{"ip":"200.219.59.22","total_events":1011,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,011 events across 1 port(s)","confidence":"medium","network_type":"enterprise","why":["1,011 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"216,880 bytes sent","bytes_sent":216880,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-02T20:45:21","last_seen":"2026-09-04T06:08:30","events_24h":372,"events_7d":1011,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"Praia Grande","lat":-24.0027,"lon":-46.4893,"asn":270817,"org":"Gigante Net Group Inf Ltda"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as270817","label":"Gigante Net Group Inf","category":"enterprise","url":"https://www.peeringdb.com/asn/270817"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1011}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-02","count":165},{"date":"2026-09-03","count":540},{"date":"2026-09-04","count":306}],"recent_events":[{"timestamp":"2026-09-04T06:08:30","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"v�Qy\u0004��[�M��/������]e��\u0014\u000f�HԶ� )���D�FS\u0003_���\u0018�F�7�7,3�<J0O3�jFB�>M\n}%���\u001b\u0003gu�'�?ƌ����Y�)f��{�y�K%�ؒ �\u001dH�\u0005�h16�gSn�Tc�\u0015�k���\u001bry��7MAaf�a\u0006�˼��%\u0010X\u0006\u001d�hʥ4��\u0012(\u0012������@���҄�\f:]�\u000bE��ʳZ`\u0014f�Y\u0019\u0012��\u0015\u0000ȗ҂R�{s9a�qI�BR����u�¯�\u0019�/xOL�\n�)k\u001c|�\u0016�6\u0000�\u000fNϟ��N\u0007�%��Q���ʚ����\f[\u0014Sd�\u001fG���8.lo;��ؖVԏ\u001f\n\u00029\u0016I��=��J�WR��{\u001a�\u0017�����Y�K|X�/\bw`م���\u0003CFI\nDn���T5�)�IL�E���~+\u000et6q���\"I��ԕ�\u000f�;��a","payload_hex":"76ce51790482be5b964ddad62fb2e6bef0ffa95d65c1f1140f8948d4b6b32029cceae744ad4653035ff2e98018a746eb379a372c33f33c4a304f33d26a4642f83e4d0a7d25989ea01b036775bd27ba3fc68ca3f984fa599e2966ed977ba079a44b25cdd89220b31d48ea05f76831368867536ec15463c415946b998ac01b7279a1ac374d416166e76106e9cbbce2ef251058061da568caa53486db1228129e89cec0f5e2409397aad284c80c3a5df40b45a4eccab35a601466df591912fcc91500c897d282529f7b733961b07149884252be8ff1a575afc2afc419be2f784f4c920a8e296b1c7c9116c53600a10f4ecf9ff88e4e07b625c5cf51aeffc7ca9aa1ba9fef0c5b145364be1f47a7f9e0382e6c6f3be7c9d89656d48f1f0a02391649fe9c3db4e64a9b5752d5cc7b1ae21797a1c8e48559a94b7c58932f087760d9858790a1034346490a446ebbd0ff5435d829e4494cdd4596cae67e2b0e743671a3e8b82249e498d495b80fa53be1f0617f","method":"","user_agent":"","ja3":"","session":"580da316-2ee5-433a-9b54-ebd4f4a25c06","seq":1,"duration_ms":100,"bytes_in":368,"bytes_out":13,"enriched":{"digest":"fc8186d0752060b1","strings":["<J0O3","7MAaf","{s9a","/xOL","8.lo;"],"iocs":{"domains":["8.lo"]}}},{"timestamp":"2026-09-04T06:07:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6PPRuU8q-IUbhH*E~s","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436505052755538712d49556268482a457e73","method":"","user_agent":"","ja3":"","session":"5262ecc3-fdcc-4bf4-b838-a7e3ab5308c0","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"22d642acd7ff9495","strings":["BitTorrent protocol","<FD6PPRuU8q-IUbhH*E~s"]}},{"timestamp":"2026-09-04T06:06:04","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"]�\u0019��5�.