{"ip":"200.68.167.210","total_events":1160,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,160 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,160 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"245,435 bytes sent","bytes_sent":245435,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T22:35:48","last_seen":"2026-10-05T19:34:52","events_24h":353,"events_7d":1160,"geo":{"country_code":"MX","country_name":"Mexico","region":"Quintana Roo","city":"Cancún","lat":21.2494,"lon":-86.8379,"asn":28403,"org":"RadioMovil Dipsa, S.A. de C.V."},"source_domain":"movil-200-068-167-210.itelcel.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":39131,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T17:37:28","last_seen":"2026-10-05T17:37:28","recent":[{"timestamp":"2026-10-05T17:37:28","port":39131,"src_port":20952,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000ar\u0004�vt\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000T+\u0000\u0000","payload_hex":"41006172049c76740000000000000000542b0000","sni":"","session":"e7aaa762-f259-4d47-912c-8a1c231b4790","bytes_in":20,"source_verified":false,"enriched":{"digest":"1b9e50aa3e0551ad","strings":["vtT+"]}}]},"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1160}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-01","count":24},{"date":"2026-10-02","count":320},{"date":"2026-10-03","count":207},{"date":"2026-10-04","count":322},{"date":"2026-10-05","count":287}],"recent_events":[{"timestamp":"2026-10-05T19:34:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6y7AJldxd~jnD9E6s*","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644367937414a6c6478647e6a6e44394536732a","method":"","user_agent":"","ja3":"","session":"73749fba-8e60-4955-99c8-0c7027609323","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"3802d2a4c41e6428","strings":["BitTorrent protocol","<FD6y7AJldxd~jnD9E6s*"]}},{"timestamp":"2026-10-05T19:33:38","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018L�;n�!�\\x����;�rZ�z\u0018���u����\u00128\t�)�L\u001f\u0011�g��\t��L\u0014u���z��?:#�l\u0002�-ع$A��\u0015����kW�w�Ū����\u00129��[�\u0002��:�\u000b�P�X'�6���\u001eQ�㢈ݭ�r��\u0003RJN�+1ރ۠\u0004<�eMI��إ��\u0018۶nx\u0019","payload_hex":"7f184cdd3b6eff21cc5c78b68abffd3b8f725ae97a18dee3e47585fab4f0123809a6298d4c1f11f667afe809899e4c1475aee7cf7abcc77f3f3a23e96c02c72dd8b92441ccd115e0c09caf6b578977bdc5aaae8bb6d8123994ca5bc602e8e23af90bef50ae5827d336bd9afe1e51b0e3a288ddadd872929e03524a4ef42b31de83dba0043c9f654d498782d8a5a6a818dbb66e7819","method":"","user_agent":"","ja3":"","session":"213cb772-adc6-4ef4-bac2-bf280ba02261","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":14},{"timestamp":"2026-10-05T19:32:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6Dh7kgHdnsP~bqR6jd","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644364468376b6748646e73507e627152366a64","method":"","user_agent":"","ja3":"","session":"90ae1d40-ab2c-475a-b6f0-fde8f9eed838","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"6e6a208940a3376a","strings":["BitTorrent protocol","<FD6Dh7kgHdnsP~bqR6jd"]}},{"timestamp":"2026-10-05T19:31:02","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���\u0007�\u0016�wR�LF5-#��0�DP�R��*z]�z\u001fPw|2g�\u0006��|\u001a͹H�:�Ϲ W���C0�A��\u001dE%�j�ʵ��{�hvC\u001b\u001c)KqDW��Cģ��\u0007>�{\n+�D���;�\u0001��z\u001d�\u0002�6l(5�����\u0015(A/�`\u0016\u001b5Aj�A7�Y�*��1k v!h\u0005�M\b8xh\u0014~�XP�Uy�\u0006-�\u001d�c��-9����VD�4ͨ1��\nՙq=�\b�lt�j���&r�9�\u000e�\u0007\u000bA\u0004��\f\u0018ֽ�\\.M�r\u0014��G{H��ǎ\u000f#+\\#\fu<T\u000e�8�J$p�}\u0004�Q���k\t+%���\u001e[b�W%d\u001fUoeZ���\u0017���\u000fr>�+�\u0015W\u0006{f�����yA\u0015z\u0000\u0018�#;����\u0011Q\u000f����?