{"ip":"4.180.183.247","total_events":272,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["272 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 17,918 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,918 bytes sent","bytes_sent":17918,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-23T17:08:07","last_seen":"2026-09-23T02:02:09","events_24h":0,"events_7d":121,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":121},{"port":8554,"proto":"tcp","label":"","count":121},{"port":25565,"proto":"tcp","label":"Minecraft","count":30}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-15","count":5},{"date":"2026-09-22","count":121},{"date":"2026-09-23","count":121}],"recent_events":[{"timestamp":"2026-09-23T02:02:09","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:toilet@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a746f696c657440<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"ddcb3a5e-f561-4e5d-8804-54301b81ace3","seq":1,"duration_ms":101,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"d3aa00a2b1a7efcc","strings":["DESCRIBE rtsp://admin:toilet@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:09","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:toilette@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a746f696c6574746540<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"4901054b-6542-4568-929e-1497368120d1","seq":1,"duration_ms":100,"bytes_in":70,"bytes_out":13,"enriched":{"digest":"c3e33f189b699873","strings":["DESCRIBE rtsp://admin:toilette@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:08","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:cams@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a63616d7340<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"f40c29f9-901c-41af-a60a-aa1adc1c2266","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":13,"enriched":{"digest":"c923e39fd53a875a","strings":["DESCRIBE rtsp://admin:cams@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:08","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:camera@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a63616d65726140<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"b69cca25-6bcb-4caf-8ca1-f19487db1b78","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":13,"enriched":{"digest":"2760d2ecef4e5c70","strings":["DESCRIBE rtsp://admin:camera@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:08","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:cameras@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a63616d6572617340<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"9fbcf3a3-f266-4cd7-be1c-7f64f380ddf0","seq":1,"duration_ms":100,"bytes_in":69,"bytes_out":13,"enriched":{"digest":"d91cf5492040548d","strings":["DESCRIBE rtsp://admin:cameras@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:07","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:baths@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a626174687340<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"2b6c3870-926b-47e9-910e-00a5fbec2ca7","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":13,"enriched":{"digest":"c7732a578ef519ac","strings":["DESCRIBE rtsp://admin:baths@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:07","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:room@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a726f6f6d40<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"24278cc7-10f2-4c11-95c6-0130fafbb6d0","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":13,"enriched":{"digest":"9e0cbc2c1465e538","strings":["DESCRIBE rtsp://admin:room@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:07","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:cam@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a63616d40<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"26c09dd0-ee0f-4d3a-9e50-bdfe2b04c453","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":13,"enriched":{"digest":"ffaac78bcce1f3cd","strings":["DESCRIBE rtsp://admin:cam@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:06","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:bath@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a6261746840<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"c6b827ca-2cd2-404c-aab3-70cd0d07419b","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":13,"enriched":{"digest":"31fbb87a1b527600","strings":["DESCRIBE rtsp://admin:bath@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-09-23T02:02:06","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://admin:tub@<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f61646d696e3a74756240<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"ac93f8b5-fc79-4357-911e-921f098959df","seq":1,"duration_ms":101,"bytes_in":65,"bytes_out":13,"enriched":{"digest":"a3c1476ad0eae5a1","strings":["DESCRIBE rtsp://admin:tub@<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T01:06:39.693140+00:00"}