\u0006��\u0014��>DX�5��:\b \tU��_��\tsaD\f���xc��q`\t2���\"�d`X����\u0005x� �\u0001eMfS�y9��I�5u�R'�K�OwƟE3����C��%����6t����v���*��F'�\u0001c�Z\u0012�((\u001a@O��p�\u001b\u0015\n����\u0003lb\u0006����\u0004�F⻇�\u0004\u0010ö�]�$��gY��\u001e\u0016\u0005m�\u0010ө.6�k�u\t�J\u0010�-3hȱ��\u0000@�'\u0007�d\u0018X�`D���\u001ax�t�K���'\u0002�� ̾\"Q8\u001f��r�.�Yc�?Õ\n��\u000fOGǸ�\u0015�R�@�o�@����p���6�@�و\u0001lo\n���2җPl�n���[��\u0017�R�,���q\u0003[��B\fZk\r�E�0�qA]��W\u0001�y�\u0007/s\u0012J�h\u0000H̓\u0005Ų��0�������]�TU\\���Uyn�v��L\u001dYë\u0015{\u0010̝��\u001d�OC�um\"\u0016'��2�ZD�T�k�!\u0005����jA�\u0013%1g�r��p\u00003%\r��??�A��\u0011�\u0004\u0018M��N4F�\\В�,e���b0BN?0�����N�\u000f�J\"/��?\u0002\u0002\n\u000f$=\u0003�#!0�E=�R��͐��\u00188-�=HC\u0019Ca\t�\u0007����\u0001k-=�H�B����e�-�|�er�?�����,A\u001a\u00050.\u0016\u0007\u0003���E\u001bX�\u0011���\u0001\u0014\u00049�\\i��� G$�������\u0006�\r]\u001c��]Z��Z\fjP=\u0017","payload_hex":"5d8a19a29535cd2e06f09414f7b43e4458f13596e03a08200955a3f05fb0e5097361440cced0f3786392fb71600932b492b622b1646058aaf58ddc05789320bc01654d6653db7939f1cc49e33575f65227a04be34f77c69f45338bef89ec43b18a25af877f98ab3674ecf5ccfe76f6acb12aebdf4627e30163d75a12c628281a404fad8470de1b150a89ccd2c2036c6206afc1a1a304fc46e2bb87d10410c3b6b05dfd24bcea675981f21e16056df710d3a92e36f76b8c7509ba4a109b2d3368c8b1e49b00409d2707bd641858ba6044f6b1c51a78b174d54b94cade27029bdf20ccbe2251381fe5a772b92ec65963f83fc3950af3b90f4f47c7b8bb15e252cc40986fe540c09bf9ba70e9e4ee36b540d8d988016c6f0abae9b132d297506ce26ef9eb915b9fb717b8529b2cb1e78671035bdae1420c5a6b0dc345ff30ed71415db4ea5701a879f1072f73124af5680048cc9305c5b2c0e0308ab490b5d4f0b75da554555c82b4ee55796ec07682a84c1d59c3ab157b10cc9d9cd31dcd4f4388756d2216279fd6329c5a44d154d96be3210589a4c0926a418513253167df72a7ca700033250d9fbf3f3ff34190ea119804184dbfe84e3446cc5cd092ea2c659ad0c96230424e3f30aaa682f3e64ea40fbd4a222fd8c93f02020a0f243d03c1232130af453da3528c81cd90ab9318382dfe3d484319436109aa07a6d6f783016b2d3dfc48e442ebffb3ea65ee2d957c8565729a3ff686f893ae2c411a05302e160703aed7fd451b588611dec0a6011404399a5c69d9fcab204724f6f59aafe5b2d906be0d5d1ce8da5d5a85f45a0c6a503d17","method":"","user_agent":"","ja3":"","session":"9cea2d35-cdc6-4095-909e-eaf809fe323f","seq":1,"duration_ms":100,"bytes_in":594,"bytes_out":13,"enriched":{"digest":"c74e40d06abfe834","strings":["eMfS","b0BN?0"]}},{"timestamp":"2026-09-04T06:04:51","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6XZwJ4P-s9Xlz-gHNM","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436585a774a34502d7339586c7a2d67484e4d","method":"","user_agent":"","ja3":"","session":"b50e5aea-b4bc-4a26-b507-6ac742a810a0","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"264b1fa1609f4cb5","strings":["BitTorrent protocol","<FD6XZwJ4P-s9Xlz-gHNM"]}},{"timestamp":"2026-09-04T06:03:39","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���\u001e9|���\u001bս��NC\u0012j��\rZ��/Q��\u0014�[D�`B�밁c��x���2��p�\"\n�\u001b\\�%A��Er�؟��\u0004�4bM1�\u0010$�\u0003�\"Q�L^��xZ���d\u0002W�\u0011��B�d�\u0019r?Yc\u0016#\u001cV�\u001a�>��H��U:�T��\fk��R4�S*I��5�\u0001�<�r�VЍ���.