{"ip":"170.64.141.32","total_events":2009,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"2,009 events across 2 port(s)","confidence":"medium","network_type":"CDN","why":["2,009 requests against only 2 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 93s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"19,116,020 bytes sent, longest session 93s","bytes_sent":19116020,"session_seconds":93,"persistent":true}},"first_seen":"2026-03-23T09:12:05","last_seen":"2026-08-09T12:32:26","events_24h":0,"events_7d":251,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8978,"lon":151.1899,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":1507},{"port":45554,"proto":"tcp","label":"","count":502}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-20","count":502},{"date":"2026-07-29","count":251},{"date":"2026-07-31","count":251},{"date":"2026-08-09","count":251}],"recent_events":[{"timestamp":"2026-08-09T12:32:26","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/video4.sdp RTSP/1.0\r\nCSeq: 251\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f766964656f342e73647020525453502f312e300d0a435365713a203235310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":251,"duration_ms":74605,"bytes_in":30582,"bytes_out":3263,"enriched":{"digest":"04babbeb71a45a39","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/video4.sdp RTSP/1.0","CSeq: 251","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video4.sdp"]}}},{"timestamp":"2026-08-09T12:32:26","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/video3.sdp RTSP/1.0\r\nCSeq: 250\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f766964656f332e73647020525453502f312e300d0a435365713a203235300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":250,"duration_ms":74307,"bytes_in":30463,"bytes_out":3250,"enriched":{"digest":"cd6ce41120786f17","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/video3.sdp RTSP/1.0","CSeq: 250","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video3.sdp"]}}},{"timestamp":"2026-08-09T12:32:26","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/video2.sdp RTSP/1.0\r\nCSeq: 249\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f766964656f322e73647020525453502f312e300d0a435365713a203234390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":249,"duration_ms":74009,"bytes_in":30344,"bytes_out":3237,"enriched":{"digest":"4a2e0dbc15f8623e","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/video2.sdp RTSP/1.0","CSeq: 249","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video2.sdp"]}}},{"timestamp":"2026-08-09T12:32:26","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/4/h264/preview RTSP/1.0\r\nCSeq: 248\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f342f683236342f7072657669657720525453502f312e300d0a435365713a203234380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":248,"duration_ms":73711,"bytes_in":30225,"bytes_out":3224,"enriched":{"digest":"fb2dabd4cb0308c9","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/4/h264/preview RTSP/1.0","CSeq: 248","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/4/h264/preview"]}}},{"timestamp":"2026-08-09T12:32:25","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/3/h264/preview RTSP/1.0\r\nCSeq: 247\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f332f683236342f7072657669657720525453502f312e300d0a435365713a203234370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":247,"duration_ms":73414,"bytes_in":30102,"bytes_out":3211,"enriched":{"digest":"4d1f3084c65eb91a","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/3/h264/preview RTSP/1.0","CSeq: 247","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/3/h264/preview"]}}},{"timestamp":"2026-08-09T12:32:25","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/2/h264/preview RTSP/1.0\r\nCSeq: 246\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f322f683236342f7072657669657720525453502f312e300d0a435365713a203234360d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":246,"duration_ms":73115,"bytes_in":29979,"bytes_out":3198,"enriched":{"digest":"f30024826d85d62c","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/2/h264/preview RTSP/1.0","CSeq: 246","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/2/h264/preview"]}}},{"timestamp":"2026-08-09T12:32:25","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/1/h264/preview RTSP/1.0\r\nCSeq: 245\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f312f683236342f7072657669657720525453502f312e300d0a435365713a203234350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":245,"duration_ms":72817,"bytes_in":29856,"bytes_out":3185,"enriched":{"digest":"8eec8f35217e925f","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/1/h264/preview RTSP/1.0","CSeq: 245","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/1/h264/preview"]}}},{"timestamp":"2026-08-09T12:32:24","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/4/Preview RTSP/1.0\r\nCSeq: 244\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f53747265616d696e672f4368616e6e656c732f342f5072657669657720525453502f312e300d0a435365713a203234340d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":244,"duration_ms":72519,"bytes_in":29733,"bytes_out":3172,"enriched":{"digest":"7a23c73d86a4840b","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/4/Preview RTSP/1.0","CSeq: 244","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/4/Preview"]}}},{"timestamp":"2026-08-09T12:32:24","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/3/Preview RTSP/1.0\r\nCSeq: 243\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f53747265616d696e672f4368616e6e656c732f332f5072657669657720525453502f312e300d0a435365713a203234330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":243,"duration_ms":72222,"bytes_in":29596,"bytes_out":3159,"enriched":{"digest":"f104b65fdf3b202a","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/3/Preview RTSP/1.0","CSeq: 243","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/3/Preview"]}}},{"timestamp":"2026-08-09T12:32:24","port":45554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/2/Preview RTSP/1.0\r\nCSeq: 242\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a34353535342f53747265616d696e672f4368616e6e656c732f322f5072657669657720525453502f312e300d0a435365713a203234320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6794f785-60db-47b4-bc44-a4bbb817aae9","seq":242,"duration_ms":71924,"bytes_in":29459,"bytes_out":3146,"enriched":{"digest":"8d459ec7fcfc2a09","strings":["DESCRIBE rtsp://<HONEYPOT>:45554/Streaming/Channels/2/Preview RTSP/1.0","CSeq: 242","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/2/Preview"]}}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:04:28.721032+00:00"}