{"ip":"80.39.172.98","total_events":506,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"506 events across 1 port(s)","confidence":"medium","network_type":"residential ISP","why":["506 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"107,657 bytes sent","bytes_sent":107657,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-29T20:07:22","last_seen":"2026-08-19T12:54:58","events_24h":0,"events_7d":102,"geo":{"country_code":"ES","country_name":"Spain","region":"Madrid","city":"Madrid","lat":40.4498,"lon":-3.675,"asn":3352,"org":"Telefonica De Espana S.a.u."},"source_domain":"98.red-80-39-172.dynamicip.rima-tde.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as3352","label":"Telefonica de España","category":"isp","url":"https://www.peeringdb.com/asn/3352"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":506}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-07-29","count":4},{"date":"2026-08-04","count":80},{"date":"2026-08-05","count":121},{"date":"2026-08-08","count":41},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":156},{"date":"2026-08-11","count":1},{"date":"2026-08-19","count":102}],"recent_events":[{"timestamp":"2026-08-19T12:54:58","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��_��f\r �…�BO��qˇ�wۀh���z54@@<\u0017��{��ɛ�(��A���h�Q���\u0003�b�j���\u0014yÍ�^�\\\u0015�j\b?,�띏�\u001e<\u000b�/\u000f�ƒ���ױ><͐\"�%�\u0000\u001a\u0019m�Y��=���\u0001N\u0018K�_.���$����1\u0005\u0005$�ʖ����\u0014tu��\u001fX�ߠA��\u0016\u0017ֶ���U2�2%�b�X�_A>�V\u0004��*a��*\u0013c�%���E]\u0002�����4�\u000e��pZ����8%O6\r\u0003\u001b[W��1�T[\u0001��H\u0016G𾿍Jns�\u0014s��\u0006��I\u001cBf{c¼��'���X(�Q̂w�t\u001d\u0001*�c\u0002��]�.�\u0013D�I��g��n֒$�#���}5��","payload_hex":"9cd65fa690660d20b7c28595424ffdb771cb87bd77db8068d8fae97a353440403c17a1f67bdbe7c99bcd28d0d041afa79f68ff51ddefa7039562a16ab980cc147949cd81af5ec65c15e06a083f2cf6eb9d8fdc1e3c0b902f0faec692eda289d7b13e3ccd90228125a2001a196d8959ab833de8d7c1014e184bc25f2ebf939e24ba97e8e831050524ceca9688a3a8eb14747584b31f58f2dfa041ac841617d6b6fdffbc5532d63225f462c258f35f413e985604e4d42a619d862a1363c925fe8693455d02f7efece7df34c60e84b7705a9a8d8eeb38254f360d031b5b579ed531fd545b01e3eb481647f0bebf8d4a6e73b91473f0c8069be9491c42667b63c2bcf4f4278aae875828fc51cc82779c741d012a9c6302f28b5dc72ee01344a149afd26791c76ed69224cf23b0ba927d35bafe","method":"","user_agent":"","ja3":"","session":"663f9ef7-e6fb-4b33-8a64-55ea0f241949","seq":1,"duration_ms":101,"bytes_in":305,"bytes_out":12,"enriched":{"digest":"9722f031400c5fc0","strings":["z54@@<","8%O6","Bf{c"]}},{"timestamp":"2026-08-19T12:53:06","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-IKpAp4AaC2WT","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d494b70417034416143325754","method":"","user_agent":"","ja3":"","session":"bbb5ca0f-60ef-470d-87d9-c1f68dcdef77","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"de24b49acfe408d7","strings":["BitTorrent protocol","<-UW1605-IKpAp4AaC2WT"]}},{"timestamp":"2026-08-19T12:51:15","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"m}�Y*5�\u0019�9i�<��ǹ\u001c\r�ի\b6;)��M�\u0004-��\u0013��\u0014ڪ�\u0004e�l٢���P|\u0015�}2�\u0000�\u00028�klw�;�-��Fv���n6u\"\u0014�\u0005&Oh\u0013p6��\u000b�W�^\t��\u0001sd\u0003\t����\f�\u0010\u001a�L�W�A{?\u0000���\u0016e\t�H�E5\nj\u0003BTu�\u0019�G6�F\u001b�\u0017鐏&&-c�5�\b��\u0001��\r�T\u00122q\u0001��ЍV\u000e�΅������d(����-Ew��KM�ē��\u0018>��v��\u0010�\n��kƂ\u0016�_B[p��I\n\u0012�$�\t\u001dw�G�����k��\u0003�#�\u0002o9v/��\t\f60�I2�W\b�����m�+•�='���*�N-\r���e��'\u0019�j\u0000-IZ[��\u001f��\u0015@F&��\u0002?\u0010��`\b�a��Z§�p��","payload_hex":"bed62cb5a74f529fc2e46b3c7595b1e6ced5c5190a316cf00e5c2a3e137036a5ff0b9057a45e09f2bf01736403098a9dd2c90ce3101a9f4cee57aa417b3f00f8ccfe166509d0488d45350a6a03425475a719a3473681461b9b17e9908f26262d63a235b208c4fc01c4df0db754123271018eb0d08d560eb1ce8581fe8ff1b68e6428e6b8c6e02d4577d8d74b4d8ec493f589183e85f47686f210d20aa0af6bc68216815f425b70d1c2490a12de24c1091d778647f5ffd4e9e36bc6d503db2397026f39762ff79e090c3630e74932d05708ef8699afbe85a7c46df72bc295a17f3d2783cdfc2a874e2d0dce7fe4aa65af9e2719e56a002d495a5b9aea1fe3ac15404626d9fa023f1084f36008e561c6dc5ac2a7b270e1cb","method":"","user_agent":"","ja3":"","session":"5cd61bca-e89f-47d7-8eb3-0d3e23ffa315","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":12,"enriched":{"digest":"d68ccbadebda7311","strings":["&&-c","_B[p","o9v/","-IZ[","j-IZ["]}},{"timestamp":"2026-08-19T12:37:19","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<-UW1605-Szgje(_hh(mI","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c2d5557313630352d537a676a65285f6868286d49","method":"","user_agent":"","ja3":"","session":"7799315f-f9b1-4091-9e59-4a94621e66b7","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":12,"enriched":{"digest":"d2a0ddf306dea7a7","strings":["BitTorrent protocol","<-UW1605-Szgje(_hh(mI"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T15:23:27.340312+00:00"}