{"ip":"87.68.52.238","total_events":33,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["33 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,751 bytes sent","bytes_sent":3751,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-02T18:14:07","last_seen":"2026-09-02T18:14:15","events_24h":0,"events_7d":33,"geo":{"country_code":"IL","country_name":"Israel","region":"Tel Aviv","city":"Ramat Gan","lat":32.0821,"lon":34.8122,"asn":12400,"org":"Partner Communications Ltd."},"source_domain":"87.68.52.238.cable.012.net.il","known_scanners":[],"scanner_tag":{"key":"peeringdb:as12400","label":"Partner Communications","category":"isp","url":"https://www.peeringdb.com/asn/12400"},"cve_matches":[],"malware":[],"top_ports":[{"port":554,"proto":"tcp","label":"","count":11},{"port":5554,"proto":"tcp","label":"","count":11},{"port":8554,"proto":"tcp","label":"","count":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-09-02","count":33}],"recent_events":[{"timestamp":"2026-09-02T18:14:15","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/12 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f313220525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"954ba929-c7ff-41cd-a25e-ad11b2c46da1","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":12,"enriched":{"digest":"a487458b3ac311fa","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/12 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-02T18:14:15","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/11 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f313120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"0cfe3a02-5d99-430f-a646-66bd239de5ca","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":12,"enriched":{"digest":"e565b79352ac3493","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/11 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-02T18:14:15","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/1080p RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f313038307020525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"0327b788-a7c2-4e03-a72a-0ab956814f98","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":12,"enriched":{"digest":"d08216c4c96b443f","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/1080p RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-02T18:14:15","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/1/stream1 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f312f73747265616d3120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"eb193e28-942f-44e3-8529-50996626dafe","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":12,"enriched":{"digest":"122fe7c3e1a5017c","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/1/stream1 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/1/stream1"]}}},{"timestamp":"2026-09-02T18:14:14","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/1/h264major RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f312f683236346d616a6f7220525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"8371ba46-cee4-4cee-85a2-5074f9d26b93","seq":1,"duration_ms":102,"bytes_in":118,"bytes_out":12,"enriched":{"digest":"dbc84d3997d3e7ba","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/1/h264major RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/1/h264major"]}}},{"timestamp":"2026-09-02T18:14:14","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/1.AMP RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f312e414d5020525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"356ba105-35d1-4730-84fd-ab0f58481ad1","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":12,"enriched":{"digest":"5383967237e5a958","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/1.AMP RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"domains":["1.amp"]}}},{"timestamp":"2026-09-02T18:14:14","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/1 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f3120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"0e80c805-6322-40fa-9982-f538392a758a","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":12,"enriched":{"digest":"07316b7f68217745","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/1 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"]}},{"timestamp":"2026-09-02T18:14:14","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/0/video1 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f302f766964656f3120525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"6ebf7f1c-ad89-4b8b-bb36-ac8798e4605f","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":12,"enriched":{"digest":"be10b46dfd4f2e4d","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/0/video1 RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/0/video1"]}}},{"timestamp":"2026-09-02T18:14:13","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/0/usrnm:pwd/main RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f302f7573726e6d3a7077642f6d61696e20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"046d6a67-9db9-4806-9b27-aadcfa3c2222","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":12,"enriched":{"digest":"fd5d34cf909116cc","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/0/usrnm:pwd/main RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/0/usrnm"]}}},{"timestamp":"2026-09-02T18:14:13","port":8554,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"DESCRIBE rtsp://<HONEYPOT>:8554/0/1:1/main RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: Mozilla/5.0\r\nAccept: application/sdp\r\n\r\n","payload_hex":"444553435249424520727473703a2f2f<HONEYPOT>3a383535342f302f313a312f6d61696e20525453502f312e300d0a435365713a20310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f7364700d0a0d0a","method":"","user_agent":"","ja3":"","session":"63ae1311-d3a3-4cb9-a718-7973f1fe2b60","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":12,"enriched":{"digest":"4419ffe48f763d57","strings":["DESCRIBE rtsp://<HONEYPOT>:8554/0/1:1/main RTSP/1.0","CSeq: 1","User-Agent: Mozilla/5.0","Accept: application/sdp"],"iocs":{"paths":["/0/1"]}}}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-04T21:36:41.085490+00:00"}