{"ip":"85.26.241.144","total_events":823,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"823 events across 1 port(s)","confidence":"medium","network_type":"nsp","why":["823 requests against only 1 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"168,912 bytes sent","bytes_sent":168912,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-17T08:08:23","last_seen":"2026-08-31T17:40:52","events_24h":176,"events_7d":213,"geo":{"country_code":"RU","country_name":"Russia","region":"Khabarovsk","city":"Khabarovsk","lat":48.4817,"lon":135.083,"asn":31133,"org":"PJSC MegaFon"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31133","label":"MegaFon","category":"isp","url":"https://www.peeringdb.com/asn/31133"},"cve_matches":[],"malware":[],"top_ports":[{"port":39131,"proto":"tcp","label":"","count":823}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-17","count":231},{"date":"2026-08-18","count":379},{"date":"2026-08-30","count":37},{"date":"2026-08-31","count":176}],"recent_events":[{"timestamp":"2026-08-31T17:40:52","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Y�BxW\u0012U2���~�5%\u0015\u0012���\u000e��Vh\u0003y�\f��ku�h����LA���\u0019\u0003�-[>\\_@/\u0004-�IK���\u0019�Z�e�Iƫ�i�R��~��\u0003���1��$!�!�UsiM��\u001f\u0016$�f�\u0013��/��\u0017�ݲ\u001a�cX���H��\u0005�;��o�\u0017�\u0017�\u001cmG�\u0003w\u0002���J\u001eB��ց��\u0001�-\u0012&+��wN�4��e�p�\\\u0007�t,y%D\u001b��9�Kt�o�M$\u000e�0:@\n��v�1�ѿPC�rK�\u0017�L4W\u001b@sb�����g��`u��\u001d����Y�4n[�����n�\u001f`(�؈�t��a���/�\u0005e0��S%!m*�I��c(*��}\u001f\"@\t��X����CJA\\��6!��*}�\b\u000b�s��b�r�F����G�\u0005q!{֒�$�}HՊ\r����:�;������/��5庆E�'�\u0012��+\u0017?P^��\u0012\"Y�a@\u001cI�����w\u001c!�6\u001f����\"V3{Zz�3�+�#;Ai:��qǸ7ua\u001f<k�\u001e\u0003���'\u0011�厤[Ib���\u000b�;��<�\u0001�R��\u001d\u0014\u000eH","payload_hex":"59d942785712553290d2f37ef93525151286c4ec0e9886566803798a0cbacb6b758b68b0afb5b24c418aeffe1903fa2d5b3e5c5f402f042dc9494bf6eac719eb5a8a65b749c6abc8698852c2cb7ea8e303909a9f31a39c2421c721de5573694daf961f16248666f613f8972fede717c2ddb21a956358c1a8f948b4d405853bc7ca6fe317a117c11c6d47ef037702979ca34a1e42848fd681b3d8019f2d12262b8be8774eec34c7fe65fe709c5c07e9742c7925441bc4c239f84b74f36fa84d240e8a303a400aeb9f76c8318dd1bf5043a5724ba717f34c34571b407362d5fdd8e18267a48b6075eead1d87f394ad59d9346e5bf3f5b99f926ed21f6028a3d888947480b761f4bce52fe2056530bdbf5325216d2af449bfac63282a8f937d1f224009b99458b3abb3f8434a415cfa8436219fa32a7df8087f0b9f73f3b6629972e946c4ebfbd547db0571217bd692b6248a7d48d58a0dafd4fec03aeb3bfe96858cbf8f2ff4a735e5ba86458c27981293fd2b173f505e8bf61222599261401c4981f987b9e6771c21b7361faf8bcfd02256337b5a7ab333f32ba1233b41693abe9971c7b83775611f3c6bfe1e03e88bf02711ede58ea45b4962b2aaee0ba73bef853ce201a152bff81d140e48","method":"","user_agent":"","ja3":"","session":"fbfcc70d-e8a4-4fd0-b4e4-fcf24f7bbf50","seq":1,"duration_ms":100,"bytes_in":460,"bytes_out":13,"enriched":{"digest":"c2650fb942b55bd0","strings":["UsiM","t,y%D","S%!m*","CJA\\","\"V3{Zz","#;Ai:"]}},{"timestamp":"2026-08-31T17:39:41","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<MG-3.01.4276cO~IMjEd","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4d472d332e30312e34323736634f7e494d6a4564","method":"","user_agent":"","ja3":"","session":"921bc5f1-b68f-4151-a7a5-db394aa78df4","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"0d1c9d4080c16a94","strings":["BitTorrent