91.231.1.41

As of: May 13, 2025 2:08pm UTC | Latest
{
  "ip": "91.231.1.41",
  "services": [
    {
      "_decoded": "smtp",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "220-mail.segodnya.ua ESMTP Postfix\r\n521 5.7.1 Service unavailable; client [162.142.125.209] blocked using zen.spamhaus.org\r\n",
      "banner_hashes": [
        "sha256:ade0f99380219550297b8b04fc8568c53e76c54d80b911b27ab38218d27af103"
      ],
      "banner_hex": "3232302d6d61696c2e7365676f646e79612e75612045534d545020506f73746669780d0a35323120352e372e31205365727669636520756e617661696c61626c653b20636c69656e74205b3136322e3134322e3132352e3230395d20626c6f636b6564207573696e67207a656e2e7370616d686175732e6f72670d0a",
      "discovery_method": "PREDICTIVE_METHOD_15",
      "extended_service_name": "SMTP",
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-13T04:35:34.839489588Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 25,
      "service_name": "SMTP",
      "smtp": {
        "_encoding": {
          "banner": "DISPLAY_UTF8"
        },
        "banner": "220-mail.segodnya.ua ESMTP Postfix\r\n521 5.7.1 Service unavailable; client [162.142.125.209] blocked using zen.spamhaus.org\r\n"
      },
      "source_ip": "162.142.125.209",
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "http",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "HTTP/1.1 301 Moved Permanently\r\nServer: nginx\r\nDate:  <REDACTED>\r\nContent-Type: text/html\r\nContent-Length: 178\r\nConnection: keep-alive\r\nLocation: https://91.231.1.41/\r\nX-Frame-Options: sameorigin\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nX-Download-Options: noopen\r\nX-Permitted-Cross-Domain-Policies: none\r\nContent-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'\r\nReferrer-Policy: strict-origin\r\n",
      "banner_hashes": [
        "sha256:2dda3d5308912c088326ecb4d32fb805bde3388362843321259f9bdb145e21fd"
      ],
      "banner_hex": "485454502f312e3120333031204d6f766564205065726d616e656e746c790d0a5365727665723a206e67696e780d0a446174653a20203c52454441435445443e0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a203137380d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4c6f636174696f6e3a2068747470733a2f2f39312e3233312e312e34312f0d0a582d4672616d652d4f7074696f6e733a2073616d656f726967696e0d0a582d436f6e74656e742d547970652d4f7074696f6e733a206e6f736e6966660d0a582d5853532d50726f74656374696f6e3a20313b206d6f64653d626c6f636b0d0a582d446f776e6c6f61642d4f7074696f6e733a206e6f6f70656e0d0a582d5065726d69747465642d43726f73732d446f6d61696e2d506f6c69636965733a206e6f6e650d0a436f6e74656e742d53656375726974792d506f6c6963793a2064656661756c742d7372632068747470733a20646174613a2027756e736166652d696e6c696e65272027756e736166652d6576616c270d0a52656665727265722d506f6c6963793a207374726963742d6f726967696e0d0a",
      "discovery_method": "PREDICTIVE_METHOD_16",
      "extended_service_name": "HTTP",
      "http": {
        "request": {
          "method": "GET",
          "uri": "http://91.231.1.41/",
          "headers": {
            "User_Agent": [
              "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
            ],
            "_encoding": {
              "User_Agent": "DISPLAY_UTF8",
              "Accept": "DISPLAY_UTF8"
            },
            "Accept": [
              "*/*"
            ]
          }
        },
        "response": {
          "protocol": "HTTP/1.1",
          "status_code": 301,
          "status_reason": "Moved Permanently",
          "headers": {
            "X_Download_Options": [
              "noopen"
            ],
            "_encoding": {
              "X_Download_Options": "DISPLAY_UTF8",
              "Server": "DISPLAY_UTF8",
              "Content_Length": "DISPLAY_UTF8",
              "Content_Type": "DISPLAY_UTF8",
              "Location": "DISPLAY_UTF8",
              "X_Frame_Options": "DISPLAY_UTF8",
              "Connection": "DISPLAY_UTF8",
              "X_Content_Type_Options": "DISPLAY_UTF8",
              "Date": "DISPLAY_UTF8",
              "X_XSS_Protection": "DISPLAY_UTF8",
              "Referrer_Policy": "DISPLAY_UTF8",
