{"ip":"200.68.167.27","total_events":969,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"969 events across 1 port(s)","confidence":"medium","network_type":null,"why":["969 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"200,268 bytes sent","bytes_sent":200268,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-15T10:13:56","last_seen":"2026-09-29T23:33:18","events_24h":0,"events_7d":77,"geo":{"country_code":"MX","country_name":"Mexico","region":"Quintana Roo","city":"Cancún","lat":21.2494,"lon":-86.8379,"asn":28403,"org":"RadioMovil Dipsa, S.A. de C.V."},"source_domain":"movil-200-068-167-027.itelcel.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":39131,"proto":"tcp","label":"","count":969}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-15","count":1},{"date":"2026-09-13","count":1},{"date":"2026-09-20","count":98},{"date":"2026-09-21","count":191},{"date":"2026-09-25","count":330},{"date":"2026-09-26","count":82},{"date":"2026-09-27","count":136},{"date":"2026-09-28","count":35},{"date":"2026-09-29","count":95}],"recent_events":[{"timestamp":"2026-09-29T23:33:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6QxgjEYwKoJDQ~XNwB","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644365178676a4559774b6f4a44517e584e7742","method":"","user_agent":"","ja3":"","session":"ae11213d-8af0-4da2-af86-1c8f89945b5a","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"5ab11b8a7adfbc6e","strings":["BitTorrent protocol","<FD6QxgjEYwKoJDQ~XNwB"]}},{"timestamp":"2026-09-29T23:30:40","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"c��\r4�\u0000<\u001a\u0005�o�\u001eKq'R>�#8h�\u0005�u�@Mk�klN��b�\u0007�5i��L�z֑h\u0016VՑ�B�G�\u001b\u001a�'���~��z3M��4�uQ\u001a\u00004�>�ۮ�O&&�I�\u0019+\u0010�uw��\u0013��œ@%-�\u0006 ���?]��<�\u0001^Kq&�D��\r`�י#кˏi�3�i��\u001b�1��H\u000f����c�}���\u000f�hD�*�|�t\u0003O6Z��\\r�\u0012V���D\u0014y0z�&�\u001d�\u0016�W\u001b�\u0012O�.i�\t��k:�\u0003�+��V��Y��*g2���颈!\u0006��\u001b�w�(�b\u001a)�!��{\f4q��E��h9[��aU�N\u001d&-$K\u001f{�ix�:w\nv�\u0014[�m�=�2%~�#�~�!�Su\n\b�Qk<cPH&\u0017X�o\t��\u001b&,i\t\nb��$�G�\\p���`0V�\u0000���W�\u00108�B���1\u0005���Xv�ei�_���c?Ŝ%d�\u0013\n\u0014���q<Z�iU�\u0013�C�j�6�h\u0018}བ���0��\u0001m�HV\\~�i}���>�,~+�9��6��@�\n~c��$���D�3�\u0017t&UG4o��!�Cl�\u0007\u0010��\u0000t�߆�#�q\u000e���dk�V� Cx�,\n��2ؾ\u0007/�ɍ��\u000b&��K�\u0003�'�\u0002�Tx�\u0000j�JO�k}9i*\u0001��h\b�S��N\f�8n��ΫƑ�N)�-�\u001c\u0003�F��%3PTT���\"\u001f;��qf��\u0014�a��͔�~T","payload_hex":"6395c40d34a3003c1a05f86fea1e4b7127523eca233868e2058a7584404d6bb56b6c4ef0d562ce07e63569fc874ced7ad691681656d591e542ff47ea1b1ac327c1fdfd7ec8cb7a334ddecd34e275511a0034aa3eb7dbae994f2626d549a1192b10b67577ecb2139fb1c59340252d880620b0fdda3f5d81fe3cd6015e4b7126d7448b8b0d60c6d79923d0bacb8f698133ec69a9c31b81318388480ff683f1ee63d07de2f7b30fbc6844b42ad67cc974034f365a95de5c72a612569c9fe9441479307a8f26f81dbb16ef571bb3124fe82e698809fff86b3ace03f22bedd856adcc59bcc52a6732fab1b3e9a2882106b