protocol","<MG-3.01.4276cO~IMjEd"]}},{"timestamp":"2026-08-31T17:38:31","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�Uq\u0001z��A��\u000ea�Vq��3\u0006�\u0011ň^`\u0015�d ����\b���p�\u0005\u0005��}�H�\u0017�\u0007�\u000b��^�]���M� �\u0012��ڹ��\u001d$�����_t\u001aIB�\u0001��\u0013�vƖ�vnj\u001a���+�,�\u0003G��ѠQ�OZ\u0005�d��P�\u0010\u0013�B�����G!\u001cD8\u0013�7\n���AqRdC+\u0011�\u001f���\u001a{�\r�Vٝl�z��Xet�s�F��)]\u0013N��1U\u0019\rG���\u001a���,P��e-ϝ\u001d,~�0gG7\nu\u001f\u00006{\u0018w_�\u001fY��y\u0019R\f76V ?�x\u0015��.S\r��\u001d�T\u0016)V���;��Eښ�bD\u0004�h2u2Nw��\t\u0015֜��1\u0014ޖg(�O�l�M5+ӑ\u0017$lL\u0015\u0016�Qdۈ\u000b�)��I�d�n�D\u0010\u001eq���;!#W��Q?Y)=�OW�}�\f{�r��\u001f�!�0���Oh�?�t�0�\nFW\u0017}r�\u00136�\u0001O�ݚ�yz��mՏ~ɇ�5Ϸ@����T��\u0005�Yߔ-��\u0014@@��\u001d�\u0005�d�������!�A\u00108�f�׉A��V)�ܺ��V�v�ϛ��˂bdtRw�w���\u001c�c��cD5äA�^$�՜l��XqǍ>\u0012�2�J��\u0006��V\u0014\r\r�eL.5���w\u001f�����(c��\"\u001d,�\u00148*~����?���C���K\u0014B\u0018�","payload_hex":"d85571017afb8c41bcca0e61fb5671abcf3306ed11c5885e6015cc6420f7f2f3930899f7d270bb0505efa67de2489417bf07ed0b9cd85ed35d81a2be4ddc20a312f4a7dab9b88f1d24cbefb3f3d45f741a4942b701e8e0139a76c696c4766e6a1abaeacc2ba02ca2034789fdd1a051be4f5a05aa649bb450f31013fc42f1cbf0978547211c44381394370aeba6f241715264432b11c81f9ff68e1a7ba80db856d99d6cec7ab388586574d1738e46f9f4295d134efcd83155190d7f479a8bc41ab38d9f2c50b49a652dcf9d1d2c7eb7306747370a751f00367b18775fd71f599ad87919520c373656203ff37815b2f82e530df9881d98541629569bfbc4cdbebfeb45da9ad56244048e683275324e77a9df0915d69ce2be3114de967f6728c74fac6cbd4d352bd39117246c4c1516ca5164db880b9e298e8549d164bb6e8344101e71f48ef33b212357f8e3513f59293dc64f57c97dc10c7bf372ccd61f8621ca30dbe5904f68d93fea74d5308d0a4657177d72dc133691014ffcdd9a9e797ae1f86dd58f7ec987d235cfb740e3abc1e454a58a05b859df942dad96144040a29c1de6059c64ebadeaf6b3f19d218a411038ee959c9f6691d78941979a56298bdcbafe8c56b576e5cf9b88a4cb826264745277aa778cf4f01c9663a183634435c3a441955e24d3d59c6cbdd15871c78d3e12db32a94a9b820689fc56140d0deb654c2e35be8bb2771f94a9aba2dc2863bca1221d2c8714382a7eeea1cfda3fdcfcf24381b5ec4b14421897","method":"","user_agent":"","ja3":"","session":"e82cdd3f-8bd0-486e-8165-3c9870611952","seq":1,"duration_ms":100,"bytes_in":554,"bytes_out":13,"enriched":{"digest":"edb0401e7b19dfa2","strings":["AqRdC+","0gG7","76V ?","h2u2Nw",";!#W","Q?Y)=","bdtRw","eL.5"]}},{"timestamp":"2026-08-31T17:37:20","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<MG-3.01.4276ZRKOpY25","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4d472d332e30312e343237365a524b4f70593235","method":"","user_agent":"","ja3":"","session":"18c5e92b-16ff-4b7c-a1e4-bd44d1134544","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"61cc6ca3a515c096","strings":["BitTorrent protocol","<MG-3.01.4276ZRKOpY25"]}},{"timestamp":"2026-08-31T17:36:08","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"R�3\u0015\u0012\b�;�������e�5\b��\u001fW\u000b(kr���q䆧�;69�w&\u0014(��\t�vӥ��d�\u001c��ɖ\u001f�Э�5�$�6���Vs��^.