{"ip":"191.99.26.108","total_events":1478,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,478 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["1,478 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"100,504 bytes sent","bytes_sent":100504,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-01T15:36:15","last_seen":"2026-08-20T04:17:26","events_24h":153,"events_7d":719,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Pichincha","city":"Quito","lat":-0.2309,"lon":-78.5211,"asn":27738,"org":"Ecuadortelecom S.A."},"source_domain":"hfce-191-99-26-108.customer.claro.com.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27738","label":"Ecuadortelecom","category":"isp","url":"https://www.peeringdb.com/asn/27738"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1478}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-01","count":8},{"date":"2026-08-02","count":178},{"date":"2026-08-03","count":56},{"date":"2026-08-04","count":78},{"date":"2026-08-05","count":94},{"date":"2026-08-06","count":115},{"date":"2026-08-07","count":130},{"date":"2026-08-08","count":55},{"date":"2026-08-11","count":17},{"date":"2026-08-12","count":16},{"date":"2026-08-13","count":42},{"date":"2026-08-14","count":60},{"date":"2026-08-15","count":158},{"date":"2026-08-16","count":35},{"date":"2026-08-17","count":122},{"date":"2026-08-18","count":127},{"date":"2026-08-19","count":76},{"date":"2026-08-20","count":111}],"recent_events":[{"timestamp":"2026-08-20T04:17:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-���5)0P(1�L$","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8aa352930502831ce4c24","method":"","user_agent":"","ja3":"","session":"0a3e1581-ec8f-4c47-a43e-4c30b9136be8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"03d5e2da157678ba","strings":["BitTorrent protocol","<-UT360W-","5)0P(1"]}},{"timestamp":"2026-08-20T04:10:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��\bڜm-����}","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b808da9c6d2daed1c7c27d","method":"","user_agent":"","ja3":"","session":"26818c9a-d216-4e67-a4e1-bb478e9ecb1d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e52858acc94a74d9","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T04:05:59","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-���J֩1�7RN�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b8804ad6a9319637524e93","method":"","user_agent":"","ja3":"","session":"18ee9b96-4f2e-4a6f-9e2d-8e8c1659307a","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"8121f3d8b391684e","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T04:03:10","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��J6�1��yr�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b84a36a531a4c579727f88","method":"","user_agent":"","ja3":"","session":"1f18d733-c71d-4b1d-be20-81b4abaa72a8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"f6dc7bdb56d872a4","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T04:00:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��fط����թ�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b866d8b7acdcf5b3d5a987","method":"","user_agent":"","ja3":"","session":"cb2860b3-a6c8-4eaa-b249-385ddd2153fe","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"b3b34923e535368f","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T03:58:44","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��\u0011v8J�d����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b81176384a8b64fab6d8d2","method":"","user_agent":"","ja3":"","session":"bca05c72-c186-45d3-b2fe-0b7f5c03e0dd","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"4db30a4a5ecb8022","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T03:57:05","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��\u0001��|�,OEW\u0015","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b801baed7c832c4f455715","method":"","user_agent":"","ja3":"","session":"cc66fa7d-1d26-4d5e-8178-5f52b0b0233c","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"f484641405c733ce","strings":["BitTorrent protocol","<-UT360W-",",OEW"]}},{"timestamp":"2026-08-20T03:55:54","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��V\u0012гw�Y�\u0012�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b85612d0b377ff59fe12f7","method":"","user_agent":"","ja3":"","session":"5a3a81c0-6c78-4577-9304-42699288c4a0","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"1fb116d31af9fb2b","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T03:52:09","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��k<[�D\u001bn�X�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b86b3c5b9a441b6ef75885","method":"","user_agent":"","ja3":"","session":"e022bbbd-66fe-44fd-8d1f-679b18f2566f","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"e1c297f76339a9b3","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-08-20T03:49:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-��z|�;Cy�P��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d96b87a7ca73b4379da508bd1","method":"","user_agent":"","ja3":"","session":"a0778b21-affd-436c-b43c-4e1e361ce12e","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"aaa78093c8986826","strings":["BitTorrent protocol","<-UT360W-"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T15:26:23.647577+00:00"}