{"ip":"200.3.184.139","total_events":32135,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"32,135 events across 1 port(s)","confidence":"high","network_type":null,"why":["32,135 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 16706s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"24,715,527,521 bytes sent, longest session 16706s","bytes_sent":24715527521,"session_seconds":16706,"persistent":true}},"first_seen":"2026-08-18T13:22:30","last_seen":"2026-08-18T18:00:56","events_24h":0,"events_7d":32135,"geo":{"country_code":"AR","country_name":"Argentina","region":"Buenos Aires","city":"Pilar","lat":-34.4836,"lon":-58.9319,"asn":27935,"org":"Cooperativa de provicion de servicios telefonicos La Lonja Ltda"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":32135}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":32135}],"recent_events":[{"timestamp":"2026-08-18T18:00:56","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���U7�0\u0014\u0010-�\u0004�ݦ\u0002/��\u0003)��=\u000b���\u000e2s$\u0001���̬1��?mE7.U�tW$s�*�/Y�.�f��<\u001a�\u000bdiݽ\u000b�","payload_hex":"bffc8155378f3014102d90049edda6022fc7db03299fe73d0baeb9d40e32732401e99cf8ccac3182e23f6d45372e55b074572473e42aa02f59f22ed566e6ed3c1a960b6469ddbd0b88","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31518,"duration_ms":16705792,"bytes_in":1476371,"bytes_out":409686,"enriched":{"digest":"ca06402fcde2a763","strings":["?mE7.U","tW$s"]}},{"timestamp":"2026-08-18T18:00:54","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�A6:��\u001amG��c\u0006�[�nf%�R��\n��\u0019��Z$I�\fu��g\"\u001f�s\u001e�e��I�","payload_hex":"ed41363ad1c41a6d47e6e26306b75bb36e6625a252aed40aac8b1998ac5a2449f10c75b28067221fca731ee065f5cf49ee","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31517,"duration_ms":16704127,"bytes_in":1476298,"bytes_out":409673},{"timestamp":"2026-08-18T18:00:53","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0013Ny\u0011hv1uQ�N�9rE���K\u0002z�Y����EC\u0018�\u0010��\u0013","payload_hex":"ee134e79116876317551b24ed43972458687ec4b027ac97f59e8b5e0f0454318e510efad13","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31516,"duration_ms":16702978,"bytes_in":1476249,"bytes_out":409660,"enriched":{"digest":"3044791a85a07bef","strings":["hv1uQ"]}},{"timestamp":"2026-08-18T18:00:53","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\"|j����\ne�J\u0012����!*�lUq�{F","payload_hex":"227c7f6a88f0bcbe0a65ea4a12def5a0f2212aaf6c5571b77b46","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31515,"duration_ms":16702557,"bytes_in":1476212,"bytes_out":409647},{"timestamp":"2026-08-18T18:00:52","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ŏ[��\u0002\f","payload_hex":"c58f5bd3f9020c","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31514,"duration_ms":16701905,"bytes_in":1476186,"bytes_out":409634},{"timestamp":"2026-08-18T18:00:52","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"[\u0001\u0006�A��̏\u0017�c�s\u0012�u��\u0003�`�e��\u000b}���[Jr<\u0011�v��er\u0004e�o\u0003a�","payload_hex":"5b0106db41d7ddcc8f17a563b07312b07583a9039460b765e0c00b7d86b4d45b4a723c119576e6a365720465a46f0361e9","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31513,"duration_ms":16701517,"bytes_in":1476179,"bytes_out":409621,"enriched":{"digest":"af5c94b8cc95d285","strings":["[Jr<"]}},{"timestamp":"2026-08-18T18:00:50","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013��d\u001ew�\u0017\u0018{�/�\u0004��>�'ڿ�\u0006_ł�","payload_hex":"138cb0641e77ea17187b972fdf04a5da3e9e27dabfd1065fc582d9","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31512,"duration_ms":16700218,"bytes_in":1476130,"bytes_out":409608},{"timestamp":"2026-08-18T18:00:50","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u001bB�\u000e�B�","payload_hex":"ed1b42d10e8542fc","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31511,"duration_ms":16699790,"bytes_in":1476103,"bytes_out":409595},{"timestamp":"2026-08-18T18:00:50","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\\\u001d��\u0016$�f׉\u001b7\b���,����ĺ","payload_hex":"5c1dfd891624f666d7891b37088e9e912c8983fdabc4ba","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31510,"duration_ms":16699655,"bytes_in":1476095,"bytes_out":409582},{"timestamp":"2026-08-18T18:00:49","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"[\u001e\u001bzZ����\tK","payload_hex":"5b1e1b7a5ab0fe99e7094b","method":"","user_agent":"","ja3":"","session":"5705f14f-30a3-4283-92fe-a6b777df9c9a","seq":31509,"duration_ms":16698924,"bytes_in":1476072,"bytes_out":409569}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T00:32:35.596908+00:00"}