{"ip":"196.189.57.23","total_events":52,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["52 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 11,652 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,652 bytes sent","bytes_sent":11652,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T02:26:15","last_seen":"2026-09-07T04:31:06","events_24h":0,"events_7d":52,"geo":{"country_code":"ET","country_name":"Ethiopia","region":"Addis Ababa","city":"Addis Ababa","lat":9.0245,"lon":38.7485,"asn":24757,"org":"Ethio Telecom"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as24757","label":"Ethio Telecom","category":"isp","url":"https://www.peeringdb.com/asn/24757"},"cve_matches":[],"malware":[],"top_ports":[{"port":1054,"proto":"tcp","label":"","count":52}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-07","count":52}],"recent_events":[{"timestamp":"2026-09-07T04:31:06","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0003\u0011i,3L\u0005��ر��*\u0010[�>\"\u0003o\u0015\u0014��\u0016g\u0000\u0007�?���F5��R\u0018]4���3��x-��j�'��>����\u0012�N��\u0018�H���`Bc��MJ�\f���#�\t\u0005ճ\"\u00112��\u001b9����e\u0000p\n�@\u000eΏ&h\u0013��\u0007 ��I�j�;�\u001a0�b�#�\u0014\u0006\u0011���������\t�z��&\u001f���e��U�\u0004�+���\b�>��\u0012G\u0003q�3~���9\u0004\u0002�Q�T���*�Y��������i-��ԇ� /\u0015��`l]�)^S����H\u0007�瞢.\u0011�,�̭4>�[)��\u0003ijC����*a��\u0010�I;�c�w�Dz�Ӛٷ^����\"�ɋ��䱖\u0017��L.�}\u0018y=�����\u001dQ�^\u0000?i�C\u0016_\b=Vq�\u001e<\u0002\u000e�7H�'\u0019\u0018����X\b͟\u0004�='5(D�\u0005��\r����<����5���t�s�Mi�h�#�`_;��j�\u0007}b\u0011az�\u000f)���R\t4@��&?m�\u0019���q��r�m�A3\u0007�y,�,�,'%��\u001bLqx<����QAt�J6�f�k��7\b�=�d%\u0000\u0007%z\u001b~\t#.�>}\u0018\u0017G��\bs\u000fB�N�~�Q!�C�u���]\u000fr[\u001b7j����\u0014ud���#���O�o�;_�\u0006f(�\r����D*�o","payload_hex":"bb0311692c334c05819bd8b181fa2a105be23e22036f1514818116670007b03fd9ddce463583ae52185d34e492fd33f480782da7fe6a93278ddb3e8fd1d4e212804ed5c118c648b784b160426398ef4d4a9e0cf3e9d023860905d5b3221132c6e71b39a3d2dfc86500700acd400ece8f2668139fd2072099dc49a56a983b8b1a30df628623f6140611e289e4b8ccc8f98ff409947a81d1261f9d89e565a6a355da04d52b83f9c408f03e9dfa12470371d7337ebac7c3390402f951c754fdeaed2a81598ff4c8cfe8b6c18d692da189d487e8202f15a58d606c5dd6295e53b77fc9eafd480795e79ea22e11b02c92ccad343e9c5b29c4eb03696a43b8a1b9d32a61b2db1087493b8763a477dbc7b2c5d39ad9b75eb8f2fef52280c98bbeefe4b19617caf64c2ecf7d18793de8e9c2e4fa1d51e95e003f69a043165f083d5671871e3c020ee03748d52719188aaacbf05808cd9f04ba3d27352844c105cfc40d89a0c28ffcb83c8baafccd35f4e7d874f573da4d699b68cb23e5605f3bb5b06aa0077d6211617a860f29fefbfe52093440bcc0263f6d7fd219ece09c71abe472f66deb413307ae792cd42c9f2c2725aaae1b4c71783c8bc187e4514174ae4a36b566866bbec13708c23dd764250007257a1b7e09232ef53e7d181747d8d608730f42da4ed17e955121c543a575a9e3b75d0f725b1b376a90a5a0ef1475648ac9e523b28ad44faa6fa53b5ffd066628b80d9ae0e091442ac86f","method":"","user_agent":"","ja3":"","session":"e90fe7fa-b200-4844-9256-c4e2a1b3cec1","seq":1,"duration_ms":100,"bytes_in":536,"bytes_out":13,"enriched":{"digest":"b8bb8bc91f897ce5","strings":["i,3L","='5(D","Lqx<"]}},{"timestamp":"2026-09-07T04:31:03","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005)b�m$��i���P�7��KW��-XL0019-9��� \u0012�h����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000052962c56d24ebd869ff82d850cb3783d34b579ca12d584c303031392d39f8cdd32012b6688994edd9","method":"","user_agent":"","ja3":"","session":"106d82ac-3566-47c2-937e-4a35ec34d749","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"40c71b9216350610","strings":["BitTorrent