              "X_Permitted_Cross_Domain_Policies": "DISPLAY_UTF8",
              "Content_Security_Policy": "DISPLAY_UTF8"
            },
            "Server": [
              "nginx"
            ],
            "Content_Length": [
              "178"
            ],
            "Content_Type": [
              "text/html"
            ],
            "Location": [
              "https://91.231.1.41/"
            ],
            "X_Frame_Options": [
              "sameorigin"
            ],
            "Connection": [
              "keep-alive"
            ],
            "X_Content_Type_Options": [
              "nosniff"
            ],
            "Date": [
              "<REDACTED>"
            ],
            "X_XSS_Protection": [
              "1; mode=block"
            ],
            "Referrer_Policy": [
              "strict-origin"
            ],
            "X_Permitted_Cross_Domain_Policies": [
              "none"
            ],
            "Content_Security_Policy": [
              "default-src https: data: 'unsafe-inline' 'unsafe-eval'"
            ]
          },
          "_encoding": {
            "html_tags": "DISPLAY_UTF8",
            "body": "DISPLAY_UTF8",
            "body_hash": "DISPLAY_UTF8",
            "html_title": "DISPLAY_UTF8"
          },
          "html_tags": [
            "<title>301 Moved Permanently</title>"
          ],
          "body_size": 178,
          "body": "<html>\r\n<head><title>301 Moved Permanently</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>301 Moved Permanently</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n",
          "body_hashes": [
            "sha256:bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d",
            "sha1:81ffbd1712afe8cdf138b570c0fc9934742c33c1",
            "tlsh:60c012a9ab026cc9a8973b3866c3a190e2ec80649bd9491112a45a47f08b19b9ec23d1"
          ],
          "body_hash": "sha1:81ffbd1712afe8cdf138b570c0fc9934742c33c1",
          "html_title": "301 Moved Permanently"
        },
        "supports_http2": false
      },
      "observed_at": "2025-05-12T12:15:10.558825402Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 80,
      "service_name": "HTTP",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "nginx",
          "product": "nginx",
          "other": {
            "family": "nginx"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.138.59",
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "pop3",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "+OK Dovecot (Ubuntu) ready.\r\n",
      "banner_hashes": [
        "sha256:5f1d48ad9e6f4f2b3f6ff82753726dee0c030c0a8798fcc2ae96fcd7a53384f5"
      ],
      "banner_hex": "2b4f4b20446f7665636f7420285562756e7475292072656164792e0d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "extended_service_name": "POP3S",
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-12T13:28:03.523374627Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "pop3": {
        "_encoding": {
          "banner": "DISPLAY_UTF8",
          "start_tls": "DISPLAY_UTF8"
        },
        "banner": "+OK Dovecot (Ubuntu) ready.\r\n",
        "start_tls": "+OK Begin TLS negotiation now.\r\n"
      },
      "port": 110,
      "service_name": "POP3",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "Dovecot",
          "product": "Dovecot",
          "other": {
            "family": "Dovecot"
          },
          "source": "OSI_APPLICATION_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "vendor": "Ubuntu",
          "product": "Linux",
          "other": {
            "family": "Linux"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.145.99",
      "tls": {
        "version_selected": "TLSv1_3",
        "cipher_selected": "TLS_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "15af977ce25de452b96affa2addb1036",
        "ja4s": "t130200_1302_a56c5b993250"
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "imap",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot (Ubuntu) ready.\r\n",
      "banner_hashes": [
        "sha256:625400f57eaf5651fdd647fffc9d69d5ca2268754bb4f99345d3c813e7cf1754"
      ],
