{"ip":"191.99.9.69","total_events":96,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["96 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 20,551 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,551 bytes sent","bytes_sent":20551,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-20T01:35:23","last_seen":"2026-08-20T05:36:50","events_24h":96,"events_7d":96,"geo":{"country_code":"EC","country_name":"Ecuador","region":"Guayas","city":"Guayaquil","lat":-2.2038,"lon":-79.8819,"asn":27738,"org":"Ecuadortelecom S.A."},"source_domain":"hfce-191-99-9-69.customer.claro.com.ec","known_scanners":[],"scanner_tag":{"key":"peeringdb:as27738","label":"Ecuadortelecom","category":"isp","url":"https://www.peeringdb.com/asn/27738"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":96}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-20","count":96}],"recent_events":[{"timestamp":"2026-08-20T05:36:50","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�ư;�h8�Fc��B��ȥ�Ǽ���RsT�W-\u001b�tbZQ*�E��8�q]K\u0012�*\"!�`{.�x�l�\u000f&c��D�\f��=pyQ�vZ�q\u0017�\u000f��:�\t\u0012Ԕ%�6�\u001a\u000fDȺ捨3rZG˴�\u0000B�P��\u0007�=(L�\"A��$8y�2GW�����\b�\u0010\u0012d�rŬ&�l���'�P4��(���\u0004\u0019\t�@[\u0002�m�W��3�7�3�x�\u0007�bM$�}����l��f,�;�[�%�]�9\u001e��\u001aJP87\u0001j\u001f�\"yY�\u0015l�J��'\u0001RU��QS���h)�잀t���\u001b6==�\r\u001f�ty(��j��<54\u0013: ��g�l2B��jV[88D33��7��\t�\u000fc\"\u0016aƉ���2\u0019N\u0003��*�D��-�����{ϖ\u0011�Fȉ��}�ڇ\u0013�F\u001e\u000f����>�n�+\u0019%�ƅ����U2�5���w\u001a���\u000f��w{g�ǽ+�\f�����kK","payload_hex":"ddc6b03bfd6838ab4663bdf2428f8ac8a5ffc7bc83c5f6527354c8572d1bc674625a512aaf45fdfc38d7715d4b12eb2a2221da607b7f2ef378d96cc90f26639ce344e90c96e83d70795194765ad27117fd0fe1d73a830912d49425f936a81a0f44c8bae68da833725a47cbb4a40042be5088dd07c33d284ca52241b9a5243879993247578aa2edb7b308cd1012649372c5ac26fd6c86bee227a8503493d22885bdec041909ab405b02aa6dc957f0de33fa379a33f978c107a9624d24b07da1ccc6ff6caab2662cde3bc65b9525c25dc6391e9bc01a4a503837016a1fa02279599c156cb04a8c8427015255b5ca5153a9b5ba6829f2ec9e8074a488c51b363d3dfc0d1fef747928aaf46a8dd53c3534133a20e0a467c36c3242aebb6a565b3838443333c08e37c1ab098e0f63221661c689fc8cc632194e038ae52ac744bebc2da18f86e28c7bcf9611c046c889b09c7d84da8713e2461e0f83cde4c53e9a6eba2b1925c4c685f1e7a5ca55328e35a8cfe2771ad4cef60fa282777b67eec7bd2bfe0cffe5f0f7c16b4b","method":"","user_agent":"","ja3":"","session":"6e3212b9-fa0a-4cb8-8faa-6e795bb16709","seq":1,"duration_ms":100,"bytes_in":393,"bytes_out":11,"enriched":{"digest":"3d90e5fe1595b1cb","strings":["tbZQ*","=pyQ","3rZG","JP87","jV[88D33"]}},{"timestamp":"2026-08-20T05:34:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-kbG1DIDvrUcr","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d6b6247314449447672556372","method":"","user_agent":"","ja3":"","session":"26614a16-ddd8-4880-94ad-1581ff1f5a45","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"1ddeaca945361c52","strings":["BitTorrent protocol","<-UW1605-kbG1DIDvrUcr"]}},{"timestamp":"2026-08-20T05:32:04","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��V�M�\u001b\\�\u0011�i8�g�U�'e)�\t�X\"��$�^\u0015����o\\�Z1�c���\u000e�z������pu.'N{�X�z�Y\u000bh\u001a�o\u0001�\u0017��\u00176.