{"ip":"192.141.113.153","total_events":10598,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"10,598 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["10,598 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 3387s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"542,566,882 bytes sent, longest session 3387s","bytes_sent":542566882,"session_seconds":3387,"persistent":true}},"first_seen":"2026-08-26T14:37:29","last_seen":"2026-08-26T15:33:57","events_24h":10598,"events_7d":10598,"geo":{"country_code":"BR","country_name":"Brazil","region":"Rio de Janeiro","city":"Rio de Janeiro","lat":-22.9072,"lon":-43.1883,"asn":267463,"org":"ALL CONECTA INTERNET LTDA - ME"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as267463","label":"ALL CONECTA INTERNET","category":"isp","url":"https://www.peeringdb.com/asn/267463"},"cve_matches":[],"malware":[],"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":10598}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-26","count":10598}],"recent_events":[{"timestamp":"2026-08-26T15:33:57","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"X�\n\n0��","payload_hex":"58a60a0a3081f7","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10598,"duration_ms":3387278,"bytes_in":113868,"bytes_out":158940},{"timestamp":"2026-08-26T15:33:56","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���:f{���v��'�V\u0003\u0013G�\u0002z�","payload_hex":"9bacd53a667bd2dbe276f3df27d856037f134792027ae8","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10597,"duration_ms":3387018,"bytes_in":113861,"bytes_out":158925},{"timestamp":"2026-08-26T15:33:56","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�fM","payload_hex":"8b664d","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10596,"duration_ms":3386717,"bytes_in":113838,"bytes_out":158910},{"timestamp":"2026-08-26T15:33:56","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l���^j","payload_hex":"6cbbef835e6a","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10595,"duration_ms":3386386,"bytes_in":113835,"bytes_out":158895},{"timestamp":"2026-08-26T15:33:56","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"p���[�.�Y�","payload_hex":"70f4dddc5bfe2efa59ce","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10594,"duration_ms":3386125,"bytes_in":113829,"bytes_out":158880},{"timestamp":"2026-08-26T15:33:55","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"JX�#`","payload_hex":"4a58872360","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10593,"duration_ms":3385981,"bytes_in":113819,"bytes_out":158865},{"timestamp":"2026-08-26T15:33:55","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�_�\r�͘","payload_hex":"9e5fe90dafcd98","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10592,"duration_ms":3385443,"bytes_in":113814,"bytes_out":158850},{"timestamp":"2026-08-26T15:33:54","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�J����/��","payload_hex":"a44aead3efaa2f9682","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10591,"duration_ms":3385030,"bytes_in":113807,"bytes_out":158835},{"timestamp":"2026-08-26T15:33:54","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��h0�o","payload_hex":"dbc66830df6f","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10590,"duration_ms":3384716,"bytes_in":113798,"bytes_out":158820},{"timestamp":"2026-08-26T15:33:54","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0013�\u001b�","payload_hex":"e113de1bb3","method":"","user_agent":"","ja3":"","session":"a2d8925a-c3dd-4518-9fb2-44b09bc3fef9","seq":10589,"duration_ms":3384169,"bytes_in":113792,"bytes_out":158805}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-27T10:51:51.034881+00:00"}