      "banner_hex": "2a204f4b205b4341504142494c49545920494d41503472657631204c49544552414c2b205341534c2d4952204c4f47494e2d524546455252414c5320494420454e41424c452049444c45205354415254544c53204c4f47494e44495341424c45445d20446f7665636f7420285562756e7475292072656164792e0d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "extended_service_name": "IMAPS",
      "imap": {
        "_encoding": {
          "banner": "DISPLAY_UTF8"
        },
        "banner": "* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot (Ubuntu) ready.\r\n",
        "start_tls": "a001 OK Begin TLS negotiation now.\r\n"
      },
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-13T12:47:12.114713833Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 143,
      "service_name": "IMAP",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "Dovecot",
          "product": "Dovecot",
          "other": {
            "family": "Dovecot"
          },
          "source": "OSI_APPLICATION_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "vendor": "Ubuntu",
          "product": "Linux",
          "other": {
            "family": "Linux"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.146.53",
      "tls": {
        "version_selected": "TLSv1_3",
        "cipher_selected": "TLS_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "15af977ce25de452b96affa2addb1036",
        "ja4s": "t130200_1302_a56c5b993250",
        "versions": [
          {
            "tls_version": "TLSv1_3",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "15af977ce25de452b96affa2addb1036",
            "ja4s": "t130200_1302_a56c5b993250"
          }
        ]
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "http",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "HTTP/1.1 200 OK\r\nServer: nginx\r\nDate:  <REDACTED>\r\nContent-Type: text/html\r\nContent-Length: 78\r\nLast-Modified: Tue, 07 Jul 2020 08:22:38 GMT\r\nConnection: keep-alive\r\nETag: \"5f0430ce-4e\"\r\nX-Frame-Options: sameorigin\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nX-Download-Options: noopen\r\nX-Permitted-Cross-Domain-Policies: none\r\nContent-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'\r\nReferrer-Policy: strict-origin\r\nAccept-Ranges: bytes\r\n",
      "banner_hashes": [
        "sha256:3cd4943ac0f42976ed9def894d593019dadd107b2010c1c3a808a75139a7266e"
      ],
      "banner_hex": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e780d0a446174653a20203c52454441435445443e0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037380d0a4c6173742d4d6f6469666965643a205475652c203037204a756c20323032302030383a32323a333820474d540d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a455461673a202235663034333063652d3465220d0a582d4672616d652d4f7074696f6e733a2073616d656f726967696e0d0a582d436f6e74656e742d547970652d4f7074696f6e733a206e6f736e6966660d0a582d5853532d50726f74656374696f6e3a20313b206d6f64653d626c6f636b0d0a582d446f776e6c6f61642d4f7074696f6e733a206e6f6f70656e0d0a582d5065726d69747465642d43726f73732d446f6d61696e2d506f6c69636965733a206e6f6e650d0a436f6e74656e742d53656375726974792d506f6c6963793a2064656661756c742d7372632068747470733a20646174613a2027756e736166652d696e6c696e65272027756e736166652d6576616c270d0a52656665727265722d506f6c6963793a207374726963742d6f726967696e0d0a4163636570742d52616e6765733a2062797465730d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "discovery_method": "PREDICTIVE_METHOD_16",
      "extended_service_name": "HTTPS",
      "http": {
        "request": {
          "method": "GET",
          "uri": "https://91.231.1.41/",
          "headers": {
            "User_Agent": [
              "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)"
            ],
            "_encoding": {
              "User_Agent": "DISPLAY_UTF8",
              "Accept": "DISPLAY_UTF8"
            },
            "Accept": [
              "*/*"
            ]
          }
        },
        "response": {
          "protocol": "HTTP/1.1",
          "status_code": 200,
          "status_reason": "OK",
          "headers": {
            "Content_Length": [
              "78"
            ],
            "_encoding": {
