{"ip":"210.205.2.37","observed":true,"total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"231 bytes sent","bytes_sent":231,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-16T16:38:54","last_seen":"2026-10-16T16:41:51","events_24h":2,"events_7d":2,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"KR","country_name":"South Korea","region":"Seoul","city":"Seoul","lat":37.5639,"lon":127.0188,"asn":9318,"org":"SK Broadband Co Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as9318","label":"SK Broadband","category":"isp","url":"https://www.peeringdb.com/asn/9318"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":16663,"events":2}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-16T16:33:26","last_seen":"2026-10-16T16:34:09","recent":[{"timestamp":"2026-10-16T16:34:09","port":16663,"src_port":57022,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"A\u0000�\u0006��2\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000","payload_hex":"41008606fbab3202000000000000000084d50000","sni":"","session":"29e52bb2-84e3-4e37-8aed-5adedcb1d5f2","bytes_in":20,"source_verified":false},{"timestamp":"2026-10-16T16:33:26","port":16663,"src_port":6881,"proto":"udp","app_proto":"","app_protocol":"bittorrent","summary":"d1:ad2:id20:\u0011��\u0012��}\u0003n��4�M�;a���9:info_hash20:\u0011��mW��՚v{}��d\f��\u001c�e1:q9:get_peers1:t2:\u0005\u00111:v4:LT\u0001\u00021:y1:qe","payload_hex":"64313a6164323a696432303a11e2da12b2847d036eab8e34ad4df93b61fd8cc9393a696e666f5f6861736832303a11e3d46d57a288d59a767b7d8585640cebfa1cf765313a71393a6765745f7065657273313a74323a0511313a76343a4c540102313a79313a7165","sni":"","session":"9140fc32-d664-4ed5-b589-919f0139b845","bytes_in":104,"source_verified":false,"enriched":{"digest":"b50219f599445b2e","strings":["d1:ad2:id20:","9:info_hash20:","e1:q9:get_peers1:t2:","1:v4:LT","1:y1:qe"]}}]},"interaction":null,"top_ports":[{"port":16663,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-16","count":2}],"recent_events":[{"timestamp":"2026-10-16T16:41:51","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001f-���؈��[�V\u0005�\t�0q�*-UW160U-r*Qie*Hcw~mV","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051f2d83cde5d888afdf5b8256059809973071862a2d5557313630552d722a5169652a4863777e6d56","method":"","user_agent":"","ja3":"","session":"4b6a760c-3f1e-47d7-ad11-96f153ef5ac5","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"0a706b4444d9c1c0","strings":["BitTorrent protocol","*-UW160U-r*Qie*Hcw~mV"]}},{"timestamp":"2026-10-16T16:38:54","port":16663,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��A����v�\u001fE\u000b�r\u000f�>�\u001ad\u0016l`X�����}\u001dj\u0011Q�:,{<�t\\\u0012<���^������܍\u000f�\u0011\u001f��.Uc�-���\u0019�\u0015����PDt+��(p�\n�*�>\u0016�5\n�s\b�\b�\u001cޅ�\u0010���;u}�)����9 !��Y>0�楌&]�\u001e0�[�\fA� �\u000b�/�\u0011z\u001by~���\u00011��`y�}","payload_hex":"ebb941a0a1bf8876ac1f450bb3720fe23efc1a64166c6058fcb19bd5e97d1d6a11518d3a2c7b3c82745c123ce091b45eb585a2eddcd8dc8d0fad111ff0ee2e5563f42db1f5a419ba15a18497da5044742bbad62870860ac32aef3e1695350af97308b008e01cde85f210f789f43b757d992985b397de392021e1c8593e308ce6a58c265dcd1e30cb5baa0c41ec20e40bd62fc7117a1b797e8698e6013192da6079f07d","method":"","user_agent":"","ja3":"","session":"0aebb6ff-20e2-4785-9f7d-0aba0f159670","seq":1,"duration_ms":100,"bytes_in":163,"bytes_out":12,"enriched":{"digest":"ce44f7af6b3525ed","strings":["PDt+"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-17T06:10:35.963829+00:00"}