{"ip":"170.64.149.57","total_events":1758,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"1,758 events across 3 port(s)","confidence":"medium","network_type":"CDN","why":["1,758 requests against only 3 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range.","Held a session open for 135s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"19,242,524 bytes sent, longest session 135s","bytes_sent":19242524,"session_seconds":135,"persistent":true}},"first_seen":"2026-03-23T13:16:44","last_seen":"2026-08-24T12:25:08","events_24h":0,"events_7d":502,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8978,"lon":151.1899,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":1256},{"port":45554,"proto":"tcp","label":"","count":251},{"port":37554,"proto":"tcp","label":"","count":251}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-06-11","count":251},{"date":"2026-06-22","count":251},{"date":"2026-06-25","count":251},{"date":"2026-08-21","count":251},{"date":"2026-08-24","count":251}],"recent_events":[{"timestamp":"2026-08-24T12:25:08","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/video4.sdp RTSP/1.0\r\nCSeq: 251\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f766964656f342e73647020525453502f312e300d0a435365713a203235310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":251,"duration_ms":74617,"bytes_in":30582,"bytes_out":3263,"enriched":{"digest":"c19fd623dfef802d","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/video4.sdp RTSP/1.0","CSeq: 251","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video4.sdp"]}}},{"timestamp":"2026-08-24T12:25:08","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/video3.sdp RTSP/1.0\r\nCSeq: 250\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f766964656f332e73647020525453502f312e300d0a435365713a203235300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":250,"duration_ms":74319,"bytes_in":30463,"bytes_out":3250,"enriched":{"digest":"faf58a5fdb59bb2a","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/video3.sdp RTSP/1.0","CSeq: 250","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video3.sdp"]}}},{"timestamp":"2026-08-24T12:25:07","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/video2.sdp RTSP/1.0\r\nCSeq: 249\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f766964656f322e73647020525453502f312e300d0a435365713a203234390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":249,"duration_ms":74020,"bytes_in":30344,"bytes_out":3237,"enriched":{"digest":"5e552835200f7360","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/video2.sdp RTSP/1.0","CSeq: 249","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["video2.sdp"]}}},{"timestamp":"2026-08-24T12:25:07","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/4/h264/preview RTSP/1.0\r\nCSeq: 248\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f342f683236342f7072657669657720525453502f312e300d0a435365713a203234380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":248,"duration_ms":73722,"bytes_in":30225,"bytes_out":3224,"enriched":{"digest":"9ca9bb5f4915a443","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/4/h264/preview RTSP/1.0","CSeq: 248","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/4/h264/preview"]}}},{"timestamp":"2026-08-24T12:25:07","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/3/h264/preview RTSP/1.0\r\nCSeq: 247\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f332f683236342f7072657669657720525453502f312e300d0a435365713a203234370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":247,"duration_ms":73424,"bytes_in":30102,"bytes_out":3211,"enriched":{"digest":"84d36d5ac155c10e","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/3/h264/preview RTSP/1.0","CSeq: 247","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/3/h264/preview"]}}},{"timestamp":"2026-08-24T12:25:06","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/2/h264/preview RTSP/1.0\r\nCSeq: 246\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f322f683236342f7072657669657720525453502f312e300d0a435365713a203234360d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":246,"duration_ms":73126,"bytes_in":29979,"bytes_out":3198,"enriched":{"digest":"c1d7e135c220ee5b","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/2/h264/preview RTSP/1.0","CSeq: 246","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/2/h264/preview"]}}},{"timestamp":"2026-08-24T12:25:06","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/1/h264/preview RTSP/1.0\r\nCSeq: 245\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f312f683236342f7072657669657720525453502f312e300d0a435365713a203234350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":245,"duration_ms":72828,"bytes_in":29856,"bytes_out":3185,"enriched":{"digest":"c4d4326dfc9f216a","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/1/h264/preview RTSP/1.0","CSeq: 245","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/1/h264/preview"]}}},{"timestamp":"2026-08-24T12:25:06","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/4/Preview RTSP/1.0\r\nCSeq: 244\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f53747265616d696e672f4368616e6e656c732f342f5072657669657720525453502f312e300d0a435365713a203234340d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":244,"duration_ms":72530,"bytes_in":29733,"bytes_out":3172,"enriched":{"digest":"de0658c96c73c96b","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/4/Preview RTSP/1.0","CSeq: 244","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/4/Preview"]}}},{"timestamp":"2026-08-24T12:25:06","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/3/Preview RTSP/1.0\r\nCSeq: 243\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f53747265616d696e672f4368616e6e656c732f332f5072657669657720525453502f312e300d0a435365713a203234330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":243,"duration_ms":72232,"bytes_in":29596,"bytes_out":3159,"enriched":{"digest":"a0056e7ec2421294","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/3/Preview RTSP/1.0","CSeq: 243","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/3/Preview"]}}},{"timestamp":"2026-08-24T12:25:05","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/2/Preview RTSP/1.0\r\nCSeq: 242\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a33373535342f53747265616d696e672f4368616e6e656c732f322f5072657669657720525453502f312e300d0a435365713a203234320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"200d43d2-7a35-4ef5-ac99-b5ed3423c357","seq":242,"duration_ms":71934,"bytes_in":29459,"bytes_out":3146,"enriched":{"digest":"1bba04e9214d0fb2","strings":["DESCRIBE rtsp://<HONEYPOT>:37554/Streaming/Channels/2/Preview RTSP/1.0","CSeq: 242","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/Streaming/Channels/2/Preview"]}}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-28T12:01:43.257301+00:00"}