              "Content_Length": "DISPLAY_UTF8",
              "Content_Type": "DISPLAY_UTF8",
              "Accept_Ranges": "DISPLAY_UTF8",
              "X_Content_Type_Options": "DISPLAY_UTF8",
              "Referrer_Policy": "DISPLAY_UTF8",
              "Last_Modified": "DISPLAY_UTF8",
              "X_Download_Options": "DISPLAY_UTF8",
              "Server": "DISPLAY_UTF8",
              "X_XSS_Protection": "DISPLAY_UTF8",
              "X_Frame_Options": "DISPLAY_UTF8",
              "Connection": "DISPLAY_UTF8",
              "Date": "DISPLAY_UTF8",
              "ETag": "DISPLAY_UTF8",
              "X_Permitted_Cross_Domain_Policies": "DISPLAY_UTF8",
              "Content_Security_Policy": "DISPLAY_UTF8"
            },
            "Content_Type": [
              "text/html"
            ],
            "Accept_Ranges": [
              "bytes"
            ],
            "X_Content_Type_Options": [
              "nosniff"
            ],
            "Referrer_Policy": [
              "strict-origin"
            ],
            "Last_Modified": [
              "Tue, 07 Jul 2020 08:22:38 GMT"
            ],
            "X_Download_Options": [
              "noopen"
            ],
            "Server": [
              "nginx"
            ],
            "X_XSS_Protection": [
              "1; mode=block"
            ],
            "X_Frame_Options": [
              "sameorigin"
            ],
            "Connection": [
              "keep-alive"
            ],
            "Date": [
              "<REDACTED>"
            ],
            "ETag": [
              "\"5f0430ce-4e\""
            ],
            "X_Permitted_Cross_Domain_Policies": [
              "none"
            ],
            "Content_Security_Policy": [
              "default-src https: data: 'unsafe-inline' 'unsafe-eval'"
            ]
          },
          "_encoding": {
            "html_tags": "DISPLAY_UTF8",
            "body": "DISPLAY_UTF8",
            "body_hash": "DISPLAY_UTF8"
          },
          "html_tags": [
            "<meta HTTP-EQUIV=\"REFRESH\" content=\"0; url=/mail/\">"
          ],
          "body_size": 78,
          "body": "<html><head><meta HTTP-EQUIV=\"REFRESH\" content=\"0; url=/mail/\"></head></html>\n",
          "body_hashes": [
            "sha256:63ab1de582fe1050b9db3bfa2481e23bb30a191d5d55ae7f45c3788abcce2248",
            "sha1:6a047f71895f2ea15d7367a1f9a8a2fb4b7ba544",
            "tlsh:d6a022bbc0f030820eb2bc208fc03200882a028cf0828ec0f2c30ca8c8e8e0088c302a"
          ],
          "body_hash": "sha1:6a047f71895f2ea15d7367a1f9a8a2fb4b7ba544"
        },
        "supports_http2": false
      },
      "jarm": {
        "_encoding": {
          "fingerprint": "DISPLAY_HEX",
          "cipher_and_version_fingerprint": "DISPLAY_HEX",
          "tls_extensions_sha256": "DISPLAY_HEX"
        },
        "fingerprint": "2ad2ad16d2ad2ad0002ad2ad2ad2ad866950a815d40ba85c7f632ca5a32362",
        "cipher_and_version_fingerprint": "2ad2ad16d2ad2ad0002ad2ad2ad2ad",
        "tls_extensions_sha256": "866950a815d40ba85c7f632ca5a32362",
        "observed_at": "2025-05-09T17:34:00.468346047Z"
      },
      "observed_at": "2025-05-13T14:08:52.089241879Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 443,
      "service_name": "HTTP",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "nginx",
          "product": "nginx",
          "other": {
            "family": "nginx"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.145.96",
      "tls": {
        "version_selected": "TLSv1_2",
        "cipher_selected": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "server_key_exchange": {
          "ec_params": {
            "named_curve": 29
          }
        },
        "session_ticket": {
          "length": 176,
          "lifetime_hint": 300
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "e35df3e00ca4ef31d42b34bebaa2f86e",
        "ja4s": "t120300_c030_bec8bdbaef8a",
        "versions": [
          {
            "tls_version": "TLSv1_2",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "e35df3e00ca4ef31d42b34bebaa2f86e",
