52.174.47.89

As of: Jun 13, 2024 3:33am UTC | Latest
{
  "ip": "52.174.47.89",
  "services": [
    {
      "_decoded": "ssh",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "SSH-2.0-OpenSSH_7.4",
      "banner_hashes": [
        "sha256:be0da7ee170f9a69bc13b9e61ecfc9110c27db40f3f2e4c0ffae6741f064af8a"
      ],
      "banner_hex": "5353482d322e302d4f70656e5353485f372e34",
      "discovery_method": "PREDICTIVE_METHOD_12",
      "extended_service_name": "SSH",
      "labels": [
        "remote-access"
      ],
      "observed_at": "2024-06-10T15:02:25.209807598Z",
      "pending_removal_since": "2024-06-13T03:29:30.901363750Z",
      "perspective_id": "PERSPECTIVE_ORANGE",
      "port": 22,
      "service_name": "SSH",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:a:openbsd:openssh:7.4:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "OpenBSD",
          "product": "OpenSSH",
          "version": "7.4",
          "other": {
            "family": "OpenSSH"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.145.97",
      "ssh": {
        "endpoint_id": {
          "_encoding": {
            "raw": "DISPLAY_UTF8"
          },
          "raw": "SSH-2.0-OpenSSH_7.4",
          "protocol_version": "2.0",
          "software_version": "OpenSSH_7.4"
        },
        "kex_init_message": {
          "kex_algorithms": [
            "curve25519-sha256",
            "[email protected]",
            "ecdh-sha2-nistp256",
            "ecdh-sha2-nistp384",
            "ecdh-sha2-nistp521",
            "diffie-hellman-group-exchange-sha256",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group-exchange-sha1",
            "diffie-hellman-group14-sha256",
            "diffie-hellman-group14-sha1",
            "diffie-hellman-group1-sha1"
          ],
          "host_key_algorithms": [
            "ssh-rsa",
            "rsa-sha2-512",
            "rsa-sha2-256",
            "ecdsa-sha2-nistp256",
            "ssh-ed25519"
          ],
          "client_to_server_ciphers": [
            "[email protected]",
            "aes128-ctr",
            "aes192-ctr",
            "aes256-ctr",
            "[email protected]",
            "[email protected]",
            "aes128-cbc",
            "aes192-cbc",
            "aes256-cbc",
            "blowfish-cbc",
            "cast128-cbc",
            "3des-cbc"
          ],
          "server_to_client_ciphers": [
            "[email protected]",
            "aes128-ctr",
            "aes192-ctr",
            "aes256-ctr",
            "[email protected]",
            "[email protected]",
            "aes128-cbc",
            "aes192-cbc",
            "aes256-cbc",
            "blowfish-cbc",
            "cast128-cbc",
            "3des-cbc"
          ],
          "client_to_server_macs": [
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "hmac-sha2-256",
            "hmac-sha2-512",
            "hmac-sha1"
          ],
          "server_to_client_macs": [
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "hmac-sha2-256",
            "hmac-sha2-512",
            "hmac-sha1"
          ],
          "client_to_server_compression": [
            "none",
            "[email protected]"
          ],
          "server_to_client_compression": [
            "none",
            "[email protected]"
          ],
          "first_kex_follows": false
        },
        "algorithm_selection": {
          "kex_algorithm": "[email protected]",
          "host_key_algorithm": "ecdsa-sha2-nistp256",
          "client_to_server_alg_group": {
            "cipher": "aes128-ctr",
            "mac": "hmac-sha2-256",
            "compression": "none"
          },
          "server_to_client_alg_group": {
            "cipher": "aes128-ctr",
            "mac": "hmac-sha2-256",
            "compression": "none"
          }
        },
        "server_host_key": {
          "fingerprint_sha256": "4dafbafc16e5e17d5ae355a3423f67a94a329d053993ac4632a2ad35c10dd8db",
          "ecdsa_public_key": {
            "_encoding": {
              "b": "DISPLAY_BASE64",
