{"ip":"81.56.169.140","total_events":80,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["80 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"387 bytes sent","bytes_sent":387,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-28T11:58:16","last_seen":"2026-08-20T14:48:41","events_24h":1,"events_7d":1,"geo":{"country_code":"IT","country_name":"Italy","region":"Lazio","city":"Rome","lat":41.8905,"lon":12.5127,"asn":29447,"org":"Scaleway SAS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as29447","label":"Iliad Italia","category":"isp","url":"https://www.peeringdb.com/asn/29447"},"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":80}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-05-30","count":9},{"date":"2026-07-01","count":1},{"date":"2026-07-28","count":1},{"date":"2026-08-02","count":1},{"date":"2026-08-04","count":1},{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":1},{"date":"2026-08-20","count":1}],"recent_events":[{"timestamp":"2026-08-20T14:48:41","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"67a075f6-1b16-4963-9b83-c94316374a9c","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-08-12T13:56:12","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"5b87a4de-5965-4407-85e8-2c4a2977c23d","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-08-11T01:54:50","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"df549cd4-8f56-441d-b820-c6c3a69b580b","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-08-04T16:51:56","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"b6975910-b4a0-490e-b966-fe82919d0cec","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-08-02T14:18:39","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"4e08f789-daa7-47c5-8588-c8d5338a84ce","seq":1,"duration_ms":100,"bytes_in":56,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-07-28T13:37:00","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"7b6573f5-af45-458b-ae7e-7fed9422be4a","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-07-01T14:45:36","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0\r\nCSeq: 1\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f20525453502f312e300d0a435365713a20310d0a0d0a","method":"","user_agent":"","ja3":"","session":"e457c778-37b7-475c-a321-749e426a32af","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78,"enriched":{"digest":"a312c8aedea889f0","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/ RTSP/1.0","CSeq: 1"]}},{"timestamp":"2026-05-30T14:49:34","port":554,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"RTSP/1.0 501 Not Implemented\r\n\r\n","payload_hex":"525453502f312e3020353031204e6f7420496d706c656d656e7465640d0a0d0a","method":"","user_agent":"","ja3":"","session":"26b50d1b-ee76-43e3-9ef6-4f4b064e918e","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9d2cca757b9e4f3e","strings":["RTSP/1.0 501 Not Implemented"]}},{"timestamp":"2026-05-30T14:49:34","port":554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:554/h264/ch1/main/av_stream RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Lavf62.13.102\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3535342f683236342f6368312f6d61696e2f61765f73747265616d20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204c61766636322e31332e3130320d0a0d0a","method":"","user_agent":"","ja3":"","session":"26b50d1b-ee76-43e3-9ef6-4f4b064e918e","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4d6e6525e5712df5","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:554/h264/ch1/main/av_stream RTSP/1.0","CSeq: 1","User-Agent: Lavf62.13.102"],"iocs":{"paths":["/h264/ch1/main/av_stream"]}}},{"timestamp":"2026-05-30T14:49:19","port":554,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"RTSP/1.0 501 Not Implemented\r\n\r\n","payload_hex":"525453502f312e3020353031204e6f7420496d706c656d656e7465640d0a0d0a","method":"","user_agent":"","ja3":"","session":"d16fc3cb-c166-41ae-9cc8-f0181f409a2f","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9d2cca757b9e4f3e","strings":["RTSP/1.0 501 Not Implemented"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-21T00:32:41.259200+00:00"}