            "ja4s": "t120300_c030_bec8bdbaef8a"
          }
        ]
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "smtp",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "220 mail.segodnya.ua ESMTP Postfix\r\n",
      "banner_hashes": [
        "sha256:af576e19de3b656ecf46aca7be09287aaa3a83c42c84f0233e01ede6ace340e6"
      ],
      "banner_hex": "323230206d61696c2e7365676f646e79612e75612045534d545020506f73746669780d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "discovery_method": "IPV4_WALK_FULL_PRIORITY_1",
      "extended_service_name": "SMTP-STARTTLS",
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-13T06:13:33.307057634Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 587,
      "service_name": "SMTP",
      "smtp": {
        "_encoding": {
          "banner": "DISPLAY_UTF8",
          "ehlo": "DISPLAY_UTF8",
          "start_tls": "DISPLAY_UTF8"
        },
        "banner": "220 mail.segodnya.ua ESMTP Postfix\r\n",
        "ehlo": "250-mail.segodnya.ua\r\n250-PIPELINING\r\n250-SIZE 15728640\r\n250-ETRN\r\n250-STARTTLS\r\n250-ENHANCEDSTATUSCODES\r\n250-8BITMIME\r\n250-DSN\r\n250 SMTPUTF8\r\n",
        "start_tls": "220 2.0.0 Ready to start TLS\r\n"
      },
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:o:*:linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "product": "linux",
          "source": "OSI_TRANSPORT_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "Postfix",
          "product": "Postfix",
          "other": {
            "family": "Postfix"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "167.94.146.56",
      "tls": {
        "version_selected": "TLSv1_3",
        "cipher_selected": "TLS_CHACHA20_POLY1305_SHA256",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "475c9302dc42b2751db9edcac3b74891",
        "ja4s": "t130200_1303_a56c5b993250"
      },
      "transport_fingerprint": {
        "id": 262,
        "os": "CentOS",
        "raw": "65160,64,true,MSTNW,1460,false,false"
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "imap",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.\r\n",
      "banner_hashes": [
        "sha256:f4e79828be4f5e4d5f16617f03e2e92725e78ec0afda189f6c45aa455daff14c"
      ],
      "banner_hex": "2a204f4b205b4341504142494c49545920494d41503472657631204c49544552414c2b205341534c2d4952204c4f47494e2d524546455252414c5320494420454e41424c452049444c4520415554483d504c41494e20415554483d4c4f47494e5d20446f7665636f7420285562756e7475292072656164792e0d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "extended_service_name": "IMAPS",
      "imap": {
        "_encoding": {
          "banner": "DISPLAY_UTF8"
        },
        "banner": "* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready.\r\n"
      },
      "jarm": {
        "_encoding": {
          "fingerprint": "DISPLAY_HEX",
          "cipher_and_version_fingerprint": "DISPLAY_HEX",
          "tls_extensions_sha256": "DISPLAY_HEX"
        },
        "fingerprint": "2ad2ad16d2ad2ad22c42d42d000000dc2b105e4dda975fa70719c0cae5d0ce",
        "cipher_and_version_fingerprint": "2ad2ad16d2ad2ad22c42d42d000000",
        "tls_extensions_sha256": "dc2b105e4dda975fa70719c0cae5d0ce",
        "observed_at": "2025-05-09T18:21:48.323685722Z"
      },
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-13T01:13:10.082078401Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "port": 993,
      "service_name": "IMAP",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:o:*:linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "product": "linux",
          "source": "OSI_TRANSPORT_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "Dovecot",
          "product": "Dovecot",
          "other": {
            "family": "Dovecot"
          },
          "source": "OSI_APPLICATION_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "vendor": "Ubuntu",
          "product": "Linux",
          "other": {
            "family": "Linux"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "199.45.154.112",
      "tls": {
        "version_selected": "TLSv1_3",
