{"ip":"170.64.163.202","total_events":66,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"66+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 66 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,665 bytes sent","bytes_sent":5665,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T07:33:31","last_seen":"2026-08-09T07:40:42","events_24h":0,"events_7d":66,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8978,"lon":151.1899,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":37554,"proto":"tcp","label":"","count":1},{"port":43554,"proto":"tcp","label":"","count":1},{"port":11554,"proto":"tcp","label":"","count":1},{"port":54554,"proto":"tcp","label":"","count":1},{"port":14554,"proto":"tcp","label":"","count":1},{"port":40554,"proto":"tcp","label":"","count":1},{"port":42554,"proto":"tcp","label":"","count":1},{"port":9554,"proto":"tcp","label":"","count":1},{"port":27554,"proto":"tcp","label":"","count":1},{"port":60554,"proto":"tcp","label":"","count":1},{"port":20554,"proto":"tcp","label":"","count":1},{"port":25554,"proto":"tcp","label":"","count":1},{"port":32554,"proto":"tcp","label":"","count":1},{"port":8554,"proto":"tcp","label":"","count":1},{"port":23554,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-09","count":66}],"recent_events":[{"timestamp":"2026-08-09T07:40:42","port":46554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:46554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a34363535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"aca6e56e-71bd-440a-9fe2-858b8d0fd754","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"107902e0c5578ca0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:46554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:37","port":40554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:40554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a34303535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"d2c1c10c-e1b8-4aaa-8aaa-76a631f3538f","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"9539db4c9e0622bb","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:40554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:29","port":3554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:3554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a333535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"43191936-3448-4508-8e80-944362f1ccaf","seq":1,"duration_ms":100,"bytes_in":85,"bytes_out":79,"enriched":{"digest":"f9359add69094af0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:3554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:27","port":35554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:35554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a33353535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"db405367-93ea-425f-9877-f48562896f72","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"687c6a9c98758ff1","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:35554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:17","port":32554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:32554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a33323535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"13de9135-4e02-421a-a12b-98ff157b031f","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"95c74cfdaa3c8ab8","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:32554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:02","port":37554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:37554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a33373535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"313619ab-4fb2-485b-83aa-031d75cf9cc2","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"1b466bc40584fbd2","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:37554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:40:02","port":29554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:29554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a32393535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"cffb6786-acb6-4c01-97a9-57a18106810a","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"c62321091fd5ab7e","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:29554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:39:48","port":9554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:9554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a393535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"de2edfd5-3762-43a5-ab19-10f7eca94e97","seq":1,"duration_ms":100,"bytes_in":85,"bytes_out":79,"enriched":{"digest":"4964f355c144427a","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:9554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:39:43","port":18554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:18554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a31383535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"8a328fc0-1b4f-46a8-84ae-13455b90859b","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"cf2e43edcd676297","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:18554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}},{"timestamp":"2026-08-09T07:39:40","port":33554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:33554/ RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: rtsp-detect/2.0\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a33333535342f20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20727473702d6465746563742f322e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"67a295d0-5fcd-497f-b91d-6cee9c0f0ac0","seq":1,"duration_ms":100,"bytes_in":86,"bytes_out":79,"enriched":{"digest":"749bcf23b0c734fd","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:33554/ RTSP/1.0","CSeq: 1","User-Agent: rtsp-detect/2.0"]}}],"http_methods":[],"distinct_ports_total":66,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-14T16:07:40.679996+00:00"}