��T�9���짆w)�\u0018a\u0016��g�\u0019��p�@\u0002�ɕ�\u001f�j\u0013�K_\u0019`\u001aΆ.��Q��}`�����;��7[���fhm\u0004��\n�x'P\u001e1�Y�k�T3�P[�ل������\u0017������FP}శ�C�H�\u0004d)�8R��c","payload_hex":"9480f607cb16817752814c46352d23eac9308d4450a452f7af2a7a5dc97a1f50777c3267e406f4b77c1acdb948e13ae3cfb920579adbec4330e7419ee61d4525996ac3cab5e4fd7b8d6876431b1c294b714457d8e343c4a3b4f2073ed57b0a2ba044f5bfda3bed01a5827a1db80282366c2835f0e5a5e9bf1528412fd760161b35416af04137d359d52a93ac316b2076216805c84d08387868147e995850b25579a6062d951dc66380912d3999bb958c5644e134cda8319cd50ad599713d8808e86c74e36a9cf4ae2672fc39f60e8d070b4104aab40c18d6bddc5c2e4dbd7214cfe3477b48b399c78e0f232b5c230c753c540eaf38b34a2470cd7d04d0519e9ddb6b092b25839fb91e5b62b05725641f556f655ab4f8ac17b8d6d80f723ea62be41557067b66c6e7b5e8ad7941157a0018d6233bb4b58cbe11510f84afd7ed3fadea549b39888ffdeca7867729e01861168baf67c619a6f270b1400282c995bb7f1fa16a13964b5f19601ace862ea7fc5180eb7d6090a287b5aa3b9cd1375b8b959b66686d04dcf30aa37827501e31bb59876be05433c5505bd9d984dcfafebfe2dd17a7bdbbfa90d346507de0b0b68e43f448ef04642982385287d363","method":"","user_agent":"","ja3":"","session":"a361ab15-5ae4-4b96-972e-7d14661fe8a2","seq":1,"duration_ms":100,"bytes_in":445,"bytes_out":14,"enriched":{"digest":"822c7c55591ac71f","strings":["LF5-#","Pw|2g",")KqDW","6l(5","1k v!h","UoeZ"]}},{"timestamp":"2026-10-05T19:29:51","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6zMebPToC-Ez*8JOx~","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644367a4d656250546f432d457a2a384a4f787e","method":"","user_agent":"","ja3":"","session":"f58f4f28-05fa-443e-a8c3-4e83bf8bcf50","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"56e1cd25b1a31326","strings":["BitTorrent protocol","<FD6zMebPToC-Ez*8JOx~"]}},{"timestamp":"2026-10-05T19:28:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"D��WK\u0002\n$�\\[�����gD\u00188�\u0003(��̸���H�\u0010%�\u0004��\u0017v�M\u0001\u0010\u000e3��\u0019\u001b�\u0004��@����\u0011�>�V=�oz�g�\u0012̛\u0005\f�������\u0005�x_tjYㅂ��xH^l\u001c�Q��6��aU���j����C\u0016j��q��D�7�ss���\b�\u0013.�/}n��K��\u001ad��\u000b\u0005\u0015\t�q��i_-���[\")�JNhw$��\u0002^ܮ���\b!oMz�2Y9�ܓ\u0016�)2�~!e\u000f���3K0�L���K5�1-�I��F�","payload_hex":"44e290574b020a24dd5c5b81b38ffbfe67441838b70328ae96ccb8f8a98048e31025c104d7e61776964d01100e33b989191b9a04c6da408aabb8fe118f3efa563de86f7aab679012cc9b050cb8bbc7e8bbedab05d3785f746a59e38582869778485e6c1ce651a6b236ea856155d9cac86aa5e2d1db43166ae9ca71e38d44e037f97373c5cff508f8132eb12f7d6ea5fc4babd31a6489b20b051509937182e5695f2d92f4b05b22298d4a4e687724f6a7025edcaea3ddf708216f4d7a8e325939c1dc9316b02932f47e21650fac8fa4334b30dd4c9d929c4b358c312da949f09d46c2","method":"","user_agent":"","ja3":"","session":"14f6412b-2cc9-4425-a836-2ac3fea61dac","seq":1,"duration_ms":101,"bytes_in":226,"bytes_out":14,"enriched":{"digest":"9b4e1d2cc88d7bf0","strings":["x_tjY","xH^l","JNhw$","!oMz"]}},{"timestamp":"2026-10-05T19:26:40","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6_iXcFq-HmHpDBadDP","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644365f69586346712d486d4870444261644450","method":"","user_agent":"","ja3":"","session":"d09e2db2-ac24-48ad-bfa4-71552b66d67f","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"d1576c1395fdcdca","strings":["BitTorrent