        "cipher_selected": "TLS_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "15af977ce25de452b96affa2addb1036",
        "ja4s": "t130200_1302_a56c5b993250",
        "versions": [
          {
            "tls_version": "TLSv1_3",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "15af977ce25de452b96affa2addb1036",
            "ja4s": "t130200_1302_a56c5b993250"
          },
          {
            "tls_version": "TLSv1_2",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "0debd3853f330c574b05e0b6d882dc27",
            "ja4s": "t120200_c030_344b4dce5a52"
          },
          {
            "tls_version": "TLSv1_1",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "ce815ab6e37127ab1cb9fe33d3ba250d",
            "ja4s": "t110200_c014_344b4dce5a52"
          },
          {
            "tls_version": "TLSv1_0",
            "_encoding": {
              "ja3s": "DISPLAY_HEX"
            },
            "ja3s": "623de93db17d313345d7ea481e7443cf",
            "ja4s": "t100200_c014_344b4dce5a52"
          }
        ]
      },
      "transport_fingerprint": {
        "id": 262,
        "os": "CentOS",
        "raw": "65160,64,true,MSTNW,1460,false,false"
      },
      "transport_protocol": "TCP",
      "truncated": false
    },
    {
      "_decoded": "pop3",
      "_encoding": {
        "banner": "DISPLAY_UTF8",
        "certificate": "DISPLAY_HEX",
        "banner_hex": "DISPLAY_HEX"
      },
      "banner": "+OK Dovecot (Ubuntu) ready.\r\n",
      "banner_hashes": [
        "sha256:5f1d48ad9e6f4f2b3f6ff82753726dee0c030c0a8798fcc2ae96fcd7a53384f5"
      ],
      "banner_hex": "2b4f4b20446f7665636f7420285562756e7475292072656164792e0d0a",
      "certificate": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
      "discovery_method": "IPV4_WALK_FULL_PRIORITY_1",
      "extended_service_name": "POP3S",
      "jarm": {
        "_encoding": {
          "fingerprint": "DISPLAY_HEX",
          "cipher_and_version_fingerprint": "DISPLAY_HEX",
          "tls_extensions_sha256": "DISPLAY_HEX"
        },
        "fingerprint": "2ad2ad16d2ad2ad22c42d42d000000dc2b105e4dda975fa70719c0cae5d0ce",
        "cipher_and_version_fingerprint": "2ad2ad16d2ad2ad22c42d42d000000",
        "tls_extensions_sha256": "dc2b105e4dda975fa70719c0cae5d0ce",
        "observed_at": "2025-05-13T05:12:37.520740455Z"
      },
      "labels": [
        "email"
      ],
      "observed_at": "2025-05-13T02:38:10.755763262Z",
      "perspective_id": "PERSPECTIVE_UNKNOWN",
      "pop3": {
        "_encoding": {
          "banner": "DISPLAY_UTF8"
        },
        "banner": "+OK Dovecot (Ubuntu) ready.\r\n"
      },
      "port": 995,
      "service_name": "POP3",
      "software": [
        {
          "uniform_resource_identifier": "cpe:2.3:o:*:linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "product": "linux",
          "source": "OSI_TRANSPORT_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:*",
          "part": "a",
          "vendor": "Dovecot",
          "product": "Dovecot",
          "other": {
            "family": "Dovecot"
          },
          "source": "OSI_APPLICATION_LAYER"
        },
        {
          "uniform_resource_identifier": "cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*",
          "part": "o",
          "vendor": "Ubuntu",
          "product": "Linux",
          "other": {
            "family": "Linux"
          },
          "source": "OSI_APPLICATION_LAYER"
        }
      ],
      "source_ip": "199.45.154.128",
      "tls": {
        "version_selected": "TLSv1_3",
        "cipher_selected": "TLS_AES_256_GCM_SHA384",
        "certificates": {
          "_encoding": {
            "leaf_fp_sha_256": "DISPLAY_HEX"
          },
          "leaf_fp_sha_256": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
          "leaf_data": {
            "names": [
              "mail.segodnya.ua"
            ],
            "subject_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "issuer_dn": "C=CN, ST=GuangDong, L=ShenZhen, O=mail.segodnya.ua, OU=IT, CN=mail.segodnya.ua, [email protected]",
            "pubkey_bit_size": 4096,
            "pubkey_algorithm": "RSA",