\u0019Q��a;\u0003�\u001f\u001bp�\u001ao\u0000��\u0014\u0010���b����\u0019\u0007'l�_|��\u0011��gP[#�&r+^}@鈵v�<}ˇ������&\u0014���\u000b5�סT�r\u0003�΂��e��<�h�'�������2w�1\u0019&^J�}��\u000f�\u0004�LR=�\rc�dx�:qQQ�@�������\u0005 ��[�\u0000\"\nɿիו�j>�[D\r\u000bٛ���L^w\r$�xd��\u0015\u0015�\u0002\u0012ݨ�X�'K�����=\u0018�6�\f��3������óM�k�<�\\/}٧��^Ng3��q\u0010����W9�{��V�\u0014��\u000e*\u0007�\u0015��0^K�F0�G�\rCM�Ix\u001b̗��(}��0L���\u0015\u0018����\u001d�ܸ�Y�:դ\r��A�\b�\u0014!|������'V/�A\u0017u���؊�0�y�=Y2=��\u001878��SM�E*[i>Eέ��\u001d)�|�d(\u0004��rI%�&��������\u000eW�;�4 ��|�\u0014�CT\u001bc\u0000!\u001d��)���\u001ek�q\u0011�)�\u0017�3L��e�P�u#�q��d:PUe[z���I��\u0002�K\u0011�B��\u0005G�UڙN��\u0007 �x���^o\nCxC��b","payload_hex":"083a8d376dc33c430a2ac3f19e3e15cfd1305e4bc546309447950d434dd449781bcc97e39a287d9c9d304c93a6e51518e19ec0c81dcadcb8c759963ad5a40df1f941a8088714217ceb96cce9b0d327562fcb411775f793ead88add30be79bd3d59323d8b9e183738a5fb534dd8452a5b693e45ceadfcb31d29d67cab642804b4c6724925f626c08ce6eec1d0e4aa0e57f93b923420e8987cdb14d743541b6300211dbbfd298cc5fb1e6bf27111b229f817bf334c8bb665b450e77523cc718dd8643a5055655b7af2fefb498fe802a34b11bf42a4c80547a955da994e94af0720937882d3c75e6f0a43784398f862","method":"","user_agent":"","ja3":"","session":"0508a6bb-cbac-499c-9af7-01b33be6bf77","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":11,"enriched":{"digest":"969b69c2fde05dfa","strings":["=Y2=","E*[i>E","d:PUe[z"]}},{"timestamp":"2026-08-20T05:24:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-Q-!6imK7cMPm","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d512d2136696d4b37634d506d","method":"","user_agent":"","ja3":"","session":"b85bcf58-7a39-48de-a1f5-9cbe5d1b4c26","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"e813bc4b5e46b887","strings":["BitTorrent protocol","<-UW1605-Q-!6imK7cMPm"]}},{"timestamp":"2026-08-20T05:22:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��f���ⓘP0�!\u000f�:�8R��t(:%�G>8�\u0006���\u000bC�|�Q�uI��h����!h\u0015A��\u0003}X��Z�^:��X�v� ��P�n��D��\u0016$�/\t�\u0007<��Ȥ\u001b)�\u00004��w��u�=�c�","payload_hex":"90f866f085b0e293985030c4210fbd3ab538528aec74283a2597473e38ab06e486ec0b43db7ce451c27549b68e68f4b28ba221681541d0d4037d58cbe75ad25e3adbc0589876fc20bbaf50976e93c04489f41624862f09c9073c8e9bc8a41b29e60034a6fb778de375b73ddd63c1","method":"","user_agent":"","ja3":"","session":"d3b44760-3ee3-4d52-9695-cf87c8d30fc9","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":11,"enriched":{"digest":"c52a82d0fe3b44d1","strings":["t(:%"]}},{"timestamp":"2026-08-20T05:14:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-_7qpcxeiu3xp","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d5f3771706378656975337870","method":"","user_agent":"","ja3":"","session":"aaeec62f-0d1e-44ed-b88d-306594319f24","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"c623bc46f382095f","strings":["BitTorrent protocol","<-UW1605-_7qpcxeiu3xp"]}},{"timestamp":"2026-08-20T05:12:41","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�,�+\u000b��m}�z�s�sY\"�䬛�\u0018A�\u0016�&oX�-YM�U�4$\u001dY\u0006G��t�䞣�FI�\u0019S���\u0007�4��\u0003[$Uk����\u0005*���`��_oY�\u001d�FX�q\u001fh��\u000e�\u001a8�B��Fl\u0004聡ze\u0001�\u0012�n��kKT����M�@;�>.