{"ip":"205.164.241.40","total_events":113907,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"113,907 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["113,907 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 54254s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"67,608,467,784 bytes sent, longest session 54254s","bytes_sent":67608467784,"session_seconds":54254,"persistent":true}},"first_seen":"2026-08-13T08:36:09","last_seen":"2026-08-13T23:40:22","events_24h":25030,"events_7d":113907,"geo":{"country_code":"BR","country_name":"Brazil","region":"Bahia","city":"Feira de Santana","lat":-12.2337,"lon":-39.0656,"asn":271562,"org":"WT NET COMUNICACAO LTDA"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as271562","label":"WT NET COMUNICACAO","category":"isp","url":"https://www.peeringdb.com/asn/271562"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":113907}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-13","count":113907}],"recent_events":[{"timestamp":"2026-08-13T23:40:22","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"������","payload_hex":"fee8dff2c5ce","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112815,"duration_ms":54253771,"bytes_in":1010017,"bytes_out":1579275},{"timestamp":"2026-08-13T23:40:22","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l2?}�","payload_hex":"6c323f7dd5","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112814,"duration_ms":54253611,"bytes_in":1010011,"bytes_out":1579261,"enriched":{"digest":"55349272ec4a7276","strings":["l2?}"]}},{"timestamp":"2026-08-13T23:40:22","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�E\u0013��&","payload_hex":"bc4513f1fb26","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112813,"duration_ms":54253428,"bytes_in":1010006,"bytes_out":1579247},{"timestamp":"2026-08-13T23:40:22","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"u��w��T","payload_hex":"75b79977bfc854","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112812,"duration_ms":54253257,"bytes_in":1010000,"bytes_out":1579233},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�h-\u0018\ni\u001a�","payload_hex":"b4682d180a691aaf","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112811,"duration_ms":54253020,"bytes_in":1009993,"bytes_out":1579219},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\b�JX^","payload_hex":"c2d008ee4a585e","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112810,"duration_ms":54252839,"bytes_in":1009985,"bytes_out":1579205},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"P��","payload_hex":"50f1de","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112809,"duration_ms":54252676,"bytes_in":1009978,"bytes_out":1579191},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"hPz`��","payload_hex":"68507a608bf8","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112808,"duration_ms":54252517,"bytes_in":1009975,"bytes_out":1579177,"enriched":{"digest":"3d86386596d27380","strings":["hPz`"]}},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"yD9K��","payload_hex":"7944394ba5d8","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112807,"duration_ms":54252355,"bytes_in":1009969,"bytes_out":1579163,"enriched":{"digest":"fd68dba4d5111cea","strings":["yD9K"]}},{"timestamp":"2026-08-13T23:40:21","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u001cv���","payload_hex":"1c7681f1ba","method":"","user_agent":"","ja3":"","session":"98f6cf34-b9fe-4416-9af5-f94338b51658","seq":112806,"duration_ms":54252199,"bytes_in":1009963,"bytes_out":1579149}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:13:27.893436+00:00"}