{"ip":"201.213.9.2","total_events":4089,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"4,089 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["4,089 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"278,052 bytes sent","bytes_sent":278052,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T08:18:35","last_seen":"2026-10-05T19:35:16","events_24h":245,"events_7d":2624,"geo":{"country_code":"AR","country_name":"Argentina","region":"Buenos Aires","city":"Avellaneda","lat":-34.6504,"lon":-58.3878,"asn":7303,"org":"Telecom Argentina S.A."},"source_domain":"201.213.9.2.fibercorp.com.ar","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7303","label":"TELECOM ARGENTINA","category":"isp","url":"https://www.peeringdb.com/asn/7303"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":10,"protocols":[{"protocol":"udp","events":10}],"ports":[{"port":39131,"events":10}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T19:28:14","last_seen":"2026-10-05T19:32:39","recent":[{"timestamp":"2026-10-05T19:32:39","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000�;����\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�e\u0000\u0000","payload_hex":"4100db3b839d91de0000000000100000a9650000","sni":"","session":"3606dfbf-3aec-44a0-be75-b4c4a5dc770f","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:32:33","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000�;�B\n�\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�e\u0000\u0000","payload_hex":"4100db3b83420ac10000000000100000a9650000","sni":"","session":"7b7d42bd-8cad-48ff-b2f1-c14e33eca7d2","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:32:30","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000�;�\rҋ\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�e\u0000\u0000","payload_hex":"4100db3b830dd28b0000000000100000a9650000","sni":"","session":"d53ac79d-321f-488e-bd3f-055e5af4a384","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:30:31","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000��{�:l\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�w\u0000\u0000","payload_hex":"4100bf8c7bfc3a6c0000000000100000dc770000","sni":"","session":"df6083e1-c2f8-4fe8-a6fe-4bdd66de724d","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:30:25","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000��{��[\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�w\u0000\u0000","payload_hex":"4100bf8c7ba0a75b0000000000100000dc770000","sni":"","session":"3145ae78-12ca-47b0-91fc-8be2041ee3a4","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:30:22","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000��{l�~\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�w\u0000\u0000","payload_hex":"4100bf8c7b6cb87e0000000000100000dc770000","sni":"","session":"1772dac8-ba7e-42e5-b9d8-10641701e288","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-05T19:28:25","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000NTtxl�\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�2\u0000\u0000","payload_hex":"41004e5474786ce800000000001000008f320000","sni":"","session":"c984bb33-15cf-4938-a531-c84d1f5031a7","bytes_in":20,"source_verified":false,"enriched":{"digest":"967fde5e7964e348","strings":["NTtxl","ANTtxl"]}},{"timestamp":"2026-10-05T19:28:19","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000NTt\u001cn�\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�2\u0000\u0000","payload_hex":"41004e54741c6efa00000000001000008f320000","sni":"","session":"6518b42a-07db-447d-9627-39e9af3dc46d","bytes_in":20,"source_verified":false,"enriched":{"digest":"03b23c509b4e229d","strings":["ANTt"]}},{"timestamp":"2026-10-05T19:28:16","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000NTs�\u001e�\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000�2\u0000\u0000","payload_hex":"41004e5473ea1e8b00000000001000008f320000","sni":"","session":"5fe316a9-e321-4b1b-9e67-3253aab70d18","bytes_in":20,"source_verified":false,"enriched":{"digest":"38ffb88dc03fb059","strings":["ANTs"]}},{"timestamp":"2026-10-05T19:28:14","port":39131,"src_port":58960,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:D�%\u0016rr�\u001d��OJw\u0002��9,S�6:target20:D�%\u0016rr�\u001d��OJw\u0002��9,S�e1:q9:find_node1:t4:U[\u0000\u00001:v4:UT�\u001e1:y1:qe","payload_hex":"64313a6164323a696432303a44b525167272e61df0844f4a7702d7e8392c539d363a74617267657432303a44b525167272e61df0844f4a7702d7e8392c539d65313a71393a66696e645f6e6f6465313a74343a555b0000313a76343a5554b91e313a79313a7165","sni":"","session":"e6a6cbb5-da10-4082-ad1a-b1f73980f0ee","bytes_in":103,"source_verified":false,"enriched":{"digest":"8b90dfabe78bcc5e","strings":["d1:ad2:id20:D","6:target20