����ъ\b�\rHC[+}t�Mf�r/`G=�n6s���\u0001�����\u0006��\u0007Y\u001c��oE���BŢ\u0001\u0015\u0014}��\u001f7�3��I�^���0��'qn�97F*�60\u001d�k��]oc�.�y�\b��]�0�z�5","payload_hex":"c0bcc11e397c94f8c61bd5bde1be4e43126a86ba0d5a8afc2f519fa714d45b44a460428cebb08163a2b478d0e1b432f1a770d5220ae61b5cae2541e0804572f8d89fa6ee04d734624d31fd10249603ed2251eb4c5e96ea7f785ac5e3d6640257e911dfd34293649019723f596316231c56bc1ab33ecbea4889eb553ad054aabb0c6bfeea5234a1532a49b1b335ab01993c9b72a956d08db0cef92e92b68487d18a08900d48435b2b7d74b34d66a5722f60473de66e3673a0979101d4d5cfe5d406b9d807591cc8df6f45c4e4f542c5a20115147db2c51f37b033be9449b05ef89bdd3094e527716edf3937462a8836301d856b9d875d6f639a2e9879d608a0ba5dec30fd7aee35","method":"","user_agent":"","ja3":"","session":"43c808c3-09c9-429e-9175-8a6e462c70aa","seq":1,"duration_ms":100,"bytes_in":263,"bytes_out":13,"enriched":{"digest":"a29ac5d62bd4863a","strings":["4bM1","r?Yc","HC[+}t","r/`G=","97F*"]}},{"timestamp":"2026-09-04T06:02:28","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6_~TC5f(gLUgxdmcL8","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644365f7e5443356628674c556778646d634c38","method":"","user_agent":"","ja3":"","session":"699ef6d5-bf76-4fe4-8595-d0086ffdca2a","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"108c2442d9022d36","strings":["BitTorrent protocol","<FD6_~TC5f(gLUgxdmcL8"]}},{"timestamp":"2026-09-04T06:01:17","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0015��B�\u000e�7���7�:bтe�\u001e�k�\u0016X�K��#3\u0011��@�+���\u0017\u0004Ӱ���6�5�\u00069�ı4\u000f,\n8���\\�\u0018\u0004��\fH\u001dH��\u001e�!J���l�z��\u000b��Kt�����\u001d5*:�=�_,S���;0�=&\bk��!@)OEبp\u000f&��sX,iؖ��b��n� ���h�\u0001\u0002m}�B� ��:c1�\u001e5�!wU1X��A�X��������S;�#�\u0015\u0001\u001c\u0019��\u000f�,\t�b���kP�9EbX�<;�\u0012\u0016�\u0011G�~�扅�f�7��̎���=8I�f��F���餭�Ո@���c‡(�l�\u0005��\u0007G��i�\u0019o�\u0019�&��yj5���\u0014L%��q���$^ڳ���2F�\u0016\u0014�1��\t\n�Ƹ.22�C\t��}����i�\\��u�F�+����P��1\\\u0016\u0000$��\u0013�g�x!�+T�A\\�\u0003~����~��.d\u0010�\r%�Ԅ��\f��j�k\u0004z���\u001aЬ�gj�X�\n\u000bk0���H��H\\ C\năZ�\u0004S\u001dP3�yֲs!p�=��\u00006\nY8\u0016��|o���\"�zا��%\u000f\u0014�˓W�K��,J9����\u0017�)���!�\f^(\u0005΀w�$R\u0015��A깲/��<)\u000e[io˺","payload_hex":"1580d442d00ebc37b7b3b737923a62d18265f11ef46b901658a04bbd83233311aca240802ba5e8a31704d3b084c0fd36e135db0639aac4b1340f2c0a38a8fb895c951804d7c40c481d489bb91ed0214ac2cae56c817a82b80ba5b84b749087a8b09e1d352a3aaa3dcb5f2c539f93843b30ae3d26086bf0952140294f45d8a8700f26a6b473582c69d896eeb362d2c96ed920fe8bc268bc01026d7dcd42e920f0d63a6331e11e35d72177553158ead741c5589bf4b9e1f78395d9533bd923bc15011c19b58f0f9c2c09fd62e98cee6b50ec39456258c43c3ba31216b41147cb7e90e68985d966e537e7c9cc8eb294d63d38498d669cbc46abd0cfe9a4ade9d58840b281f563c28728b96cfa05dbe80747f9c57f69b6196fdb19b226a39b796a35b59ba5144c25a4c171d0cdc6245edab3b1ee823246c71614bd31c4e0090ac5c6b82e3232804309ac827dfcb3cbd469855cf5e675ec46ff2bb2cedcf950b383315c16002494c913c567ca7821cd2b548f415c91037eb48db6987edaf72e6410ec0d25c9d484c1830cc4f96a996b047a8195f41ad0acd7676aa158a60a0b6b30809a9d48c1db485c20430ac4835ade04531d5033d279d6b2732170c73deae300360a59381694d17c6ff4f49e22d77ad8a7a3e6250f14b6cb9357d24bbac62c4a39b385bb8f17ef29c0c09421b20c5e2805ce8077c824521596e341eab9b22fb9dd3c290e5b696fcbba","method":"","user_agent":"","ja3":"","session":"45b2592c-57dc-4b3a-96f6-7c964924e2e7","seq":1,"duration_ms":100,"bytes_in":520,"bytes_out":13,"enriched":{"digest":"01905b712b6ae650","strings":["!