{"ip":"45.156.128.5","total_events":26,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"bitsight","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (bitsight).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,224 bytes sent","bytes_sent":1224,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-17T15:37:27","last_seen":"2026-09-20T01:53:18","events_24h":0,"events_7d":2,"geo":{"country_code":"PT","country_name":"Portugal","region":"","city":"","lat":38.7057,"lon":-9.1359,"asn":211680,"org":"Sistemas Informaticos, S.A."},"source_domain":"sh-ams-nl-gp5-wk102a.internet-census.org","known_scanners":["bitsight","Internet Census"],"scanner_tag":{"key":"internet-census","label":"Internet Census","category":"research","url":"https://internet-census.org/"},"cve_matches":[],"malware":[],"top_ports":[{"port":465,"proto":"tcp","label":"SMTPS","count":11},{"port":587,"proto":"tcp","label":"SMTP","count":9},{"port":25,"proto":"tcp","label":"SMTP","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130700_2d7513195f68_ac8bd4dd6c01"],"tls_client_hello":"","tls_ja3":["caaddd3ed0a315543d761490b01b08e0"],"http_akin":[]},"fingerprint_peers":{"t12i130700_2d7513195f68_ac8bd4dd6c01":71},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-06-28","count":2},{"date":"2026-07-15","count":2},{"date":"2026-07-16","count":2},{"date":"2026-08-01","count":3},{"date":"2026-08-04","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-13","count":2},{"date":"2026-08-27","count":1},{"date":"2026-08-29","count":1},{"date":"2026-08-30","count":1},{"date":"2026-09-01","count":1},{"date":"2026-09-06","count":1},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":1},{"date":"2026-09-14","count":1},{"date":"2026-09-17","count":1},{"date":"2026-09-20","count":1}],"recent_events":[{"timestamp":"2026-09-20T01:53:18","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"0c2a26bf-54c2-40dd-ba58-620551cf1f21","seq":1,"duration_ms":194,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-09-17T21:16:55","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"d6af0c27-d374-4128-8862-b49409484cfd","seq":1,"duration_ms":108,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-09-14T11:22:55","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"8f594d4d-653f-4580-a2cc-dbf749f2aaff","seq":1,"duration_ms":194,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-09-10T16:42:14","port":587,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000�c�L̕�����3ь�ف","payload_hex":"802e0100020015000000100500800300800100800700c006004004008002008063ed4ccc95e2e6e9fe9333d18ce0d981","method":"","user_agent":"","ja3":"","session":"1d20fced-871f-4294-b9fe-6ebe844039dc","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40},{"timestamp":"2026-09-08T21:41:54","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"73ff571b-e76b-4ddd-86c0-2f28e9fcfed5","seq":1,"duration_ms":109,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-09-06T08:47:12","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"4deb1969-67bb-42ed-9605-629d61f7e6a5","seq":1,"duration_ms":108,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-09-01T16:49:06","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"4fe04706-4d84-4ed9-85f8-9c51924c9c28","seq":1,"duration_ms":194,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-08-30T20:25:20","port":587,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000�{�<������wUZ\u0018�\u000f�","payload_hex":"802e0100020015000000100500800300800100800700c00600400400800200807bb23cadf69cc1b1b777555a18920ff1","method":"","user_agent":"","ja3":"","session":"b2c5c404-c9ef-4272-92e9-3e1f86a43e86","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40},{"timestamp":"2026-08-29T15:37:47","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"16ab8aed-497f-4260-860d-9c301d4a0e3e","seq":1,"duration_ms":107,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-08-27T00:18:49","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"7eb68d68-8019-4b96-9beb-eb4cbd6383e3","seq":1,"duration_ms":193,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-24T13:01:38.729142+00:00"}