:D","e1:q9:find_node1:t4:U[","1:v4:UT","1:y1:qe","e1:q9:find_node1:t4:U[1:v4:UT"]}}]},"top_ports":[{"port":39131,"proto":"tcp","label":"","count":4089}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":205},{"date":"2026-09-20","count":380},{"date":"2026-09-21","count":125},{"date":"2026-09-24","count":43},{"date":"2026-09-25","count":28},{"date":"2026-09-26","count":217},{"date":"2026-09-27","count":325},{"date":"2026-09-28","count":244},{"date":"2026-09-29","count":201},{"date":"2026-09-30","count":202},{"date":"2026-10-01","count":737},{"date":"2026-10-02","count":396},{"date":"2026-10-03","count":313},{"date":"2026-10-04","count":507},{"date":"2026-10-05","count":166}],"recent_events":[{"timestamp":"2026-10-05T19:35:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e��W�f�l�\u0001��","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb9b557c166896c8001d3d8","method":"","user_agent":"","ja3":"","session":"fce93e5b-95e3-4821-9717-992e657c2c14","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"6eab45d2a044353c","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T19:33:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e��⊤�R\u0017���","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb9dde28aa48352178ce286","method":"","user_agent":"","ja3":"","session":"587b13fc-7406-47a7-85a5-e16158c60544","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"00ea51085b10532c","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T19:32:30","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e����\u0004h�w{\u001b�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb988a69104689a777b1ba5","method":"","user_agent":"","ja3":"","session":"f9f4f470-77fe-443f-9c8f-c38e4f809fa7","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"7628a5196ddc3923","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T19:31:27","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e�\u0003<K�Q\u0004\u0018i�/","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb9033c4b9551041869f92f","method":"","user_agent":"","ja3":"","session":"b15b6d77-cc5b-43c1-9b07-44adf93c93ad","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"bb5a0311b94889e0","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T19:29:40","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e�\u0013l����5�Dt","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb9136c9e93938935a74474","method":"","user_agent":"","ja3":"","session":"c30c7257-4b2f-457f-8825-0f2391b012c8","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"d7a3b4ae1e3bb569","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T19:28:16","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e��y\"��X,\u0004A�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb9917922cef4582c0441a1","method":"","user_agent":"","ja3":"","session":"7670542f-fc85-4173-baa1-0c9a2bf2b29a","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"d294785e16a2eaea","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T09:00:41","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e�#vjl<�#4}�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb923766a6c3ca023347dd6","method":"","user_agent":"","ja3":"","session":"e28a801e-2d6b-478d-82b7-f38d087aa7de","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"cb4d760c8b6b992c","strings":["BitTorrent protocol","<-UT360W-","#vjl<"]}},{"timestamp":"2026-10-05T08:53:59","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e�S�\u0010�=�\u0011� �","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb953e810f23db1118a20d7","method":"","user_agent":"","ja3":"","session":"6a2f8a3e-d12a-4b46-984b-b2874642d1c9","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"5be20ef901db6bc4","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T08:49:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e�\r\u0015��e����r","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb90d158ae165b0b0b09972","method":"","user_agent":"","ja3":"","session":"c2bb23ed-f5f0-4a5e-a144-9b5cc3a83cc2","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"a42d3a84dd30e0ff","strings":["BitTorrent protocol","<-UT360W-"]}},{"timestamp":"2026-10-05T08:46:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UT360W-\u001e� ��G�s��/�","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001000051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5554333630572d1eb920989f47d273c0892fc3","method":"","user_agent":"","ja3":"","session":"4d89eb8b-485b-46bf-b2aa-1d41ebfd2190","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":11,"enriched":{"digest":"ceafb8c408236945","strings":["BitTorrent protocol","<-UT360W-"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-05T19:36:23.043431+00:00"}