@)OE","sX,i","!wU1X","9EbX","H\\ C"]}},{"timestamp":"2026-09-04T06:00:03","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD60wTzOedI3dGRWr7mO","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644363077547a4f656449336447525772376d4f","method":"","user_agent":"","ja3":"","session":"3ca77c7f-61ab-4712-8a23-7f5d97b10614","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"0348bbf9a3b35886","strings":["BitTorrent protocol","<FD60wTzOedI3dGRWr7mO"]}},{"timestamp":"2026-09-04T05:58:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"P\u0005��\u000f��)\ns�z@u\u0014��\u0012T\u001f`?96B��\u0003��1>G*�E'�����ޏ��9w�x�h�\u0012\u001f\u0018˰<�B5�[T�q����=G��*��:A�\r$�\u0014k����]���\u00181��\u001fG��Yx0����%\".�9�����X9/q�h��T��W\fs��\u0013�0�_�\u0007;�\u001d���x��R⫸7p��3S\u0015E�|��\u000f�\u0000Ղ��?�‡y�\b�7�)�ӂ_���f�Q�+>��=�Pj�{\u0011M��Ԗ{y�ѐ@2y�\b�]���q�_�%5�\u0016:-�tٻ�\u0006^���\t\u000f�\u0017�^{Q�\t�\u0018�t�;p�\u001d�(=�|q\u0004��\u0015H,'r���\u0018K>\t�)sX$}\u0007u\u001e��\u000f�y:^���`�\u0014�o��P~�D�/)߁��/��p\u00143��J߬T�K!ٌ5%��f�\u0004,�\u001e�2�q��+_\u001d�S�K!�����sg��\u001bhi�\u000e��.\u00185Wx��\u001a���D�\u0018�\u0010�\u0017�旬9�","payload_hex":"500588bd0f8bf4290a73fc7a4075148cd712541f603f393642ecda037fae9d313e472abe4527dfc09086abde8fe29f39778478cd68cc121f18cbb03cbb4235b65b54f6719be68ec53d47858c2aa0da3a41d80d24f9146be4a7e8bf5dc7e4c7183190841f4796e7597830b0afa98425222eb839a4aecddedc58392f71dd68c4fb54dcea570c73bad4139730e05ffc073b931dd7faf478e98252e2abb8377083de33531545b97cc1ff0fc100d582bbe63f93c28779ce088137b329d8d3825faab8e766be51f42b3ef6e83dfc506afb7b114d89fad4967b7987d1904032798c08e75d968eb671a95fb62535ff163a2da874d9bb9c065e8cbfef090f8517d45e7b51cc09e018f874e53b70e81d93283d857c7104978415482c27728b94c5184b3e09bc297358247d07751ecee40fbe793a5e8a959c60d214d96ff5c6507e9744e92f29df81b7b32ff5ee701433adb24adfac54af4b21d98c3525fdea66a6042c841ed132ab7186ff2b5f1de153ea4b218ad7e1cceb7367d3ec1b6869b40eabd62e18355778e9e31af988ef44dc18a310ea17ffe697ac3980","method":"","user_agent":"","ja3":"","session":"f15858e2-94e5-4167-8e21-98f91beb6e76","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":13,"enriched":{"digest":"f233344fdf09cc69","strings":["`?96B","1>G*","X9/q","H,'r",")sX$}"]}},{"timestamp":"2026-09-04T05:57:42","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6R~.aay5Su_vfnDSCT","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436527e2e6161793553755f76666e44534354","method":"","user_agent":"","ja3":"","session":"9b4321b1-060d-42d2-80c9-653985164be0","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"6f3e17b26acd76c0","strings":["BitTorrent protocol","<FD6R~.aay5Su_vfnDSCT"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-04T20:59:11.558004+00:00"}