0eb1bda77e428bb621a299421edfe7b0c3471efef87a1f245f99e68395be1a96155f34e1d262d244b1f7b946978e23a770a76ab145be36d9d3df632257ed423e77ea021ca53750a08df516b3c635048261758916f09948e1b262c69090a62d4c8248f47c05c709eb5ce6030569c009ae5fb57a21038c142f8b2af31058fd9ce5876bc65698d5fc4c181633fc59c2564d4130a1492ace6713c5a806955ed13c743d76ae536cf68187de0bd96d7e9f530a591016dab48565c7ecb697d96c8f83e9e2c7e2bde39fec436badb407f9a0a7e63b7f924b697de44f233ca1774265547346fe6ef218d436c850710e9f20074e4df86db23ee710efafeae646bf456b6204378a72c0aa7d132d8be072f95c98d83fd0b2689fa4b9e03d627a7029e5478f1006aed4a4fd26b7d39692a01e4f26808965389c94e0cb0386e8df7ceabc691904e29fd2d821c03c8469fad2533505454dcead1221f3b9ca07166e8f3149561c4c6cd94d07e54","method":"","user_agent":"","ja3":"","session":"0016731c-5145-4ed1-a960-df1e3228c121","seq":1,"duration_ms":101,"bytes_in":596,"bytes_out":13,"enriched":{"digest":"81fdb56715740497","strings":["Kq'R>","^Kq&","&-$K","Qk<cPH&","HV\\~","t&UG4o","k}9i*","%3PTT"]}},{"timestamp":"2026-09-29T23:28:18","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6SOLamor*X_NeCi4Yw","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436534f4c616d6f722a585f4e654369345977","method":"","user_agent":"","ja3":"","session":"1816a7fa-0562-48d8-9be7-220ee3a40eb3","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"de9d9ab16d337683","strings":["BitTorrent protocol","<FD6SOLamor*X_NeCi4Yw"]}},{"timestamp":"2026-09-29T23:26:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"&��'\u0016�[��P�hG\u001e�%\\��!\"}�\u001c��h�\u001dM��,�A�\r�=\u0005��\\\u0012o\u0017\u001e�V\u0013�n�\n�s�,��@)�y��:�l��> }*\u0010�����@�˲\u0002^�\u001aQ��{#�(�+�\bq�_�?�5ޱş���\u0005\u0016p zy��1x\u001d��bw�\u000bT?%\u001bV��\u001046*<���\\{��F��Ź�","payload_hex":"2688832716a95bf98a50e668471ed0255c8a9621227de91cf5f068971d4deda12ced41c20de13d059b915c126f171ea95613d96eba0ae873bd2caa8f40299d79e3863afc6ceb8a3e207d2a10b6b6ebdbd14081cbb2025ec11a51af827b23d628862bdd0871fb5f8d3fae35deb1c59ffeb5ae051670207a79b3a231781deead6277880b543f251b56ee9f1034362a3ca1afe95c7b8caf46fef3c5b9f8","method":"","user_agent":"","ja3":"","session":"67bee1a2-76fe-44fd-a2b8-5be701b4802f","seq":1,"duration_ms":100,"bytes_in":156,"bytes_out":13,"enriched":{"digest":"a41ea14b7918e37e","strings":["p zy","46*<"]}},{"timestamp":"2026-09-29T23:23:47","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6Un6L(37bzCVhfs5qM","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436556e364c283337627a435668667335714d","method":"","user_agent":"","ja3":"","session":"32512b08-1ee8-4c35-89a9-b7dfc8dd7947","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"dc4c932964ad84b7","strings":["BitTorrent protocol","<FD6Un6L(37bzCVhfs5qM"]}},{"timestamp":"2026-09-29T23:21:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�]�;$f*�\b:��ý=\f뗛��V����LE���$\u001dI\u000f�\u0001�7��ĕ^�\u001d^����.\u001bT�5j�*\u0005\u0006ṆCv�h\u001e��6����\u0018\u0007\n��(-��CN��H\u001fe���\u001b��egQ��n���ƧD�5\u0015����/���M�.j+\u000b�o2^\u001e?