            "tbs_fingerprint": "26a92fbd4734f1d11a7d930664e9e493e16cecf219f954f2bc8786af3c538f36",
            "fingerprint": "f7a6504648eff926c88bb69cc0b048772331f806d56a74eaf9531e9158d336b4",
            "issuer": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "subject": {
              "common_name": [
                "mail.segodnya.ua"
              ],
              "locality": [
                "ShenZhen"
              ],
              "organization": [
                "mail.segodnya.ua"
              ],
              "organizational_unit": [
                "IT"
              ],
              "province": [
                "GuangDong"
              ],
              "country": [
                "CN"
              ],
              "email_address": [
                "[email protected]"
              ]
            },
            "public_key": {
              "key_algorithm": "RSA",
              "rsa": {
                "_encoding": {
                  "modulus": "DISPLAY_BASE64",
                  "exponent": "DISPLAY_BASE64"
                },
                "modulus": "1VxZ8AQOz7PslrZVrje2cm2YiFBc/luAPieAHCe3TEQrsSCF27ydlpltIG7F3nzmQmJWuuVRc8hqcK3NmWQF9YZQoh29qvrBaggK51k+o0D35vn85J73yta/EUqyAD86Kkmuf4xmUfLUbi0hxhQi5FiSSf1FhHa3cV1UnuUQJLHaXQ4qYkI3xvvQE2ljJ769TkhK1EdDuSysgw5h5Xflt7B9ijJPagkBK/ojpH7vSCAlxO8nWg7momRrek0lXpLAqk1GKWtUT7cPdEbR455enSfagRFcS2UVyjdsUqAEDCGBpgouSBkkZisQu06bdP9gAlltAPSmkkkFLN+Su6v8cRJYOGmbe7sQhWstKktOQjKGfr7w0PBnYC4Jt+rZw0+9AamGLlTzqldJkUL/z5aER01wuPYUhMIWZ2znIaeFJe9VIG1JPJTLdaWlnedkVQqjxwGnKfXPVGZeb1FgnAq84ofkMMQRDtljJ1m00sYoTbw65ro89orgS9QWI5PpLNavw0YwTNgEl2HiaB+T8pEAZxydAliibsE5Tamy0HsnmM+9iA+kzbTT9hlqA/uQ+1xh+Bg0hPM5LzoJUSdJtIJtXzMS2W7folmNbgW5bLcqZ1J94CzBlZLq/zo0NUZVITEAO8f+StyWJ2npCj/3jdT0OYBb9U2yogr+Fphgsmx6fac=",
                "exponent": "AAEAAQ==",
                "length": 512
              },
              "fingerprint": "dd7448ed4ddcdc7b624bb714afa8e6a8ec63ca8039f5b928b1ecd3da74b1c8a5"
            },
            "signature": {
              "self_signed": true,
              "signature_algorithm": "SHA256-RSA"
            }
          }
        },
        "_encoding": {
          "ja3s": "DISPLAY_HEX"
        },
        "ja3s": "15af977ce25de452b96affa2addb1036",
        "ja4s": "t130200_1302_a56c5b993250"
      },
      "transport_fingerprint": {
        "id": 262,
        "os": "CentOS",
        "raw": "65160,64,true,MSTNW,1460,false,false"
      },
      "transport_protocol": "TCP",
      "truncated": false
    }
  ],
  "location": {
    "continent": "Europe",
    "country": "Ukraine",
    "country_code": "UA",
    "city": "Kyiv",
    "postal_code": "03027",
    "timezone": "Europe/Kyiv",
    "province": "Kyiv City",
    "coordinates": {
      "latitude": 50.45466,
      "longitude": 30.5238
    }
  },
  "location_updated_at": "2025-05-06T17:34:03.926677429Z",
  "autonomous_system": {
    "asn": 198224,
    "description": "SEGODNYA-AS",
    "bgp_prefix": "91.231.1.0/24",
    "name": "SEGODNYA-AS",
    "country_code": "UA"
  },
  "autonomous_system_updated_at": "2025-05-02T16:47:27.285812128Z",
  "whois": {
    "network": {
      "handle": "ORG-LA1965-RIPE",
      "name": "MASCODE LLC",
      "cidrs": [
        "91.231.1.0/24"
      ],
      "created": "2024-12-10T00:00:00Z",
      "updated": "2024-12-10T00:00:00Z"
    },
    "organization": {
      "handle": "ORG-LA1965-RIPE",
      "name": "\"MASCODE\" LLC",
      "address": "Kyiv, str. Mrii, 19",
      "abuse_contacts": [
        {
          "handle": "MA27648-RIPE",
          "name": "mascode-noc",
          "email": "[email protected]"
        }
      ],
      "admin_contacts": [
        {
          "handle": "ZV621-RIPE",
          "name": "Zhavoronkov Viktor",
          "email": "[email protected]"
        }
      ]
    }
  },
  "operating_system": {
    "uniform_resource_identifier": "cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*",
    "part": "o",
    "vendor": "Ubuntu",
    "product": "Linux",
    "other": {
      "family": "Linux"
    }
  },
  "dns": {},
  "last_updated_at": "2025-05-13T14:08:56.851Z",
  "labels": [
    "email"
  ]
}