              "gx": "DISPLAY_BASE64",
              "gy": "DISPLAY_BASE64",
              "n": "DISPLAY_BASE64",
              "p": "DISPLAY_BASE64",
              "x": "DISPLAY_BASE64",
              "y": "DISPLAY_BASE64"
            },
            "b": "WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=",
            "curve": "P-256",
            "gx": "axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=",
            "gy": "T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=",
            "length": 256,
            "n": "/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=",
            "p": "/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=",
            "x": "eIbDqVFgvklnMsDUHhW1yRgjMKjlAIZwYyMEqoxkqrI=",
            "y": "dUExMulaVqowScct6NexDlwWvMN4O4wCZJXmAYtA0wE="
          }
        },
        "hassh_fingerprint": "6832f1ce43d4397c2c0a3e2f8c94334e"
      },
      "transport_fingerprint": {
        "raw": "28960,64,true,MSTNW,1440,false,false"
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "rdp",
      "_encoding": {
        "certificate": "DISPLAY_HEX"
      },
      "certificate": "887a8892f2a6833bc5a3e378398ba837f2771d6b0f44d0efed18c147addcac76",
      "discovery_method": "IPV4_WALK_CLOUD_PRIORITY_1",
      "extended_service_name": "RDP",
      "jarm": {
        "_encoding": {
          "fingerprint": "DISPLAY_HEX",
          "cipher_and_version_fingerprint": "DISPLAY_HEX",
          "tls_extensions_sha256": "DISPLAY_HEX"
        },
        "fingerprint": "2ad2ad0002ad2ad0002ad2ad2ad2adf9fdf4eeac344e8b5003264da73585be",
        "cipher_and_version_fingerprint": "2ad2ad0002ad2ad0002ad2ad2ad2ad",
        "tls_extensions_sha256": "f9fdf4eeac344e8b5003264da73585be",
        "observed_at": "2024-06-10T14:20:05.988741303Z"
      },
      "labels": [
        "network-administration",
        "remote-access"
      ],
      "observed_at": "2024-06-10T13:17:47.800842640Z",
      "pending_removal_since": "2024-06-13T03:33:02.293878427Z",
      "perspective_id": "PERSPECTIVE_NTT_2",
      "port": 3389,
      "rdp": {
        "protocol_flags": {
          "extended_client_data_supported": true,
          "dynvc_graphics_pipeline": true,
          "neg_resp_reserved": true,
          "restricted_admin_mode": true,
          "restricted_auth_mode": true
        },
        "selected_security_protocol": {
          "rdstls": true,
          "raw_value": 4,
          "standard_rdp": false,
          "tls": false,
          "credssp": false,
          "credssp_early_auth": false,
          "error": false,
          "error_ssl_required": false,
          "error_ssl_forbidden": false,
          "error_ssl_cert_missing": false,
          "error_bad_flags": false,
          "error_hybrid_required": false,
          "error_ssl_user_auth_required": false,
          "error_unknown": false
        },
        "x224_cc_pdu_srcref": 13330
      },
      "service_name": "RDP",
      "source_ip": "199.45.155.60",
      "tls": {
        "version_selected": "TLSv1_2",
        "cipher_selected": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "887a8892f2a6833bc5a3e378398ba837f2771d6b0f44d0efed18c147addcac76",
          "leaf_data": {
            "subject_dn": "CN=labvm-1368367",
            "issuer_dn": "CN=labvm-1368367",
            "pubkey_bit_size": 2048,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "bff669c609bc1843599e454672bb6815a428da7d408311f039cfb1eb04acba8d",
            "fingerprint": "887a8892f2a6833bc5a3e378398ba837f2771d6b0f44d0efed18c147addcac76",
            "issuer": {
              "common_name": [
                "labvm-1368367"
              ]
            },
            "subject": {
              "common_name": [
                "labvm-1368367"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "o/9YWYZJWTHGSx2tt+d0P2e932jFzP1StSxfq43W3swvPvNWRqSUmGaq21IFlsrkjycUdKLLck5YBUXstdJ+0ZZSOSR3rz/4nVOPKcksPQ8xFDh+dPw25ZiVSvXu34k29qQcghddGmgrYn8xvuKH8LZuMbEJspIB7bH1FzcX+mteDXukoo9vfZIIUTIZ3E3sgT7e/dE2y9tc/tgk7eSXa5y0hi+CbA6+Ba4X6ia0dWRU0j+kThX7OOcgQ5dHMpHflJqe4bjNV9SMTPfNmkD+uWYqr4swMPaJr/olnl9mg9Wi8euXLEpMxVN8JD1Ahl9FGS/YrusH/hPPgnyQU7xg0Q==",
