{"ip":"201.173.65.55","total_events":1431,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,431 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,431 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"295,889 bytes sent","bytes_sent":295889,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T06:05:14","last_seen":"2026-09-08T17:15:06","events_24h":0,"events_7d":1431,"geo":{"country_code":"MX","country_name":"Mexico","region":"Nuevo León","city":"Apodaca","lat":25.793,"lon":-100.253,"asn":265594,"org":"Television Internacional, S.A. de C.V."},"source_domain":"201.173.65.55-clientes-izzi.mx","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1431}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-07","count":887},{"date":"2026-09-08","count":544}],"recent_events":[{"timestamp":"2026-09-08T17:15:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O��\u001b�\"�\b�","payload_hex":"0fbb804e25b3a8b4629ce73c43bd8d9242dd7460c849e1c9325b3737f1f756eabd5c0c85737e0228a3a7198b877cc22afd19fcb89ab23aaf11046ebe5c85e5382293c0db17154411d9934f79b3064817689cb3fdb98d01c04533dcae03b4d732b00b4075e55bff4ca43ff8dc20bfd708beaa502ac2925a184a0715878cd08fd8ae801f963551d5ed3673f4dd2be62f4980c68ffd54933430f8237399a3bf88a5ac76efd0c389e21cc3fd371d07261ec5cce0bc5e269ab65bc0c875e86200d71ba384b60cc9a932c17ab77d4cf2eb8ada8e896cb35dc695f9ba460b7d7c4841e5b9799553e240e14b5de313df5670321b57567b8f2eaf5683fb7b4b3ed51bc122ee08a0","method":"","user_agent":"","ja3":"","session":"45fed166-f5a3-4f48-aa4c-120a7fd3cf25","seq":1,"duration_ms":100,"bytes_in":259,"bytes_out":13,"enriched":{"digest":"c7daf0a05b7be3f8","strings":["2[77","}|HA"]}},{"timestamp":"2026-09-08T17:10:38","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�0\u001a1{֋\u001e'�W����^���d��\u0000���~������'z��8@#\u001c�Ս\r����r�k��½Ҳ\u0000��)���L�\u001cH뙺��nC����*ꛋ<����~\u0012\b|������-'4�}���^ם \u0010\"\r�-��;\u0017a<�Rh�>���\u0006蜩�\u0003~\u0017��\u001c���\u001c}\u0004a3@�\r�s~\u0004(l\u0018p�*�����8|\u0018�goq��~-`:\u0018H>-Υ�6^X��̩%�\u0014;�\u0010�T���.\u0004~�ġ��0��gT\u001fMfQF�\n���=���\u0015��+\t�\u000elӌL\u0003�<���{\"����\u0006\u000b����-\u0014�@�ohG.���9���\u0016m�栻2��j�XF\u0011��Aw,����v�\u0002��'�T�u0,��_\u001a������7��\u000bu���Z�K\f\u0001$\u0006�4�3e%m)�\u0003e�1�(j{\u000e5��ELQ8��޿ \u001aeq\u0006�-��5\n��.�I�u�L","payload_hex":"065d1e69a9e74f432e3e301a317bd68b1e27eb57fcba9f825ea3c2d164bf8200b0f9987ecaf39381f4f5277a90e93840231ceed58d0daeacfce272966bcaf3c2bdd2b200ed8329b8a3c74cb21c48eb99baac8a6e43f88095a12aea9b8b3c8da1aede7e12087ca7e7e0fba0a02d27349b7dfeb9bf5ed79d2010220dce2db9c23b17613c965268fa3ed3fe9a06e89ca998037e17c2dc1c9ad6c11c7f7d04613340e40dd4737e04286c1870cc2aa7c8c0a78a387c1897676f719cd37e2d603a18483e2dcea5eb365e58d1dfcca92580143bb510dc54a48e9d2e047edbc4a1b18530ba8967541f4d665146ca0afeb1c33dc1dcc11597f62b098a0e6cd38c4c03fe3ceeff917b22febf94a2060bc5d6ffb32d14f340b86f68472e9692cc39f492b7166d94e6a0bb3298ef6af65846118ae441772cb296e0b176a702d6f1278554c375302c82ab5f1ac7c4d5dde0c337a9e40b75c1d8e65ac84b0c012406ce348a3365256d29d70365f1319e286a7b0e35c1cc454c51388ee1debf201a657106c32dd7c1350abfc02eaf499775a84c","method":"","user_agent":"","ja3":"","session":"b323cabd-b9fc-4999-8bee-e2046d0adc79","seq":1,"duration_ms":100,"bytes_in":396,"bytes_out":13,"enriched":{"digest":"dd396727949b6a3c","strings":["OC.