protocol","<FD6_iXcFq-HmHpDBadDP"]}},{"timestamp":"2026-10-05T19:25:26","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��]�v�\u0011iɇIR3�3�Δ���T\u0017���1C�@�\u001c�}�?��F�\n\"��v�!\u0003\u001c\u0004�\u0012x\u000f�fR}��}\u001c�\u0014��)�ksU)YU�0)��\u001bZ\u001a\b\u000f���d\b\u0000P����`�\u0017�ɷ�>�!Y�+��r'ͻ���I/���Y�bo\n:w���0���8)TC�����c�\u0018\u001cq]���6,�����U\u0012��L��/��F���\u001c�Qе$�K���^��\u0007��\"�\nӒ��5o�\u0004�}�,t�C{I�f\u0007gq��","payload_hex":"bbd45dfe76cf1169c987495233ac3390ce94bec6d85417f093c03143b240bd1ccb7db13ff7bd7f46f10a22fea076a421031c04d212780f8266527dc1fd7d1c9114c1aa29f56b7355295955ef3029bbe71b5a1a080fe5aac664080050918ffeab609717c9c9b7ad3e912159912bab9e7227cdbb9ae1fc492fa09f8f5996626f0a3a77aac08a30eeb9dc38295443abc7f1a1db63e2181c715da9beca362cf0aff4e3835512bfb34cf88a2ff2f846b8abbc1c9c51d0b5249d4b84b2a15ebe9d0793a022e60ad39287aa356ff004f87d862c74db437b499066076771b2e4","method":"","user_agent":"","ja3":"","session":"4f17f109-8dc3-40c0-ae4e-515a86508eb8","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":14,"enriched":{"digest":"10312d43f11707ef","strings":["ksU)YU","8)TC"]}},{"timestamp":"2026-10-05T19:23:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6D~SYIQ955Olb(2_)g","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436447e535949513935354f6c6228325f2967","method":"","user_agent":"","ja3":"","session":"98916e75-0d8f-4d91-8bea-a75c6ae978e4","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"6cec1d55fab5c13f","strings":["BitTorrent protocol","<FD6D~SYIQ955Olb(2_)g"]}},{"timestamp":"2026-10-05T19:22:46","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���T����|�J�B˩�aV\u0006~f�\bK\nP�8�0���*�>-��~r9�ʴ\t�b纚�ZK\u000f���%_�\bӥ�\u001d�\n�ߴ碩<\fg�h�JR�K���\\�?\u001ee;URZ\u0012k�h��\u001c>繸X�\u0001�\u0011<\u0017e�[����j��\u0019�Ǯ�A��9�o�F&y�t>�PFp&��\u0002\"x�zU�^��\u001aJ\u000e{��c���(C_\u0006}�֙��D\u000e\u0006Ҿ3I\u000e\b�\u0006�\bF\u0015\n\u0019��LO\u001eI�x�\u0002�\u0013��P������Z�\u0016*�&�O=�D�|���\u0003�A����^5���I��\u0002\u0018\u0017h��=\u0001n��=���V�^ݮGKk��:bp��_�Ų\u001c}DT��ýBS�U=","payload_hex":"9fb1c254f7f49db27cf84ae042cba9de6156067e669f084b0a508838c93094e1da2add3e2df9847e7239ebcab4098462e7ba9aa85a4b0fbad6ef255f8808d3a5fb1dcf0ac0dfb4e7a2a93c0c67a3687f954a52e04be4bad45ce03f1e653b55525a126bbb68818a1c3ee7b9b858b701d3113c1765e75bb3fb9bcd6af4df19aac7aed641bba839866fcf462679ba743ecd50467026feaa0222788d7a55ba7f5eade61a4a0e7bf7b463ced7e828435f067df1d699f6e7440e06d2be33490e08ee06c50846150a19aed04c4f1e49fa789102d913e0ae50a1998b83e2fc5a8a162afd26874f3dea44c47c7fd2cafc039b41a1a7e08e5e35afbc9149c0bb02181768fca13d016ee2973d81f9b656c95eddae474b6bbf833a6270c3d15fa9c5b21c7d4454f4a9c3bd4253b6553d","method":"","user_agent":"","ja3":"","session":"5ade231d-c466-4ef6-bf52-4ab06799cb8e","seq":1,"duration_ms":100,"bytes_in":298,"bytes_out":14,"enriched":{"digest":"06cf5d58cd61f841","strings":["e;URZ","PFp&"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T19:36:18.858988+00:00"}