=ߢ͋��%y���p`���Q�W�C\u001d�=���f!F����M�\u0005�0V��{\u0003Y\u0012\u0011�\u000fbA\u0017�f��l\r\u001f\u0005�\u001dCdA��\u00038<aJ\u0013\u0015���v~�CQ\u0006\nUSU���������� \"�i�\\��ߙ[P��;�2�OC����\u0011b�%\u0000���>��G�<���\u000f�Ow\u0005M�\\�`ш�q{\u000e\t~\u0018�s����q�\u000bb{���\u0007K�D�i�\u0001_e��\u0016M�\u001a�5'9\u001a�&�֖�\u001b��c�7�&r�\u0016TYK1\u001a278�����~��\u0004-��\u0007\u001bPs��(2�&\u0016ʋ����C����3\"�4\u001b�٨�{p�9L,��\u0011\u001cwZ��9p�m�V�}�h�/z\u0014������\u0014�%��|��T��n�\t�̅\u0001�d���ߪ)\u0017�/���o����d^\\�\u0012�\u0017,C\u0003�1ϧWSt�9H�QhDz�\u0003L�\"��\n���d\u00005�9:�$�q��$\b\tf�U\u001ak�ԃ�\u0007v��","payload_hex":"52b833151208853baeb0bba7ffffb465993508bdb91f570b286b7294f3d471e486a7d63b36399b77261428fa92099476d3a584a764f01cdfe2c9961ffad0ade335ab24ba3696b3ae5673d1d75e2e3ddfa2cd8b9b902579b7e6de7060869fc251ef57ad431d8e3d8de5cc662146fcb3fec64df305e2305690ce7b03591211ed0f6241178d66bdac6c0d1f05a51d436441acd203383c614a1315c5d8da767e9f4351060a555355bfadabadd3f8a58ffce320229669cf5cf2a8df995b50d2c53b9632d84f43a393c1b61162a32500acc1bb3e8bb1479d3cdaeb870f884f77054dec5cc260d18899717b0e097e18fa73d0eccfc171f30b627baae99d074b8c44fa699d015f65f18a164dd21aba3527391ace2690d696ba1bc5f663c637c02672c81654594b311a32373893a8a38dba7e80d7042dfb8d071b5073a5c72832be2616ca8bbc92b8dc43aca68baa3322c8341bc2d9a8967b7086394c2ce58c111c775a9ac23970906d9c56fc7d9a68dd2f7a14ac9bacab949814ce25b8807cc4e45486d26e9f09d2cc85019f64a9959adfaa2917ba2fb5fda96f87c6f7c8645e5cd012a0172c4303c231cfa7575374be3948f45168c7b2d5034cab22d0d40ac197f3640035bd393ab624ae718cf72408096681551a6bfbd483c00776d6ff","method":"","user_agent":"","ja3":"","session":"917b45fc-6821-4629-b8e2-1ff4d00e8bef","seq":1,"duration_ms":101,"bytes_in":474,"bytes_out":13,"enriched":{"digest":"2b14a01eb1103309","strings":["8<aJ","TYK1"]}},{"timestamp":"2026-08-31T17:34:56","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<MG-3.01.4276fkFilMUn","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4d472d332e30312e34323736666b46696c4d556e","method":"","user_agent":"","ja3":"","session":"9f60dcfe-efd8-4878-b299-521690ebc775","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"241d74e5a24ce4cb","strings":["BitTorrent protocol","<MG-3.01.4276fkFilMUn"]}},{"timestamp":"2026-08-31T17:33:45","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"7�'�Ĉ�~�\u001c$�����B\"YvI��3���*B�/G�\u000e�YN���\u00053T���q�����Ыަ����$��o�|�\u0017�|�xb͵��J\rD?�^1��=\u0006�K�%�8\u001c��|cf\u00171��t\u0014���􈮬_Bd��G�P��X\"؛�\u0019ء�\u0018o=\u0012S��","payload_hex":"379527acc488db7eee1c24879bd9f7f34222597649c8cb33b681f62a42a02f47af0ef8594ea48289053354eae9f471a596818ae3d0abdea6aef49cc324b8a86ff97c9e17fa7cfb7862cdb5e2b24a0d443fb85e31bab33d06b34bc325fb381ce6a67c63661731b7e37414eaaacdf488aeac5f426491b747d450e0e45822d89b9d19d8a18b186f3d1253b698","method":"","user_agent":"","ja3":"","session":"a68a7619-81a6-43bf-bc60-99bc3728fc9e","seq":1,"duration_ms":100,"bytes_in":139,"bytes_out":13,"enriched":{"digest":"f1a400457302f683","strings":["B\"YvI"]}},{"timestamp":"2026-08-31T17:32:34","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<MG-3.01.4276uqlwDkCG","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4d472d332e30312e3432373675716c77446b4347","method":"","user_agent":"","ja3":"","session":"a8bc55c1-e5f1-4d8d-aebf-a65b097a2637","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"82d068bb365312a2","strings":["BitTorrent protocol","<MG-3.01.4276uqlwDkCG"]}},{"timestamp":"2026-08-31T17:31:22","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��!