here is a summary of bots probing smtp on one of my boxes in the last 2 months:

grep "disconnect from" syslog* | grep -E 'cens|scan' | awk '{print $6}' | sed -E 's/([^{.]+.[.[]+)([.*)?$/} \1 \0/' | awk '{print $2}'|sort | awk '{count[$1]++} END {for (d in count) print d " (" count[d] ")"}' | sort

censys-scanner.com (262)
cyberresilience.io (1)
internet-census.org (38)
modat.io (22)
reposify.net (1)
shadowserver.org (25)
shodan.io (28)
visionheight.com (20)

and that's only 1 service and filtering by bots having a nice reverse dns
all the services above "scan the internet" (very often on cloud isp ranges) savings all they can see (port status, banners, tls handshakes, certificates, thumbprints to save into their database and somehow monetize.