{"ip":"45.173.101.133","total_events":17905,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"17,905 events across 1 port(s)","confidence":"high","network_type":"residential ISP","why":["17,905 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 6088s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"2,048,938,436 bytes sent, longest session 6088s","bytes_sent":2048938436,"session_seconds":6088,"persistent":true}},"first_seen":"2026-08-18T01:06:04","last_seen":"2026-08-18T02:47:31","events_24h":0,"events_7d":17905,"geo":{"country_code":"BR","country_name":"Brazil","region":"Pernambuco","city":"Recife","lat":-8.0009,"lon":-34.8687,"asn":268809,"org":"EDILEUZA EVARISTO BARRETO"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as268809","label":"EDILEUZA EVARISTO BARRETO","category":"isp","url":"https://www.peeringdb.com/asn/268809"},"cve_matches":[],"malware":[],"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":17905}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-18","count":17905}],"recent_events":[{"timestamp":"2026-08-18T02:47:31","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\\:Y���\u0015��","payload_hex":"5c3a59c1858e15bad1","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17680,"duration_ms":6087721,"bytes_in":259822,"bytes_out":247484},{"timestamp":"2026-08-18T02:47:31","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Ńs+���","payload_hex":"c583732be29df7","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17679,"duration_ms":6087275,"bytes_in":259813,"bytes_out":247470},{"timestamp":"2026-08-18T02:47:30","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"#���d�","payload_hex":"23b48acc6494","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17678,"duration_ms":6087026,"bytes_in":259806,"bytes_out":247456},{"timestamp":"2026-08-18T02:47:30","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0012C0,��\u0014�","payload_hex":"b4ae1243302cba8214a3","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17677,"duration_ms":6086484,"bytes_in":259800,"bytes_out":247442},{"timestamp":"2026-08-18T02:47:30","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"d.O;vR0h�#\u000e�U�","payload_hex":"642e4f3b76523068bc230ea855e1","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17676,"duration_ms":6086245,"bytes_in":259790,"bytes_out":247428,"enriched":{"digest":"b7f5c9d9a3240302","strings":["d.O;vR0h"]}},{"timestamp":"2026-08-18T02:47:29","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Avfj�{�V��","payload_hex":"4176666aea7bc65690be","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17675,"duration_ms":6085656,"bytes_in":259776,"bytes_out":247414,"enriched":{"digest":"e8b70320fb367763","strings":["Avfj"]}},{"timestamp":"2026-08-18T02:47:29","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004���Qu�\u0018�","payload_hex":"04aaedb151758b1888","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17674,"duration_ms":6085436,"bytes_in":259766,"bytes_out":247400},{"timestamp":"2026-08-18T02:47:28","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"L��\u001e","payload_hex":"4cbae81e","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17673,"duration_ms":6085054,"bytes_in":259757,"bytes_out":247386},{"timestamp":"2026-08-18T02:47:28","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"њ=�JV","payload_hex":"d19a3db74a56","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17672,"duration_ms":6084500,"bytes_in":259753,"bytes_out":247372},{"timestamp":"2026-08-18T02:47:28","port":3306,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0004:y��Y=","payload_hex":"cd043a79c2e8593d","method":"","user_agent":"","ja3":"","session":"01515610-f18e-4710-8030-3ca255315069","seq":17671,"duration_ms":6084111,"bytes_in":259747,"bytes_out":247358}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T00:32:35.732558+00:00"}