�!܁d���\u0002L\u0007d;z�\u0000���LE6δ\u0004u��%P�~R��\u001e$g3,\u0006��X�\u0012U��\u0004;(Xw���lE�9\u0013\u0007�\fJ`qR�T�'�\u001a~��9���\u000f\u0007�W�����l�o�\tM���pr\u001e��g�)���Τ�6�kz�\u000e\u0006\"<\u0019�j�\u000b\u0014�6/8\u0001B�e^B�X2\u0018Ƿ�=!D�\u001e�B>E\u0019�zl8H\u000f�>�\u0015����{�w+L���+P}t��x���)�\u000f\\\u0001�v��-y�ȼ�\u0000\u001e�5�U��s��7�\u0001���\fxg�\u0007x{�Iɹ�j�!8\u0001�*9\\�VVDYp4�����`�<ri�U�P��\u0005\u001a��4�g��\u0001����[\u0011�U��T\"�˽�$.��`�>�:<r\\�fO��d���8-���\u000b��+�/�I�L�t�Pb�Ҵ�}�t8��w~1�j�_����߰.��[�!tlK\fw\u0011W�����d\u000f��T�但�a\"3T\u000b�>�\u0000�\u0010}Ti\u0019k�\u0001�\f�t�L�MfR�\u0001\u001fD�\u0014�9����X�֟\t�","payload_hex":"af5df33b24662adc083aebeac3bd3d0ceb979baddb568f96e2be4c45a2af81241d490ff301dc37e8b7c4955eb91d5eb3bbf3f32e1b54ea356ab12a05064ecca343769c681efde836e1f3aefc18070a8dde282d88bf434e84d2481f65dced9f1bee966567518bcc6ef098bbc6a7448d3515aeaa89812faac3f44daf2e6a2b0bc66f325e1e3fcd21dc8164d27f9ec8024c07643b7ad900bbbfe44c4536ceb40475d1c62550ac7e52bb861e2467332c06e09a58c71255e8b1043b285877a98cf56c45d9391307e80c4a607152a954fc27b61a7ee6ce39eff5b90f079057f68eb28fac6c9c6faa094db4dcfc70721ef29a67ef29edfbc3cea4d736ce6b7af60e06223c19a06ab50b14c9362f380142ee655e4285583218c7b7893d2144901e83423e4519ff7a6c38480fc33ec01596cdeed77bb3772b4ce3eaa42b507d748dca788beafd29ab0f5c019376ebc52d7981c8bc80001e8a35ec55cdf873eec237d701b0f3b00c7867eb07787bf049c9b9956abc213801af2a395c8d565644597034a5efd8f0bd60ba3c7269a055b050e4f5051aaea934d867b9a301b0a9bdb05b11d9558db1542289cbbdae242ec9f760e13eec3a3c725c88664ff08b6496b8b0382dd1e4e60bc6f12b8d2fb149e74cd174f050629fd2b4d77dc974389bfb777e31e56ae75fe2b0eddadfb02efe895be121746c4b0c77115789bdf5ece9640fe7fe548de4bd86ea612233540b813e7fde0092107d5469196bcc01dc0ca974954cbb4d6652a9011f44ae148839e7e2a0fc58a6d69f09de","method":"","user_agent":"","ja3":"","session":"388a9ced-ef8d-4382-aa89-5f58b601a49e","seq":1,"duration_ms":100,"bytes_in":563,"bytes_out":13,"enriched":{"digest":"8a8aebaae72bd40a","strings":[";$f*","$g3,",";(Xw","J`qR","zl8H","+P}t","VVDYp4",":<r\\","!tlK","a\"3T"]}},{"timestamp":"2026-09-29T23:19:23","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6Alray).!sE*N~ljYF","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c464436416c726179292e2173452a4e7e6c6a5946","method":"","user_agent":"","ja3":"","session":"aa47a685-c479-4a35-883c-7ed4ed61d9f4","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"d520363fbfcd20e1","strings":["BitTorrent protocol","<FD6Alray).!sE*N~ljYF"]}},{"timestamp":"2026-09-29T23:16:43","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"2q�-\u001c��ׂ���d\u00067�A�y7�s�\u0004Ֆ�\u0016k� �#W,��2܌D-������������C\u0014\t�>`\u000b�?U% �P�-�SQ�|x�C���ˀ�%��\u0005�O\bi�\u0013*͐��*�@�\u0001�0\u000b\u0000!\u0010c��9���?