protocol","-XL0019-9"]}},{"timestamp":"2026-09-07T04:22:04","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�H\u0004�H�15ߖ�;�l\u0017u��\r\t>������\u0013�:χZ��P��W�[\n�\u0003Z��O?Y�1��i�qp3�2\u001eGo5��1�I�\n�QG3Ȯ��.a�2r\u0015��0q��F��� �8���>�d\u001b救tg�e'z \u000e�������^\u0004��\u0002}�7C�\u0012�{��Q-@/����W͒���v,3Yp\u001cZ���]�2� \u001d�I�?������j\u0013m[�����Qfw��\u000f�8��y}�&�����kBq�Q\u00133%�W06>|B_\u0010(‘_\u0012\u0010\"v�!;��B�HJ\u00193WRe�\"F��\f)tw\u0006��|��`�-��\u000e�z�\u001d��|�@�\u0004}�S\u0012\u0016v�����ƗT�\b��_����\u0002���|\u0006�WNn]|�?\u001e\u001d�z\u001f���y\u0019�\u0012��mK\u001c.�h(�e\u0006˙�b\u0005fʽ\u0000����p\u0018?��\u0012GU�@��7+�T�Šo�\u001cz!D�l0��L#|��ֹ�+��\u0012�\u0012}t��\u0012\u0000oc�|���doBe^���Ol2^}���9Djk","payload_hex":"9148048448fe3135df96c93bc46c17758dee0d093e8aeeceebfb85138f3acf875af6e350cfee57ef5b0acd035a8fe84f3f598c31a2876983717033ff321e476f35bc8c31f549ae0a8a514733c8aed2da2e61b9327215e4963071dbf646dde3b820dc38f68a893e83641be695917467f865277a200ec2c9c1bea8eba65e04b2f3027db43743d412b27b9bfc512d402ffce8d5d357cd92e2c6ea762c3359701c5af4abbd5dc432c4201df449c13f859dace1a6e46a136d5b8fcceb93fb516677a2960fb238a3db797da8269a80accbe46b427191511333257fa55730363e7c425f1028c2915f12102276f0213b89b542a0484a1933575265db2246faf20c297477068dd97c88f660c12d9bff0ea27a8a1d95847cf140c2047ddc53121676addfe6efb2c69754bf08d7c95feacee3f7029389857c06f8574e6e5d7cf43f1e1d807a1fa4e2ef7919f112a4a06d4b1c2e806828b06506cb99f4620566cabd0097a0dbcd70183ffb9c1247559240b2af372baa54fcc5a06fe21c7a2144fe6c30fdcc4c237cabbed6b9c62b8bf012d3127d74e59712006f63c27c83c2f2646f42655eabbda84f6c325e7dbebdf039446a6b","method":"","user_agent":"","ja3":"","session":"0a175974-6bba-4010-ad98-73c0a70bdca7","seq":1,"duration_ms":100,"bytes_in":430,"bytes_out":13,"enriched":{"digest":"051fef7e5e8d65b8","strings":["Q-@/","v,3Yp","W06>|B_","3WRe","WNn]|","doBe^","Ol2^}","9Djk"]}},{"timestamp":"2026-09-07T04:22:02","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005)b�m$��i���P�7��KW��-XL0019-9��� \u0012�h����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000052962c56d24ebd869ff82d850cb3783d34b579ca12d584c303031392d39f8cdd32012b6688994edd9","method":"","user_agent":"","ja3":"","session":"845849a2-c5d2-4b09-9169-b45f3b14a47c","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"40c71b9216350610","strings":["BitTorrent protocol","-XL0019-9"]}},{"timestamp":"2026-09-07T04:13:22","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\\E\bۿ!F6\u0003p��D(k}�16�\u0013�a�D�̥�G6w�\f��d\b*���)&�P<�?��,�A��L�\n� ���\f��6*5�\u0003���\u001e�H\u0004�p�)\u0016��5.�\u000e$�H�J��#��O4~�\u0016����~\tk\"=Nџ4���ߡ=|b�[e\\� *���B\u0014��\u0010���\u000b�Դ��Uzw�q�\u001d�㣝����l�\u0011y��\u001e%{\u0003)\u0018��\u0001A\u000f*MA[?