{"ip":"201.219.161.20","total_events":1499,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,499 events across 1 port(s)","confidence":"medium","network_type":null,"why":["1,499 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"319,797 bytes sent","bytes_sent":319797,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T01:03:50","last_seen":"2026-09-29T19:03:33","events_24h":51,"events_7d":1441,"geo":{"country_code":"AR","country_name":"Argentina","region":"Entre Rios","city":"Concordia","lat":-31.3985,"lon":-58.0374,"asn":28015,"org":"MERCO COMUNICACIONES"},"source_domain":"customer-ftth-CGNAT-sanluis-201-219-161-20.megacable.com.ar","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":1499}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":109},{"date":"2026-09-24","count":144},{"date":"2026-09-25","count":92},{"date":"2026-09-26","count":413},{"date":"2026-09-27","count":157},{"date":"2026-09-28","count":388},{"date":"2026-09-29","count":196}],"recent_events":[{"timestamp":"2026-09-29T19:03:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-7CgPYzOySOIX","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d37436750597a4f79534f4958","method":"","user_agent":"","ja3":"","session":"9f14c8d9-7666-48b5-b108-b4556246311f","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"4ae97d13c8a15091","strings":["BitTorrent protocol","<-UW160N-7CgPYzOySOIX"]}},{"timestamp":"2026-09-29T19:02:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��ͩk��\u0002��!7�I�&\t\u0013?\"���Z����]�\u0010�\bC\u000b�����b�\u0003\u001e��?\u0011*F��L\u0004�lԧ�^��+�虾��\u0004d��/\u0014J�c^�n\u001e�x_ t��Ry�\u0015J��!����m�\u001fV+�\t\u001c��\u001b��>_��0\u0018ձ XI)�\u00137�08�X���ODV�?��͗0�%�D�`_�Q\u0014y`\u0015/��\u0011�!���\u0011\u0011��HS�;籮0\u0004���Bs�\u0004\u0016C\u001a6��vSZ��g�V/�Q��\u0007^D�Z\u0003�MG�&ͫÕ�?q֍v��՞\"\u0006�c6\u000b����6\u0016U��I����Xo\u000f)��}�� /`�d詏���\u0006/�����������<\ry݊8m���s�;\u000b����T*���\f��1�r���F�@�.�7��~�\n��S�'W!�\u0016��\u0019�o��\u0005�\u0003%di7\n�nc����rn��?�q[ʹ[�+��\u0002�9I\u001d\u001bIm86�\u0001�\u0016��N~�5�\u001dGg�J��gl�9�٫�xZ\u001b֝G�_��\"\u0004A)}��#E\b4v\u0010dʟn}ܜ�\r��O\f��,�FVR=['����A\u001bȸ{\u001c�����)�*aB��\u0005��\u0016\u0016Ty/(�TR��ܥ����������'�\u0015\nU%�\t�\u0010��ԐH�^���\u001a�k�\u0011�F�$&<�XT��hz�qf�x��\b)s\u001c�\u001ci.!�\u0019/�\u0005�6\u0017�L������suU��\u0012\u001a1��N����,��2h��� v�T�\u0012\tFGl�eF`\u0017Շw^<�ປB^�&=H*��b�`%\u000e=@�CB*\u000f�փͻ���\\�E��8\u0012;\fB��9����v�#нA�,\u0006�O�\no�v\u0016�Щ��\u0000�>\u001a\u0002צ�MK*uP�i\u0006E�V*\u0005� ��̚����&\u0012\t\u0007��\u0004�=�~�T�\u0019ă0\u0014\u0015�T�A��\u001a�\u0016K\u0012ATt!_l\u0012r�@�ұD��C��!2�|\u0017k�\u001fi���a��-��\u001a&P�V���pa�","payload_hex":"71fcb673e24a1ec11c8ac3df7d6ff0de35dbf9dc21e451e8380551b8f26f1a2f334716aad270185a3561a0c6d8c2a9c9c3846e65830b53807a260b6f5d627461b371a01450db399b642be7abb2a8859cfea616a3c73c90db166f00ed2dba817e6621f5b63e5525f3099310fcafd49048a85e97fe9d1a806b91119346f824263c835854e2db687a9c71669078bc930829731ca61c692e21c8192ff405903617f04cb5ebe694c5d87375558efc121a318bbc4e91f6f4c42ce0d63268f2aa8f2076ea54bb120946476c8965466017d5877f775e3cffe0ba9b425ea5263d482a8af662bb60250e3d40c543422a0ffcd683cdbb90a9925c9e45878a38123b0c42f69539b295c1b0768223d0bd41db2c06ad4f990a6f917616c5d0a9d8fb00883e1a02d7a6f84d4b2a75509d69064580562a057fcdc2a0bef0cc9a93b9958f2612090798e904fe3d9b7e9354f819c483301415e154e34191881ad7164b12417f5474215f6c1272ab40add2b144898f43a8c02132e87c176ba91f69d7fac661bdf32d8dc81a2650fe56edbed670618b","method":"","user_agent":"","ja3":"","session":"94178657-13d4-4924-acba-89ae26b5eda7","seq":1,"duration_ms":100,"bytes_in":396,"bytes_out":14,"enriched":{"digest":"7c1dcef17b9c1199","strings":["o]bta","&=H*","MK*uP","Tt!_l"]}},{"timestamp":"2026-09-29T18:52:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW160N-Otg!PO~w0Tux","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d55573136304e2d4f746721504f7e7730547578","method":"","user_agent":"","ja3":"","session":"7d7249a6-69c1-4d33-8b35-71dfcafbac7d","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":14,"enriched":{"digest":"c8f4528d9ea760ff","strings":["BitTorrent protocol","<-UW160N-Otg!PO~w0Tux"]}},{"timestamp":"2026-09-29T18:51:33","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ژ�n<\u0014G�\u0016굼�Wv@\"�JhY�D\f7&��F+��ϰN��\u0005j�X���� \u00170!J�C��,�9xu�/��Ҷѥ���0-�#h@�Pۍ\tJHv_������`0��\u0005F�vt\u0016�x�6�X�\t�\u0011l�7v6Z�","payload_hex":"da98996e3c14479916eab5bcf157764022c84a6859b0440c3726a0e4462b96c1cfb04ee8b1056af158afe9e0ba201730214ab34391cb2cc3397875882fe7b2d2b6d1a5e0fca9302df42368408b50db8d094a48765ffd87f3e79af26030c9cd0546b17674169078ab36f8589509c7116c903776365ab9","method":"","user_agent":"","ja3":"","session":"ade4a9a6-ca01-4d16-a601-2e99c1502340","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":14,"enriched":{"digest":"5741444f3ab18b25","strings":["Wv@\"","JHv_","7v6Z"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T09:59:35.687812+00:00"}