{"ip":"109.105.210.77","total_events":8,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"bitsight","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (bitsight).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-06-12T13:56:18","last_seen":"2026-07-02T01:13:38","events_24h":0,"events_7d":6,"geo":{"country_code":"PT","country_name":"Portugal","region":"","city":"","lat":38.7057,"lon":-9.1359,"asn":21859,"org":"Zenlayer Inc"},"source_domain":"zl-dfwc-us-gp5-wk101a.internet-census.org","known_scanners":["bitsight","Internet Census"],"scanner_tag":{"key":"internet-census","label":"Internet Census","category":"research","url":"https://internet-census.org/"},"cve_matches":[],"malware":[],"top_ports":[{"port":587,"proto":"tcp","label":"SMTP","count":5},{"port":25,"proto":"tcp","label":"SMTP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130700_2d7513195f68_ac8bd4dd6c01"],"tls_ja3":["caaddd3ed0a315543d761490b01b08e0"],"ja4h":[]},"fingerprint_peers":{"t12i130700_2d7513195f68_ac8bd4dd6c01":61},"user_agents":[],"timeline":[{"date":"2026-06-12","count":1},{"date":"2026-06-25","count":1},{"date":"2026-07-01","count":4},{"date":"2026-07-02","count":2}],"recent_events":[{"timestamp":"2026-07-02T01:13:38","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000��t�oճ\u0003ў^;����g","payload_hex":"802e0100020015000000100500800300800100800700c0060040040080020080d174d86fd5b303d19e5e3bb6b694f367","method":"","user_agent":"","community_id":"1:U8CAtmXfC315EiSJ5i7mOxASgKY=","ja3":"","session":"cc088a4a-c587-4b1f-b79b-d104c2d61350","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40},{"timestamp":"2026-07-02T01:13:37","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO zl-dfwc-us-gp5-wk101.internet-census.org\r\n","payload_hex":"45484c4f207a6c2d646677632d75732d6770352d776b3130312e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:cebNDwgdEb323rbYjiL0j8J69mk=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"4db47b1f-65bd-425f-b469-5ab36409449c","seq":1,"duration_ms":123,"bytes_in":47,"bytes_out":40,"enriched":{"digest":"8aea90283ec24a95","label":"SMTP","strings":["EHLO zl-dfwc-us-gp5-wk101.internet-census.org"],"iocs":{"domains":["zl-dfwc-us-gp5-wk101.internet-census.org"]}}},{"timestamp":"2026-07-01T19:10:12","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","community_id":"1:GqYhqosTVKWrjXNj0ySOEPz7eE8=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"6a450cfe-9f0d-413e-b6f2-ba85cac24278","seq":2,"duration_ms":379,"bytes_in":53,"bytes_out":54,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-07-01T19:10:12","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO zl-dfwc-us-gp5-wk101.internet-census.org\r\n","payload_hex":"45484c4f207a6c2d646677632d75732d6770352d776b3130312e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:GqYhqosTVKWrjXNj0ySOEPz7eE8=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"6a450cfe-9f0d-413e-b6f2-ba85cac24278","seq":1,"duration_ms":240,"bytes_in":47,"bytes_out":40,"enriched":{"digest":"8aea90283ec24a95","label":"SMTP","strings":["EHLO zl-dfwc-us-gp5-wk101.internet-census.org"],"iocs":{"domains":["zl-dfwc-us-gp5-wk101.internet-census.org"]}}},{"timestamp":"2026-07-01T08:47:06","port":587,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000���Ϙ5T�\t�c+29\u000e}�","payload_hex":"802e0100020015000000100500800300800100800700c0060040040080020080ffb6cf983554c609cf632b32390e7d93","method":"","user_agent":"","community_id":"1:X/4S4nLQIO86dgCOGJdb94g1+CY=","ja3":"","session":"35558968-0450-4750-89a1-376f81b6b637","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40,"enriched":{"digest":"d011b8ee69126cd5","strings":["c+29"]}},{"timestamp":"2026-07-01T08:47:01","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO zl-dfwc-us-gp5-wk101.internet-census.org\r\n","payload_hex":"45484c4f207a6c2d646677632d75732d6770352d776b3130312e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:So2VlamzCONMSM7iEgir8J75BlI=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"4e4e63b1-da77-4f1c-a031-214ef17da039","seq":1,"duration_ms":122,"bytes_in":47,"bytes_out":40,"enriched":{"digest":"8aea90283ec24a95","label":"SMTP","strings":["EHLO zl-dfwc-us-gp5-wk101.internet-census.org"],"iocs":{"domains":["zl-dfwc-us-gp5-wk101.internet-census.org"]}}},{"timestamp":"2026-06-25T02:16:14","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO zl-dfwc-us-gp5-wk101.internet-census.org\r\n","payload_hex":"45484c4f207a6c2d646677632d75732d6770352d776b3130312e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:oN/bqqc6QbY+/pteSVhg0ukm3z0=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"844ad987-014a-4268-aa47-0d5c27ea4fb0","seq":1,"duration_ms":123,"bytes_in":47,"bytes_out":40,"enriched":{"digest":"8aea90283ec24a95","label":"SMTP","strings":["EHLO zl-dfwc-us-gp5-wk101.internet-census.org"],"iocs":{"domains":["zl-dfwc-us-gp5-wk101.internet-census.org"]}}},{"timestamp":"2026-06-12T13:56:18","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000�Nt2g�\u0019\u0002U�\\_��\u0006v\\","payload_hex":"802e0100020015000000100500800300800100800700c00600400400800200804e743267d0190255aa5c5f93c806765c","method":"","user_agent":"","community_id":"1:sQWd+WBxZhGZp/Mo31O8UlITdjw=","ja3":"","session":"fb7e1dde-2b2c-40e2-9b10-e462cf600d31","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40,"enriched":{"digest":"659f31aaca5044e8","strings":["Nt2g"]}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-04T19:17:40.756427+00:00"}