{"ip":"104.143.218.4","total_events":138,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["138 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 16,479 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,479 bytes sent","bytes_sent":16479,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T22:32:31","last_seen":"2026-09-25T19:53:28","events_24h":0,"events_7d":26,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":58061,"org":"Scalaxy B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":110},{"port":9090,"proto":"tcp","label":"Prometheus","count":26},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-30","count":19},{"date":"2026-09-07","count":13},{"date":"2026-09-08","count":13},{"date":"2026-09-10","count":13},{"date":"2026-09-11","count":26},{"date":"2026-09-13","count":26},{"date":"2026-09-18","count":1},{"date":"2026-09-21","count":1},{"date":"2026-09-25","count":26}],"recent_events":[{"timestamp":"2026-09-25T19:53:28","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/unicast/c1/s0/live RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f756e69636173742f63312f73302f6c69766520525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"da667342-5e67-4924-b6a1-2243abc94ee6","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":13,"enriched":{"digest":"f49189f57c6b0663","strings":["DESCRIBE rtsp://<HONEYPOT>:554/unicast/c1/s0/live RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/unicast/c1/s0/live"]}}},{"timestamp":"2026-09-25T19:53:26","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/video1 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f766964656f3120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"7c5cbbf9-8526-41db-bc70-cbb4036a1bd4","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":13,"enriched":{"digest":"bc073b23541e8040","strings":["DESCRIBE rtsp://<HONEYPOT>:554/video1 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-25T19:53:25","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/1/h264major RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f312f683236346d616a6f7220525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"3d889894-2ef0-4df8-9291-05e99aa6b815","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":13,"enriched":{"digest":"83ce720a021bb5d7","strings":["DESCRIBE rtsp://<HONEYPOT>:554/1/h264major RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/1/h264major"]}}},{"timestamp":"2026-09-25T19:53:24","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/ch0_0.h264 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f6368305f302e6832363420525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"3556fcd8-60de-41b6-a39f-6ac25cd36040","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":13,"enriched":{"digest":"b98d95b6e6edbee9","strings":["DESCRIBE rtsp://<HONEYPOT>:554/ch0_0.h264 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-25T19:53:23","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/live/ch00_0 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f6c6976652f636830305f3020525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"ac0655b6-0177-44b3-8380-d8cc63837d16","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":13,"enriched":{"digest":"8d7e0611317bc7e4","strings":["DESCRIBE rtsp://<HONEYPOT>:554/live/ch00_0 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/live/ch00_0"]}}},{"timestamp":"2026-09-25T19:53:22","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/live/ch0 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f6c6976652f63683020525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"c8041416-4720-4e7c-a3f3-1b5382d801bc","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":13,"enriched":{"digest":"9fa7872ecc279ef8","strings":["DESCRIBE rtsp://<HONEYPOT>:554/live/ch0 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/live/ch0"]}}},{"timestamp":"2026-09-25T19:53:21","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/axis-media/media.amp RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f617869732d6d656469612f6d656469612e616d7020525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"f26326da-5c1d-48e8-be3d-9e95b1bb057e","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":13,"enriched":{"digest":"d3c183c378b3b348","strings":["DESCRIBE rtsp://<HONEYPOT>:554/axis-media/media.amp RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["media.amp"],"paths":["/axis-media/media.amp"]}}},{"timestamp":"2026-09-25T19:53:20","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/ch01.264 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f636830312e32363420525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"32a9d092-a20b-4b22-9c0b-56347ac334dd","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":13,"enriched":{"digest":"1585ae64092b0f57","strings":["DESCRIBE rtsp://<HONEYPOT>:554/ch01.264 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-25T19:53:19","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/1 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f3120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"e5d3ac83-168b-4bac-b44c-aa3ed085fcc0","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":13,"enriched":{"digest":"d45810d70537a230","strings":["DESCRIBE rtsp://<HONEYPOT>:554/1 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-25T19:53:18","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:554/Streaming/Channels/101 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a3535342f53747265616d696e672f4368616e6e656c732f31303120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"cad2be29-8fae-49ba-9824-97937c56b546","seq":1,"duration_ms":100,"bytes_in":128,"bytes_out":13,"enriched":{"digest":"61f1672275180f66","strings":["DESCRIBE rtsp://<HONEYPOT>:554/Streaming/Channels/101 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/101"]}}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T01:06:33.020266+00:00"}