���-���b�o�c>�%�v\r$t��\t\u001b�Hhj�ʫ��o\u001a\r��vdMJ�a]4�,y$;����kީ���[�T�%�&�4�\f��","payload_hex":"3271a12d1ccad3d782adf2ea640637c241d3797f37b173dc04d596a0166bc020f623572ca1f832dc8c442dfdfeb8eec4cffba0e4f9bff84314098a3e600b9e3f552520ae50dd2d995351fe7c78aa43a4ae9dcb80ed25f1fb05e44f0869c5132acd9081fc2aca40d701a1300b00211063eeda398a87ff3f8de7d72de6f89d62e66fc2633e842588760d2474c2fa091bad48686aa5caabb2c66f1a0de1b576644d4ac7615d34ef2c79243ba2999fe86bdea9efa8f05bab54cf25c826b5348a0cb2f3","method":"","user_agent":"","ja3":"","session":"db145b1f-5657-4537-b84c-54191b6ce8f7","seq":1,"duration_ms":101,"bytes_in":193,"bytes_out":13,"enriched":{"digest":"cfdbc5151c1b0056","strings":["vdMJ",",y$;"]}},{"timestamp":"2026-09-29T23:14:30","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<FD6ixVCAdppW(a8cdI)1","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4644366978564341647070572861386364492931","method":"","user_agent":"","ja3":"","session":"1a948c73-a7ca-4952-988a-78475deed69d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"27f9595fd4b294d4","strings":["BitTorrent protocol","<FD6ixVCAdppW(a8cdI)1"]}},{"timestamp":"2026-09-29T23:12:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���� �j�tq���6h�07��\u0011�{_�����i.�\u000e\u0005Kd��ϲ��2���%\u00111^m������Q{�p\u000f���ᔴ\\�xz6�mB,��ws�`�� �L����bA��~!���5��)�E2�g��\u0000ߝZ�\u0005w�{��5\u0003�\"�\u001c%S�7�����\u000fc\u0019��Bղ*C\"\u001a�Ѷ�������]����j�F����0\u0001�[U�Q�ib��3\u0007\u0002\u0005��\u001b0\u001d����-2!�V\u0006�|4PD���I٤�oY+�)�]\u0003jR&�O`s�i�a���6��\u001c��lOv�*,��� ���4��D\b<i�N��z�l𙸽�k\u0016�O\u0000�\tö\u0003҅�\u0013�b1�G��(�j=\b\u001d���l��\"Y��L\u0013\u000e�(N/r��kE�\u001a�bԑ��F=&(R�\u0016��\ty[W\\O葉��UhJ\bA�/L,z\u0000иf�\u0002��� \u000f9���[��\u0018O\u001b�\f�j�����0\"Q\u0015�sz8ذo���N.��Ưb\b\u000e\f�c��-[g\u0019�t���?Oo&cC[�\u0015\u001d�\u0019��G�u6��r��TU���","payload_hex":"e0f286b120c56aaf7471f694fe3668db3037aef611927b5fab9d85979e692e8e0e054b64afebcfb2c2c032c199ce2511315e6df3afedf89bdd517bb0700febcccbe194b45ca4787a36c66d422c8bb77773bb60caf420a64cbfe4d9da6241b9c37e219691de35f19929f74532896788fd00df9d5aeb0577ea7be8cd3503cd22a51c2553e037faf4c3d2ff0f6319b0bc42d5b22a43221a84d1b68eaf99979895b35db5b1a1dd6ac046bc80a3f43001ab5b55f551c6696282f033070205f8c81b301db1ae9ce82d3221e95606ed7c345044eacaf449d9a4f16f592bed29b95d036a5226904f6073e769f661a48bb136b0e61c83c36c4f76a22a2ce681fa20c8c8db34aec244083c69834ea1f87a9f6cf099b8bdb56b168e4f00c309c3b603d285c213926231db47f6fa28b16a3d081d87bfb16ceafc2259f1b84c130e82284e2f72e29f6b45e21adc62d491f783463d262852b116cfeb09795b575c4fefa5aed3fc55684a0841992f4c2c7a00d0b866a802f5c6eb200f39a4a1bb5bf89d184f1ba50ce46ac1bff6a0bf30225115c2737a38d8b06fc9ffcf4e2eecf6c6af62080e0c8363b4f02d5b67199974febb8c3f4f6f2663435bbc151dec19fdbd47b77536f8fe72a2b55455d5c2f8","method":"","user_agent":"","ja3":"","session":"267c85f5-5b72-4df7-9d44-f50006bbb029","seq":1,"duration_ms":101,"bytes_in":457,"bytes_out":13,"enriched":{"digest":"96c1fbf29a829c6e","strings":["|4PD","(N/r","F=&(R","y[W\\O","/L,z","?Oo&cC["]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-06T20:36:30.126786+00:00"}