�KsUQ\u000fy�E�\u000e\u0007[��\u0012q�!��UL���>�\n��h\u001a����߹�\u0019\u000b��\u001c\r̳ #����#@��\"�D^8��!+�7gc�\u0010�����{�6���\f��\u0003�\t%�\u0005�k����g]\\f�V}����\u001a\u001eG\u0019�j6��\r,�\u0005\u0017�(�u\u0000����T>�\b\u00035�j��Yү��M�\u0010��%�2��Q\u001a\u001d�\u0015QǑ��n2\u0000\u001d�1U��c�\u00191p[\u0011�����&��.ϙ\u0007�q�� g\u0014�^�\u001dl���8q�[�\u000e\u001d��v�\u001a-2�\u001a��F��\"��Є�u��\r\u0000B���*;I����\u001a���T�\u001fU�q�\u0004�\u0015\u0002�z�M��.��Hbm��I��͠O8F�E��~�����b\u001e\n\u0004%nHg4R�n[\f�I���?�))�4lu\u000e\u001a;K��\u0012�^�\u0005�X��g\u0003\u0014�\u001d�FmA!�\u0011�i�5���3\u0019%\u0004�\u000fT���[��\n\u000f�ŏZ�W\u0014��\u0012�nj\u0001د��\\G����9\u0011�\u0018��֏I��\u0003�F�\u0002�\t\u001e\u0013z\u0014��z\u0015ۢ<�7�\u0012��J]�c��H�EDf��?�b\u0016����Jd�����\u0000���-�","payload_hex":"e52ce12b7f0bd3f96d7dd87afa73f4735922ece4ac9bf51841c8168a266f58b42d594da655ef34241d590647dbfa74f3e49ea3a44649891953acf6b9078a349095035b24556b9b9cf1f8052a8f9ea9608bf95f6f599f1dc04658b8711f6891db0ef21a38e84283e6466c04e881a17a6501b912b76ef0ac6b4b54cec8fdf64d98403bf53e2edd4b7355510f798a45b60e075bf18712719e218882554c979ebd3e980aaceb681a9d9eb3a1dfb9ca190bb1991c0dccb32023a5ec95fe2340899922cb445e38b8c4212b9d376763b110cacceda9ad7ba736898ded0ce7a103840925f505e66bf4f9f8f1675d5c669d567d9c87eeb01a1e4719bb6a368ec70d2cdf0517b3289d750097d8cad0543ed2080335c56a889859d2afa1fa4d8f10b8a2258b32aaac511a1ded1551c791f1e76e32001d973155a1eb63981931705b118da8aaa6dd26eed62ecf9907df71d6ea206714ed5eee1d6ca6c5e13871e75bf00e1df29f76ca1a2d32c91aa89d46fd81229291d084d475e6df0d0042a9fba42a3b49d0e087ea1a93b5b9548d1f55b8719b048c15028d7a864d80e82ebebf48626df2f549d9cdcda04f3846fb45c2dd7efbaeb8bc8e621e0a04256e48673452d66e5b0cff498eb4bf3fb62929ab346c750e1a3b4bba8f12b55eed05ed58e9ea670314dd1de7466d4121a811de69cf358aae8533192504af0f548eb4f35b8b8f0a0facc58f5ab5571494d3127fd16e6a01d8afbcf35c47dfc1dfe039118a189ce6d68f499ab203a946d9028b091e137a14b6ea7a15dba23cd637df12f59e4a5ddd63aec448d545446689cc3fa0621688e49ec84a64e0a9c8f99d00a0e3c82d8e","method":"","user_agent":"","ja3":"","session":"9b6df441-851f-4692-a902-97d0a3d65509","seq":1,"duration_ms":101,"bytes_in":604,"bytes_out":11,"enriched":{"digest":"a434fcb50a3a1560","strings":["[$Uk","KsUQ","g]\\f","%nHg4R","FmA!"]}},{"timestamp":"2026-08-20T05:10:11","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-FCfe4FW.GeAL","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d464366653446572e4765414c","method":"","user_agent":"","ja3":"","session":"c682af7e-8293-430c-b8a0-b9ca3774f6e7","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"1b291ee4c4403b55","strings":["BitTorrent protocol","<-UW1605-FCfe4FW.GeAL"],"iocs":{"domains":["uw1605-fcfe4fw.geal"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T15:26:17.870547+00:00"}