                "exponent": "AAEAAQ==",
                "length": 256
              },
              "fingerprint": "5bad73d011549ff341c66204fd63156ad4c47721c6e765ceb865721478174856"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "server_key_exchange": {
          "ec_params": {
            "named_curve": 24
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "364ff14b04ef93c3b4cfa429d729c0d9",
        "ja4s": "t120100_c030_437cb43a3022",
        "versions": [
          {
            "tls_version": "TLSv1_2",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "364ff14b04ef93c3b4cfa429d729c0d9",
            "ja4s": "t120100_c030_437cb43a3022"
          }
        ]
      },
      "transport_fingerprint": {
        "raw": "64000,128,true,MNWST,1440,false,false"
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "http",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "HTTP/1.1 200 Ok\r\nContent-Type: text/html\r\nCache-Control: no-cache\r\nConnection: close\r\nRefresh: 5;url=/\r\n",
      "banner_hashes": [
        "sha256:02ba04f603adb42599b9bf60ea1f3b3457fe1caa77fbaab94b728fc09c171ece"
      ],
      "banner_hex": "485454502f312e3120323030204f6b0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20636c6f73650d0a526566726573683a20353b75726c3d2f0d0a",
      "certificate": "09d43e67ab96902464494c644fc957b053c6b20eb378e3fdb08883f7fc158127",
      "discovery_method": "PREDICTIVE_METHOD_12",
      "extended_service_name": "HTTPS",
      "http": {
        "request": {
          "method": "GET",
          "uri": "https://52.174.47.89:6854/",
          "headers": {
            "User_Agent": [
              "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
            ],
            "_encoding": {
              "User_Agent": "DISPLAY_UTF8",
              "Accept": "DISPLAY_UTF8"
            },
            "Accept": [
              "*/*"
            ]
          }
        },
        "response": {
          "protocol": "HTTP/1.1",
          "status_code": 200,
          "status_reason": "Ok",
          "headers": {
            "Cache_Control": [
              "no-cache"
            ],
            "_encoding": {
              "Cache_Control": "DISPLAY_UTF8",
              "Refresh": "DISPLAY_UTF8",
              "Content_Type": "DISPLAY_UTF8",
              "Connection": "DISPLAY_UTF8"
            },
            "Refresh": [
              "5;url=/"
            ],
            "Content_Type": [
              "text/html"
            ],
            "Connection": [
              "close"
            ]
          },
          "_encoding": {
            "html_tags": "DISPLAY_UTF8",
            "body": "DISPLAY_UTF8",
            "body_hash": "DISPLAY_UTF8",
            "html_title": "DISPLAY_UTF8"
          },
          "html_tags": [
            "<title>PowerMTA monitoring</title>"
          ],
          "body_size": 3976,
          "body": "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\"\n    \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n<html><head><title>PowerMTA monitoring</title>\n<link rel=\"stylesheet\" type=\"text/css\" media=\"all\" href=\"css.css\"/>\n</head>\n<body>\n<!-- BEGIN TOP NAV/HEADER -->\n<div class=\"header\">\n<table width=100% cellspacing=0 cellpadding=0 border=0><tr>\n    <td align=left width=81><a href=\"http://www.port25.com\"><img src=\"logo.gif\" border=\"0\" vspace=\"2\" hspace=\"3\"></a></td>\n    <td align=right><table width=100% cellspacing=0 cellpadding=0 border=0>\n        <tr><td align=right class=title>PowerMTA&trade; 4.0r8&nbsp;</td></tr>\n        <tr><td align=right>mail.officespot.com&nbsp;</td></tr>\n    </table></td>\n</tr></table>\n<table class=menu cellspacing=0 cellpadding=0>\n<tr>\n<td><a href=/ class=selected>Home</a></td>\n<td><a href=status>Status</a></td>\n<td><a href=queues>Queues</a></td>\n<td><a href=domains>Domains</a></td>\n<td><a href=vmtas>Virtual MTAs</a></td>\n<td><a href=jobs>Jobs</a></td>\n<td><a href=logs>Logs</a></td>\n</tr>\n</table>\n</div>\n<!