\n?`�\u0002\u001a#W�a��x��@3,a|�`�\"�\u0004>\rm^�хV\u0007U��\u0002��q\u0015;�-\u0011#t�\\�a��P��`4Xx\u0001��U�\b56A��u���\u0018?��τ�Њ�x�®��5�B8x��`,㭨�q�v\t�\f\b:��\u001c/\u0003��\b\r��&!�\u001c#�����)N\u000e�g�\u000f�E^\rVd��J���\n���\u0019b�g����\u000b��㳿mBw6ː߃��\u0019H��`l�����oPְ\u0019��\u000f���\u0014\t\n4f\u0010��G�`��\u0010J~䗉V��T'����Z����G�͡`'���@U/:Ij�U�O:��3}��C{a\u0005K&�0\u0000U��\u0015e\u0001|[g���=\t\u0014��\bb��w����q�U\r2E,`����OYnp[�\u0019V\u001b���e�\b��g��K\u0002��/��=D\u0002��C���M��pE냙�-�\u00188r�\u0019Q�F�T�l�qr���\u001d����XSZ\u0013\b�S>۸`3�\t�ُ�K܏��A�,-�_�7�N\u0006�?/�\u0001$���P#]Ĕċ/\f\u00051�T��\u0005�~`#ݘ{��3���\b�JEߜ�T���y����ۿ�\u0012����\u000b\u0019�ݿ`��\u0006��\u001dB�\\j\u000e���=�\u0007�r5�l�\u0002z�rhY���|�_�\u0012\u000bu\u0013�h��\u0006�.Z","payload_hex":"ebcb210a3f60dc021a2357f761ec8878fce940332c617c9960e022e0043e0d6d5e93d185560755ecd702868f71153bcc2d112374bc5cd861bc8850f0a86034587801e4d955fe08353641e08e75fc948a183fd6decf84fdd08af27890c2ae96ac359842387891a9602ce3ada8be71be7609860c083ab6e51c2f03f29d080d939f2621b41c238892a3b2f7294e0ed567cd0ff1455e0d566487d14afec7e20ae0d0d31962b167cbffb49e0b9fcce3b3bf6d427736cb90df839e8219489ff5606cd5d6f9aa916f50d6b019f8940ffcdeee14090a347f66109dc447db60928c104a7ee4978956f8ff5427aee69af05abfb8fede47a2cda1602787a6a640552f7f3a496a9655e34f3ab1f6337d8d93437b61054b26a0300055fec11565017c5b67ae80c83d0914c0ae0862efd877abbe9a8871e2550d32452c60bdb1a5d84f596e705b8e19561baf85e765c108b19f67ad8c4b02e1af2ff0fe3d4402808643f0f5fe4de7967045eb8399f62d8d183872bd1951e746eb54ba6c9d7172a3ced91dac87d6f958535a130887533edbb86033fe09e5d98fb44bdc8ffdee41cd2c2da25f8637ff4e06ee3f2fe201249793a950235dc494c48b2f0c0531c254e6c905cb7e6023dd987b89ca33f7d2fa08bd4a45df9cbd54b7f59879afe3e2d3dbbfd212bdd7ff950b19cbddbf60f58d068db31d42eb5c6a0ebc98c23d90079d7235816cb2027ade726859aeb0a07ce15f9d120b7513d268f1d4068a2e5a","method":"","user_agent":"","ja3":"","session":"3ea6bb80-ced9-4105-98d4-59760542138e","seq":1,"duration_ms":100,"bytes_in":535,"bytes_out":13,"enriched":{"digest":"4f21ff45688fe9d1","strings":["@3,a|","`4Xx","mBw6","2E,`","OYnp["]}},{"timestamp":"2026-08-31T17:30:12","port":39131,"proto":"tcp","app_proto":"","app_protocol":"bittorrent","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0013BitTorrent protocol\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0005\u001b�R\u001f�ƸN�\u0011�Y�q\u0017|O�<MG-3.01.4276ctwbgAN5","payload_hex":"13426974546f7272656e742070726f746f636f6c00000000001800051bba521fdbc6b84ea3119a59eb71177f7c4fbc3c4d472d332e30312e343237366374776267414e35","method":"","user_agent":"","ja3":"","session":"3991c130-6737-4e29-a464-bc4a8b7f6a56","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"172a6e45e99aa7a8","strings":["BitTorrent protocol","<MG-3.01.4276ctwbgAN5"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-31T23:16:39.110783+00:00"}