{"ip":"45.11.230.136","total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"enterprise","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"122 bytes sent","bytes_sent":122,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-28T20:58:56","last_seen":"2026-09-28T20:58:58","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.018,"lon":-77.539,"asn":152586,"org":"Kuroit"},"source_domain":"136.230.11.45.us.kuroit.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as152586","label":"Kuroit (India)","category":"enterprise","url":"https://www.peeringdb.com/asn/152586"},"cve_matches":[],"malware":[],"top_ports":[{"port":5038,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-28","count":2}],"recent_events":[{"timestamp":"2026-09-28T20:58:58","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: admin\r\nSecret: admin\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a2061646d696e0d0a5365637265743a2061646d696e0d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"020e0ff1-97ce-4e1f-a5bc-864fa7d12f76","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":13,"enriched":{"digest":"6aaa74ae010478f0","strings":["Action: Login","Username: admin","Secret: admin","Events: off"]}},{"timestamp":"2026-09-28T20:58:56","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: cron\r\nSecret: 1234\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a2063726f6e0d0a5365637265743a20313233340d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"0eb706be-33ff-47f3-93eb-4e8c882dbca2","seq":1,"duration_ms":101,"bytes_in":60,"bytes_out":13,"enriched":{"digest":"bd9587ccb1414d8d","strings":["Action: Login","Username: cron","Secret: 1234","Events: off"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T18:35:48.575651+00:00"}