-- END TOP NAV/HEADER -->\n\n<p/>\n<table>\n<tr><td colspan=3 align=right><a href=\"homeHelp\" target=\"help\" onclick=\"popWin = open('homeHelp','help','height=600,width=595,resizable=yes,menubar=no,status=no,toolbar=no,location=no,scrollbars=yes');popWin.focus();return false\">Help</a></td></tr>\n<tr>\n<td width=340>\n      <table class=data border=0 cellspacing=0 cellpadding=3>\n        <tr><th colspan=3 class=c>Traffic Totals</th></tr>\n        <tr><th width=30%>&nbsp;</th>\n            <th width=30%>in</th>\n            <th width=30%>out</th>\n        </tr>\n        <tr>\n            <th>total</th>\n            <td>0</td>\n            <td>0</td>\n        </tr>\n        <tr>\n            <th>last hour</th>\n            <td>0</td>\n            <td>0</td>\n        </tr>\n        <tr>\n            <th>top/hour</th>\n            <td>0</td>\n            <td>0</td>\n        </tr>\n        <tr>\n            <th>last minute</td>\n            <td>0</td>\n            <td>0</td>\n        </tr>\n        <tr>\n            <th>top/minute</th>\n            <td>0</td>\n            <td>0</td>\n        </tr>\n      </table>\n</td>\n<td width=10>&nbsp;</td>\n<td width=350>\n      <table class=data border=0 cellspacing=0 cellpadding=3>\n        <tr><th colspan=4 class=c>Top Domains in the Queue</th></tr>\n        <tr><th class=l width=\"40%\">name</th>\n            <th>recipients</th>\n            <th>% total</th>\n            <th>conns.</th>\n        </tr>\n      </table>\n</td></tr>\n<tr>\n    <td><table class=data border=0 cellspacing=0 cellpadding=3>\n        <tr><th class=c colspan=3>Active Connections</th></tr>\n        <tr><th width=30%>&nbsp;</th>\n            <th width=30%>in</th>\n            <th width=30%>out</th>\n        </tr>\n        <tr><th>SMTP</th>\n            <td>0</th>\n            <td>0</th>\n        </tr>\n    </table></td>\n    <td>&nbsp;</td>\n    <td><table class=data border=0 cellspacing=0 cellpadding=3>\n        <tr><th class=c colspan=3>Queue Totals</th></tr>\n        <tr><th width=40%>recipients</th>\n            <th width=40%>max</th>\n            <th>% max</th>\n        </tr>\n        <tr><td>0</th>\n            <td>720,000</th>\n            <td>0%</th>\n        </tr>\n    </table></td>\n</tr>\n    <tr><td>\n        <h2>Administration</h2>\n        <a href=\"editConfig?returnUrl=/\">Edit configuration</a><br/>\n        <a href=\"enterLak\">Show/enter license key</a><br/>\n        <a href=\"command\">Run command</a><br/>\n    </td>\n    <td>&nbsp;</td>\n    <td>\n        <h2>Resources</h2>\n        <a href=\"getFile?file=UsersGuide.pdf&disposition=inline\" target=\"_blank\">User's Guide</a><br/>\n        <a href=\"mailto:[email protected]?body=&lt;your message here&gt;%0a%0aVersion: 4.0r8%0aBuilt: 2012-09-10 17:27:12%0aPlatform: Linux 3.10.0-1160.118.1.el7.x86_64 CentOS Linux release 7.9.2009 (Core) x86_64%0aSerial: Elysium3-5-316904\">Port25 Support</a><br/>\n    \n    </td></tr>\n    <!-- END INFO SECTION-->\n</td></tr>\n</table>\n\n</body>\n</html>\n",
          "body_hashes": [
            "sha256:d4cf1db961a7ac4982a8436c98e0474eca67643d2f45c1914e071c210e46c9ed",
            "sha1:88e2cf15e6c430a17f5a08a707acf63b1f9a851f"
          ],
          "body_hash": "sha1:88e2cf15e6c430a17f5a08a707acf63b1f9a851f",
          "html_title": "PowerMTA monitoring"
        },
        "supports_http2": false
      },
      "observed_at": "2024-06-10T15:02:34.371111024Z",
      "pending_removal_since": "2024-06-13T03:23:58.645444880Z",
      "perspective_id": "PERSPECTIVE_ORANGE",
      "port": 6854,
      "service_name": "HTTP",
      "source_ip": "167.94.145.97",
      "tls": {
        "version_selected": "TLSv1_0",
        "cipher_selected": "TLS_RSA_WITH_AES_128_CBC_SHA",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "09d43e67ab96902464494c644fc957b053c6b20eb378e3fdb08883f7fc158127",
          "leaf_data": {
            "names": [
              "mail.officespot.com"
            ],