>0","MfQF","ohG.","3e%m)","ELQ8"]}},{"timestamp":"2026-09-08T17:06:13","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O����)��1\u0017IW]\u00127��Ra��\u0016�}G�\t�*\u0013ʐ�0\rv��B�H�D��T�g�h\u001e_��R8�v��*\u001e�\n&J6�EN_\u0010\u001cD�Ś\u0007\u0002к0�\u0004\u0018 �\tx�f?�ܬvW;4�\u001f��;z����Wu&UAB\u0001�\u0014\u0014y���\u001az��Wå��|�18\u0012���\u001f,�FF+��~�u����%�.\u0013�Tսؒ��^L\u001b���DK?��\u0002'\fךv��QL�j��\u0013","payload_hex":"c90836c74eff7cb5a2c4f5723281e7386d9a3233959e8f4977be64b50f47a02d9dd945f095f16e6815c9c7185ac7694fe51e6e076e2fbc304bd34a93581d0a7a50bcb2ba5fae0a00c0391782d06b002aaaa24b6c084c8e9e05bbf0978aa9747b22677aaa4f4f50990a2420e1de453db1b477db336d1d7318e0c82a556f156881c20814f38d2b2e41b8f7fd525f2646d25cd62c4ecb44bdeae2f011986b55a1ea290f572d6b17a57af75169d289b93b43f9715dd9399ecdc05784303f58fe1f851788eaa8014bbc8b048132e065ff9ef25c9adc7561acb663c5b62fa1043cf96792f90af305cb1b1e2ea42c3de8fee8c5c56d362ec00f33508cdb7e29e393777122393d6097412dfd8c95b97c6042e68b170cd79af89f00f36dcab379dfee4c3448fe3ffadc31ddbf9ad84910cf352e0bf09b783d5e057d3e90abb1299cd8311749575d1237acd55261b78416a17d479909af2a13ca90ac300d76b3ff42f748bd44e5d654a067b0681e5ff7a95238c776cef32a1e910a264a36f1454e5f101c448bc59a0702d0ba3096041820c4097882663fdfdcac76573b34b31febc13b7abf96c5ec5775265541420189141479f285c01a7abacd57c3a5f6c57ca5313812a2f3fc1f2ce646462b99d47e867587abe7b525ab2e139354d5bdd892c7d55e4c1bbae6ff444b3fc3c902270cd79a76e27f9e514ce96abd9313","method":"","user_agent":"","ja3":"","session":"d71e6553-8d60-4eb2-9f94-f1ca996580b9","seq":1,"duration_ms":100,"bytes_in":504,"bytes_out":13,"enriched":{"digest":"98a2d8d66827c894","strings":["t{\"gz","R_&F","wq\"9=`","vW;4","Wu&UAB"]}},{"timestamp":"2026-09-08T17:01:47","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O����\u000f\u0016�\b�2?����'�\u0019\u0002Pe\u0007�4�\u0011�\u00113I\u0016N^I��\u0010���D��\u0014��\u0013���\ng\u0019d;V �\u000e��\u001d�\u0007�\u0002�}c��gP,�M1�s�\u0018��Į!4�C���3q�\u001e��^��`�\u0004%��z��Il٠����}P~TN��J\r]T����#�O9��\fD��Up\fG���$%�\u000e�D��\u0002�@,u��s�Y9����!�D[������F��،\u000f���c�\u0018\tXAJ��x��g�r\n�\u0000#B'6�2\u0011��\u000fV��E��\u0007�+��1\u0019+\u0006\u000b�Kw������2\u0010�\u0018�1%\u00077��\u000f�ك\u0018�Z)\t\u000f1ȋcՌK�\u0018�3�4!�:�C�)\f\u0010a�D���\f��\f�gcY\b���\u0001\u001e|\u0002��\u0011\u0010�l�\t�?r��y���&=8d��1�L��zq����<�>��X��c","payload_hex":"2810d972660cf0dad35f947966ed1deaccadad9f8dff8aaee198479aa41ac13be83a5dfd0cc6e70d1f2813964b84a403f16eaa43d3e8441838577dbeb1497270dce7f9ed5a5bfaa56ba29a464109f20cf0d27bb04fd2a745f81f6b8f59aa5db206faf9fb821526803ba077c75e9550a9ee650bb7d404279c5ace4d9f1a3eaf917a9f82496cd9a0a7e1e8e37d507e544e99da4a0d5d54f2b6c1e023a04f397fedbc0c4486d155700c47fd95f92425df0efe44e38b02f3402c75f89873bb5939c1d7ffe8219b445bb8a0b68f8ce1468befd88c0fbeec92638f180958414afdfc78fe8e67b7720ad00023422736d3321184af0f5685fc45e4bf07d82bb4eb31192b060bf34b77a9e0f1b8e3973210eb18b831250737ad930fbbd98318d95a29090f31c88b63d58c4bfb18ca33d73421f93a8743eb290c1061b744ab89e70cbee10c9c67635908f6e18d011e7c02bb851110fe6c8a09c73f72e0a879feb4b8263d3864b79631c34c9bf77a719af0d3db3cee3e92a158cffe63","method":"","user_agent":"","ja3":"","session":"33e6f7c0-bccd-493a-b16c-6979984cde1e","seq":1,"duration_ms":100,"bytes_in":375,"bytes_out":13,"enriched":{"digest":"13e5694bcb52b4df","strings":["}P~TN","#B'6","&=8d"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-11T05:24:33.340231+00:00"}