������?\u0001ߓE���Ġ�ρ�h?�-�o�\u001af��","payload_hex":"8330392d0e4eac13b3d20d7808011ea2c35135d8c2ffbd344a94accc7a78902a917997be26ebf861d28c1350401aa46383249b2b38f18f01b7d1605518b182a12a09d6309da003db3a85df0760f8ab31022db22ca92866ca5556c1aac5eee3f29cb93f01df9345c2dad6c4a0e7cf81f4683fac2da36f8b1a6695d7","method":"","user_agent":"","ja3":"","session":"6894eeeb-7513-4110-a7f3-70f1b55d662f","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":13},{"timestamp":"2026-10-04T00:56:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-8cE4R-p(I3LC","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d38634534522d702849334c43","method":"","user_agent":"","ja3":"","session":"b79e012c-0270-4863-90ef-e74cd8569e1b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"38991f3d6e8f3be7","strings":["BitTorrent protocol","<-UW160N-8cE4R-p(I3LC"]}},{"timestamp":"2026-10-04T00:55:12","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001e��Wf\u0010✴�T�, Q�TWie�eH��%\u0017�|/�y��%*�0\u000fN߿�\f\u000b˲�J)_L'��\u001c�����Z�\u0000\"\u0014�I�\u001f0q�*k�ڵ��w�Z�tjb|���[ώ9�\u001d����W{=�F5��a������6\u0000��А杈�\\�%�SC�lcf�\u0016��*~<��\u0017���K>�J�p�H�jv~��ຂ1�A�f�j�,\u0018#��wZ;mf��!�*���g\n&ސ�\u0000��&S\u0005�k^�\t[���U@�j���K\u000fP\u001d\u0014}��ir\bhZƮ\u000f,ӊ'����\u0006M,����b\t����\u001a��T�!��O�m","payload_hex":"e35b058f6565b083134b97b6768723d5471c4a7c7100bb2b5700b6a8f4c26a8d270fded4b230ad4e8c8da6699e7922a5daab3cb0713674f042ab7c52c36b7921a837edee7cce54f10f93deabcf1fb2a1035e45bd4fa7b5b3d1bedb54a8e5bdd7baaec4fbad330ab57308697ab451a4abb5828b3a09dadda41ff3353b2aa936b4b7c22df05f9418f5c90f51b0044220d62334ebefe79357ad7defb8f1c880cbe4a9e0774b94f0cdcf9f4825d36db57b930a9d00a4c626a25e76407b6c37f331b98e1b393bef32c6ebda674927eca70ff11e55480847d9fbdc07583396cfc8d7fdf7d734983ab0040746f38ef9b52800377462e771eb53666207016117596e3a907828845fabcecbe2a92d4319bb6d48026dc4353ea5577b3dec4635d6ca61ea9ae8f9e1843600bfacd090e69d88be5cbf25fa5343ab6c6366eb16e8d02a7e3ca9f917cfe5964b3ee74ab770c448866a767eabe4e0ba8231c741ea66bb6aeebe84cf2c1823a8e5775a3b6d66ac8921ac2aa4faa7670a26de90c10096cb265305e56b5ef3095b949daf5540996acacbe24b0f501d147d92cb697208685ac6ae0f2cd38a27eedff9d2064d2c9af5b4d06209fb86a2991af5b254f721e9aa4fde6d","method":"","user_agent":"","ja3":"","session":"6ab6f93d-71cf-47b6-8798-45ce0db4602e","seq":1,"duration_ms":100,"bytes_in":447,"bytes_out":13,"enriched":{"digest":"fb4421ef927e1fad","strings":["^v@{l7","wZ;mf","(7tb"]}},{"timestamp":"2026-10-04T00:50:59","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-urai*g-Zw0Bi","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d757261692a672d5a77304269","method":"","user_agent":"","ja3":"","session":"c8293c1f-e663-498f-9efb-012724d286ec","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"01fd725fcb528a50","strings":["BitTorrent