            "subject_dn": "CN=mail.officespot.com",
            "issuer_dn": "CN=mail.officespot.com",
            "pubkey_bit_size": 1024,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "2387339e226028caf1cecb069187a0b05a7395ad9cdc25ed5413df2b6cc45fac",
            "fingerprint": "09d43e67ab96902464494c644fc957b053c6b20eb378e3fdb08883f7fc158127",
            "issuer": {
              "common_name": [
                "mail.officespot.com"
              ]
            },
            "subject": {
              "common_name": [
                "mail.officespot.com"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "uF1hl06Qe2VUnWoQXEdwQhsJ1EG9lOGqX/9eYBRySojdiK6o38HVm6/ftngovrAJzcmWE+WF9zcR64T1x/2BJ3TD+vSjQzIFNmMkmxNRawvOmPrqYWB/5p/2TGnqfto7C8NmEvbtJRHE7wCVhf0LwJqSUQ22RCTTyGKdxDlJ+Bc=",
                "exponent": "AAEAAQ==",
                "length": 128
              },
              "fingerprint": "1c51e06c102e28dac3eed7f94078ded81dfba2ce2a8d56a6471ff014003aaea6"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA1-RSA"
            }
          }
        },
        "session_ticket": {
          "length": 176,
          "lifetime_hint": 0
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "4ea82b75038dd27e8a1cb69d8b839b26",
        "ja4s": "t100200_002f_ca0ca9e4ffed",
        "versions": [
          {
            "tls_version": "TLSv1_0",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "4ea82b75038dd27e8a1cb69d8b839b26",
            "ja4s": "t100200_002f_ca0ca9e4ffed"
          }
        ]
      },
      "transport_protocol": "TCP",
      "truncated": false
    }
  ],
  "location": {
    "continent": "Europe",
    "country": "Netherlands",
    "country_code": "NL",
    "city": "Amsterdam",
    "postal_code": "1012",
    "timezone": "Europe/Amsterdam",
    "province": "North Holland",
    "coordinates": {
      "latitude": 52.37403,
      "longitude": 4.88969
    }
  },
  "location_updated_at": "2024-06-05T07:11:01.418808736Z",
  "autonomous_system": {
    "asn": 8075,
    "description": "MICROSOFT-CORP-MSN-AS-BLOCK",
    "bgp_prefix": "52.160.0.0/11",
    "name": "MICROSOFT-CORP-MSN-AS-BLOCK",
    "country_code": "US"
  },
  "autonomous_system_updated_at": "2024-06-05T07:11:01.419036604Z",
  "whois": {
    "network": {
      "handle": "MSFT",
      "name": "Microsoft Corporation",
      "cidrs": [
        "52.145.0.0/16",
        "52.146.0.0/15",
        "52.148.0.0/14",
        "52.152.0.0/13",
        "52.160.0.0/11"
      ],
      "created": "2015-11-24T00:00:00Z",
      "updated": "2021-12-14T00:00:00Z",
      "allocation_type": "ALLOCATION"
    },
    "organization": {
      "handle": "MSFT",
      "name": "Microsoft Corporation",
      "street": "One Microsoft Way",
      "city": "Redmond",
      "state": "WA",
      "postal_code": "98052",
      "country": "US",
      "abuse_contacts": [
        {
          "handle": "MAC74-ARIN",
          "name": "Microsoft Abuse Contact",
          "email": "[email protected]"
        }
      ],
      "admin_contacts": [
        {
          "handle": "IPHOS5-ARIN",
          "name": "IPHostmaster IPHostmaster",
          "email": "[email protected]"
        }
      ],
      "tech_contacts": [
        {
          "handle": "BEDAR6-ARIN",
          "name": "Dawn Bedard",
          "email": "[email protected]"
        },
        {
          "handle": "IPHOS5-ARIN",
          "name": "IPHostmaster IPHostmaster",
          "email": "[email protected]"
        },
        {
          "handle": "KIMAV-ARIN",
          "name": "Avery Kim",
          "email": "[email protected]"
        },
        {
          "handle": "MRPD-ARIN",
          "name": "Microsoft Routing, Peering, and DNS",
          "email": "[email protected]"
        },
        {
          "handle": "SINGH683-ARIN",
          "name": "Prachi Singh",
          "email": "[email protected]"
        }
      ]
    }
  },
  "dns": {},
  "last_updated_at": "2024-06-13T03:33:20.233Z",
  "labels": [
    "network-administration",
    "remote-access"
  ]
}