��T|g���|S\u001f���7�i\u0005�l���%X*�l�����Y�5?u]{\u0003�����\u001aE�UB�\u0016��Ү\u000bt�C6C�=\u001e�GԆ�\u0003{�^���\u0003ī���A���k%��-�m�X��\u0015�Uq�C&\u001eC]�r6�.^\u0013'����\u001b\u0019p�ֱ=\u00003\u0004�\u0002,�]\r]\u0005����|_2D���P�����;w�(\u0019\u000eٿ8��i�c���5;V�����B�����f��4�s\u0005>6n�����\u0004�ʫ�\u0000�5'\u000f\u001e��`A�y�7NMb��'Ƨy�9\\A7\u000e\u0002����\u001b��O'��݆�0&E6#x\u0013cpM<��Y��?\u0013��]�\u0015� �%��.D��\"�\u000f���d�p�B$����~��","payload_hex":"5c4508dbbf2146360370d7e444286b7dc03136b113fd61b544f3cca590473677ef0cc2d0647f082ac18dac2926bb503cd83f8ee82cb541dbf14ce50aa0208387bf0cd3ce362a35d903f98b861ee148048b70bc2916e9ef352e9f0e24bf48b64ae5d723a5e94f347eac16e0a4f6937e096b223d4ed19f34f3edb3dfa13d7c62975b655ca5202ac1bed14214ab9c1095cafe0b98d4b487da557a779f71ec1db3e3a39da197f9b36c8d117990f81e257b032918f4c001410f2a4d415b3ff8fb547c679ecede7c531ff1988237bf6905b76cf9d9f625582a896c8685e080bb59ad353f755d7b03fab09bc1e31a45ee5542f51686c7d2ae0b74c6433643ce3d1eea47d486cb037b9a5eb2918e03c4abb7a3c341fd9a9a6b25a7a52dc36da5589eed159155719d43261e435d9c7236e02e5e1327b9e8c5f71b1970ebd6b13d003304e3022cd55d0d5d05f381d6da7c5f3244b0f0a350aeecadf6ea3b77d928190ed9bf38c1f769ef63eeeba2353b56c2f587a2b342b4c3ebb1c166ed9d34a673053e366ef3b0bed6c304a5caabf3008435270f1ea9d66041f5799e374e4d62f6ec27c6a779b5395c41370e029896c2f21bc0b14f27b99cdd86d43026453623781363704d3ca2da59b2883f13e8e75d9c15bd208a25f7c82e44f1fb22e90fe89eec64a370f14224bfd6f9867e87b0","method":"","user_agent":"","ja3":"","session":"4983b268-b128-4353-be0b-acd187113654","seq":1,"duration_ms":100,"bytes_in":491,"bytes_out":13,"enriched":{"digest":"92a895228b44fd54","strings":["D(k}","k\"=N","*MA[?","5?u]{","|_2D","7NMb","9\\A7","0&E6#x","cpM<"]}},{"timestamp":"2026-09-07T04:13:21","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005)b�m$��i���P�7��KW��-XL0019-9��� \u0012�h����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000052962c56d24ebd869ff82d850cb3783d34b579ca12d584c303031392d39f8cdd32012b6688994edd9","method":"","user_agent":"","ja3":"","session":"805c1b1c-3cf0-4641-a8f3-145cb8a42647","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"40c71b9216350610","strings":["BitTorrent protocol","-XL0019-9"]}},{"timestamp":"2026-09-07T04:05:01","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0005'iG9���+���D��xBY�����\u0007�T�5%��\u000b=>M\u000b�ċ�kg\u0013U3M�\u0018�]\u000b&W�*����U_��+�\u001cu��J\u0003��D���ŏ���\u0014'{jXJ�`gF����~����^\u0006�kV��\u0016�%�\u001d\u0004�{T,#-qa\u001b yf�掲:��:U\u001e&�#k�)gd�L�1��?� :K%����\u0018���/�$d�h5�*!�t��t��|ӿ�0�A5:���\u0016\u001aR\u0018�,�!��\u0018�)6>\u001b\u0006_oQG\r��2Q��Vʻ\nק�\fpi�+l?��0�{\u001f�y�\u0000\u0004�P","payload_hex":"e40527694739b3ecc82bcfd1cb44f0ce784259a681c8e8a307da54ca3525e2dc0b3d3e4d0beac48bb46b671355334d8618a15d0b2657ab2ae9f1b9f4555f8ed92bf61c75e0a54a03e0f544efcedec58f9cec8c14277b6a584ae8606746fbb2e18a7ea7fd8dce5e06b46b56aaaa168225b51d04e77b542c232d71611b2079669ee68eb23a82d33a551e2690236bef296764ae4cb13186ec3fba203a4b2594adc3ef18cfe8ae2fd82464c96835d52a21fc7490a174f9807cd3bfba30ce41353ac4fed5161a5218e02cf821fce4189d29363e1b065f6f51470de7dc3251f0e356cabb0ad7a7940c7069d02b6c3fe29030bd7b1f8d79a50004a450","method":"","user_agent":"","ja3":"","session":"9a5c10d5-47b