{"ip":"201.43.247.129","total_events":7894,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"7,894 events across 1 port(s)","confidence":"high","network_type":null,"why":["7,894 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 28626s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"206,674,550 bytes sent, longest session 28626s","bytes_sent":206674550,"session_seconds":28626,"persistent":true}},"first_seen":"2026-08-27T11:30:55","last_seen":"2026-08-27T19:28:01","events_24h":0,"events_7d":7894,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"Taubaté","lat":-23.0209,"lon":-45.5508,"asn":27699,"org":"TELEFONICA BRASIL S.A"},"source_domain":"201-43-247-129.dsl.telesp.net.br","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":53,"proto":"tcp","label":"DNS","count":7894}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-27","count":7894}],"recent_events":[{"timestamp":"2026-08-27T19:28:01","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"X��D�=��\u0013�","payload_hex":"58ccce44d93dfca813e0","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7894,"duration_ms":28626469,"bytes_in":52585,"bytes_out":110498},{"timestamp":"2026-08-27T19:27:58","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Ti\"U\u0013��\u0005","payload_hex":"875469225513bec505","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7893,"duration_ms":28623626,"bytes_in":52575,"bytes_out":110484,"enriched":{"digest":"3cd2bebde67d2e4f","strings":["Ti\"U"]}},{"timestamp":"2026-08-27T19:27:56","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"���S","payload_hex":"b67fc0c553","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7892,"duration_ms":28620989,"bytes_in":52566,"bytes_out":110470},{"timestamp":"2026-08-27T19:27:53","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����?�H\u0015i","payload_hex":"b99a90ca3f94481569","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7891,"duration_ms":28618668,"bytes_in":52561,"bytes_out":110456},{"timestamp":"2026-08-27T19:27:51","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Ax�Ne�;","payload_hex":"804178914e65833b","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7890,"duration_ms":28616047,"bytes_in":52552,"bytes_out":110442},{"timestamp":"2026-08-27T19:27:48","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����rX�E","payload_hex":"a08d8bdb7258e645","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7889,"duration_ms":28613454,"bytes_in":52544,"bytes_out":110428},{"timestamp":"2026-08-27T19:27:45","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�]\u000e�C","payload_hex":"e55d0e8243","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7888,"duration_ms":28610575,"bytes_in":52536,"bytes_out":110414},{"timestamp":"2026-08-27T19:27:44","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u000be���\u001d��E","payload_hex":"db0b65b0f5841d8a9245","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7887,"duration_ms":28609393,"bytes_in":52531,"bytes_out":110400},{"timestamp":"2026-08-27T19:27:44","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">ь","payload_hex":"3ed18c","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7886,"duration_ms":28609175,"bytes_in":52521,"bytes_out":110386},{"timestamp":"2026-08-27T19:27:34","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0002ZN���g�'","payload_hex":"c4025a4ebeb0c667f127","method":"","user_agent":"","ja3":"","session":"131c728d-2f74-42c2-9a2a-d71e85a461f9","seq":7885,"duration_ms":28599681,"bytes_in":52518,"bytes_out":110372}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-01T05:44:26.013725+00:00"}