{"ip":"45.156.128.6","total_events":6,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"bitsight","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (bitsight).","Known research and commercial scanners are labelled as such, not as threats."]},"first_seen":"2026-06-21T21:17:47","last_seen":"2026-07-03T05:31:40","events_24h":0,"events_7d":3,"geo":{"country_code":"PT","country_name":"Portugal","region":"","city":"","lat":38.7057,"lon":-9.1359,"asn":211680,"org":"Sistemas Informaticos, S.A."},"source_domain":"sh-ams-nl-gp5-wk102b.internet-census.org","known_scanners":["bitsight","Internet Census"],"scanner_tag":{"key":"internet-census","label":"Internet Census","category":"research","url":"https://internet-census.org/"},"cve_matches":[],"malware":[],"top_ports":[{"port":25,"proto":"tcp","label":"SMTP","count":2},{"port":465,"proto":"tcp","label":"SMTPS","count":2},{"port":587,"proto":"tcp","label":"SMTP","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130700_2d7513195f68_ac8bd4dd6c01"],"tls_ja3":["caaddd3ed0a315543d761490b01b08e0"],"ja4h":[]},"fingerprint_peers":{"t12i130700_2d7513195f68_ac8bd4dd6c01":59},"user_agents":[],"timeline":[{"date":"2026-06-21","count":1},{"date":"2026-06-22","count":1},{"date":"2026-06-27","count":1},{"date":"2026-06-30","count":2},{"date":"2026-07-03","count":1}],"recent_events":[{"timestamp":"2026-07-03T05:31:40","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:8UBilbhvXiSlpVkrVF2KfoPQmB8=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"6570dc25-514d-4e31-930f-732004caaaa3","seq":1,"duration_ms":193,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-06-30T11:54:13","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000�\u000e�yY���A\"���\r�\u0000�","payload_hex":"802e0100020015000000100500800300800100800700c00600400400800200800efa79599090a64122d2fdd80d9200d7","method":"","user_agent":"","community_id":"1:qjhp/5w9KSpQc7DEOA04/elvBZs=","ja3":"","session":"c78d4471-5919-4065-85a1-acf5b4cfa950","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40},{"timestamp":"2026-06-30T11:54:09","port":25,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:f07nXXP4Zy7wMLA/3Z2tLX+1S3c=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"384e55f7-3f00-43b4-a762-e93088024870","seq":1,"duration_ms":193,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-06-27T16:14:01","port":587,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"EHLO sh-ams-nl-gp5-wk102.internet-census.org\r\n","payload_hex":"45484c4f2073682d616d732d6e6c2d6770352d776b3130322e696e7465726e65742d63656e7375732e6f72670d0a","method":"","user_agent":"","community_id":"1:HZWIvaNFUI/CrgaSnly6nYw5neA=","ja3":"caaddd3ed0a315543d761490b01b08e0","session":"75261931-c808-4f1d-bc8b-8272f09478cc","seq":1,"duration_ms":107,"bytes_in":46,"bytes_out":40,"enriched":{"digest":"fbb6ec662a2416f4","label":"SMTP","strings":["EHLO sh-ams-nl-gp5-wk102.internet-census.org"],"iocs":{"domains":["sh-ams-nl-gp5-wk102.internet-census.org"]}}},{"timestamp":"2026-06-22T14:20:14","port":465,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000��Wߨ)�\u0019f��\u001a!y\u001d�g","payload_hex":"802e0100020015000000100500800300800100800700c00600400400800200809157dfa829c91966d0ee1a21791da467","method":"","user_agent":"","community_id":"1:WTe+0hxKRQJMh3S9VIxVGQNB3xI=","ja3":"","session":"ec6af90c-5c48-489b-bd76-1ea9913cc3d6","seq":1,"duration_ms":101,"bytes_in":48,"bytes_out":40},{"timestamp":"2026-06-21T21:17:47","port":465,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�.\u0001\u0000\u0002\u0000\u0015\u0000\u0000\u0000\u0010\u0005\u0000�\u0003\u0000�\u0001\u0000�\u0007\u0000�\u0006\u0000@\u0004\u0000�\u0002\u0000�\u0018���\u000e��o�oL��~Q}","payload_hex":"802e0100020015000000100500800300800100800700c0060040040080020080188cbefb0ea6bd6f8f6f4cb7c87e517d","method":"","user_agent":"","community_id":"1:ten7QTcBj9Afb30uzDUGrHYvd7k=","ja3":"","session":"f9476ce2-c1a9-4f81-99a6-f1e1c7a05934","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":40}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-05T21:17:36.832483+00:00"}