1-4ea6-bf7b-48eeca288828","seq":1,"duration_ms":100,"bytes_in":249,"bytes_out":13,"enriched":{"digest":"923ddffb4ea6498a","strings":["'iG9","'{jXJ","{T,#-qa","_oQG"]}},{"timestamp":"2026-09-07T04:04:59","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005)b�m$��i���P�7��KW��-XL0019-9��� \u0012�h����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000052962c56d24ebd869ff82d850cb3783d34b579ca12d584c303031392d39f8cdd32012b6688994edd9","method":"","user_agent":"","ja3":"","session":"0c083278-32aa-488f-9043-fff1dbc32281","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"40c71b9216350610","strings":["BitTorrent protocol","-XL0019-9"]}},{"timestamp":"2026-09-07T03:57:00","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�L��\r���M4��OZFj\u001c��/-�\r;%�\r<�y��i�\u0004\u0005\b7LvnH�G�lT�һ\u00123\u000fN9���)��)�aG�x���\u001fڇ\u0006��i�\u0000GK�%LRz��z�,�<��eT[c�da\u0019��|)\u0012o_�Z��\u0002$�L\u0015\u0006ݗ�c\u001e��G\u0019�T�DB{i���\u0013\f\u001b�Ud��\r�'�\u0012��4�7a��Y�\u0006�K%�R��@,�\u0006게�հC���\u001c���~\u0006��AvXC��)\r\u000e���~\u0002�f�;�\u001f��\u000e\f��=����-\u0000\u0001���|��WH��C0\u000b�0,Z�\",\u0002\n�\u0002���`��Q�\u0019�Ia\u0003zw��R��M�����&��\u0019�31P)�J��y�*\u0003'\u001a!�(k���cP��7|��&����(~���y�*\u0004D�c��i\u0014�ة�ܞ`h�I�ւ�j�mNR�\"�\u0013J�N���_��)}�fb���\t\u00185_���u���<\u0003���çM�\u001e�����1�Ծ��!�>ˌ)�k\u001c�\u0014}�{�\b\\��>�{�c�VoX�\u0002d�\u0004��\n� Ң�c��N3�,N���UW","payload_hex":"fa4cc5c90dc9ee954d34e4b34f5a466a1cc1c32f2df70d3b25ed0d3cef79b0de69d3040508374c766e489f47f76c54e7d2bb12330f4e39fe8e8929c4fa29b0614788789abca51fda8706bafb69f20047eeac8c4be4254c527af4b77afd2cf53ce7e165545b63ea646119acd07c29126f5f925ab2860224ff4c1506dd978f631e8ddd4719ff549944427b69dbf8ad130c1bfa55649f880da527d412858f34dd3761e7db59db069a4b25c852acec402c8506eab28cb7d5b04395e1de1cfbb9927e068da841765843c3eb290d0e8fb3a27e02aa66c73b931ff8c60e0cf4953db3e484ef2d000193ccdd7c87e55748bae243300bc7302c5ae7222c020afd02a6af8e608ead51cc19d74961037a77a98352efc84da8c5ffe7be26b1f719aa33315029e14aa4ca79e22a03271a21b1286b85f2db6350c5ed377c90b5268caf9387287e9af88c79842a0444e1639bdc6914b5d8a9ffdc9e6068a849afd682946ac76d4e52e122e4134ac74effd2ca5fe7c9297dc46662bf8cd40918355f99eac175b0b6bb3c03e49ac8c3a74d931ee6a3f5f08031c6d4be91b321f43ecb8c29b96b1cab147dd07bd3085cd1d83ef77ba063f4566f58d60264cc04e6b30ac820d2a2d06386e34e33a62c4e91baaa5557","method":"","user_agent":"","ja3":"","session":"3eb52285-bc5c-4100-a8d3-afda6f2ac035","seq":1,"duration_ms":100,"bytes_in":460,"bytes_out":13,"enriched":{"digest":"39abfac2519c42c7","strings":["OZFj","7LvnH","%LRz","eT[c","DB{i","AvXC","31P)"]}},{"timestamp":"2026-09-07T03:56:59","port":1054,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005)b�m$��i���P�7��KW��-XL0019-9��� \u0012�h����","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000052962c56d24ebd869ff82d850cb3783d34b579ca12d584c303031392d39f8cdd32012b6688994edd9","method":"","user_agent":"","ja3":"","session":"2602fd5b-ab23-4905-8786-a8acdc3bfe0d","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"40c71b9216350610","strings":["BitTorrent protocol","-XL0019-9"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T09:52:43.443474+00:00"}