protocol","<-UW160N-urai*g-Zw0Bi"]}},{"timestamp":"2026-10-04T00:49:48","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�w�,�k�\u0017�\u0015�\u00183ۀ�\u001a%;\u001c8ϸ�V���\t\u001aM\u000f/A�;¨g4\u0012��\u000eX�B>��-\u0019��\u0019By�&��wr�F��}]K�u���206�<�\r�40��r1\u0012:2Y�ʖ-\u001e�q6�(�y9��[","payload_hex":"da779d2cb66bce17d415a31833db80841a253b1c38cfb8fb5685e5a1091a4d0f2f41e83bc2a8673412b4e70e58cc423efabc2d198096194279f126d1c07772e746a9fd7d5d4b9a7590d6dd323036f03c9d0dd53430acbf7231123a3259adca962d1ea97136aa28d579398da25b","method":"","user_agent":"","ja3":"","session":"50624736-818d-43ad-b283-22a7f41623d2","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":13},{"timestamp":"2026-10-04T00:48:17","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-V.pWF_tH1PW!","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d562e7057465f744831505721","method":"","user_agent":"","ja3":"","session":"28079296-6d25-4a88-be4f-80c1d88d4d24","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e6f835f2255f31ed","strings":["BitTorrent protocol","<-UW160N-V.pWF_tH1PW!"]}},{"timestamp":"2026-10-04T00:47:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"eTΔ�)R^W�{�.�m+Y�M/�E{=\u000b,���Psq\t�\fY-���B�������D�&HÎ�\u0018\u0003^mO󾚤\u0003֪| ;(b����\u0010�\u0010��U�Wһ|?��8%W����c�K�\"!\u0013.�\u0006���^��H�c\u0001w:m}����8!gL��\fd����g��Վ���NJf������XX\u0019~��\u001d��.3�\u0000�k%n��\u001c��S;\u000e�Q����G�͖\u0000\b��\u0010k�9z/}��da]\u0001�\u0007\u0000\"\u0000A�HS\u0001\r�\u0003��bP�\rG�,y�\u000f�S��R���j�]O9P���W=y\u00074��\u001dg�<\u0017ML�?�,�\b@\u001d;ܬ�_IN\u001cD4\u0018�$�ʁ��\u0019�ܶSH,�G�7�<�⑛71��D�M�*q\u0010�2f/K��\u001e\u0010ݹ�U^��\u0000A\u0014�ғ��i�\u0002�E&���\u0010�l�a�8�٤���lU�\u001c�7�_<��v\t\n�y�m\u0003��\u0015�\u001ePa���94\u0000�\u0003株0v�z�j\u0003�L�^\u001e[�\u0010����)���F�j(y���cy.z�\u001d2yCj��","payload_hex":"6554ce94ef29525e57b27bb42ec66d2b59b24d2f9c457b3d0b2cc2fdd650737109990c592da4bbb642b9bb92e29ec09244902648c38ef118035e6d4ff3be9aa403d6aa7c203b28629eb3efa810b0109db7558d57d2bb7c3fb8ce382557f1f1f3a763f94bbf2221132eb306b1fcba5ef4eb48fd6301773a6d7d919ee1bf3821674c94b20c6485c0fbc367e4ddd58ebeb3c5c78a66b6d2e8e4f4bc5858197eeeb01dd4c62e33af00fc6b256e9be51ca2ec533b0ec8518780ad8547becd960008e790106bff397a2f7d86f564615d019b0700220041aa4853010da603b1c86250ea0d47a32c79be0fb653829f52d7eaa46a9e5d4f3950aee991573d790734fd951d67893c174d4ce03fd92c8508401d3bdcac8e5f494e1c44341891248aca81a1c5199cdcb653482c8747dc378c3c85e2919b3731f0b644c14d912a7110f032662f4b87941e10ddb9b2555ea2bc004114c1d293849569bd02a6452690c1e410cc6cd561e238a2d9a4a8aaae6c55ec1c9e37a95f3cb2bb76090aee79a56d03cddb15ee1e5061888cc53934008b03e6a0aa30768b7a8a6a03954cbc5e1e5bde10cee481ce299afc9c46b66a2879e6a0df63792e7adb1d3279436ac0a4","method":"","user_agent":"","ja3":"","session":"37b00a0c-d538-47f8-bbb6-d4950cab8016","seq":1,"duration_ms":101,"bytes_in":442,"bytes_out":13,"enriched":{"digest":"0c134c9c109062f3","strings":[")R^W","| ;(b","w:m}","8!gL","9z/}","]O9P","2f/K","cy.z","2yCj"]}},{"timestamp":"2026-10-04T00:45:36","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-BnqWG0u)fvy8","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d426e71574730752966767938","method":"","user_agent":"","ja3":"","session":"a3676561-ec7a-46cd-8e1b-dea068a08353","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"ecdf690d3a420222","strings":["BitTorrent protocol","<-UW160N-BnqWG0u)fvy8"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-04T19:26:14.798618+00:00"}