Do not expose camera ports directly to the internet. Instead, set up a Virtual Private Network (VPN) to securely connect to the local network before accessing the camera feeds.
Universal Plug and Play (UPnP) or manual port forwarding rules on routers expose the camera's local IP address directly to the public internet.
The motion.cgi endpoint often implies that the camera is configured to stream only when motion is detected, making it a target of interest for attackers seeking to monitor activity.
This specific string is popular in the cybersecurity and "OSINT" (Open Source Intelligence) communities because it can reveal thousands of live feeds from around the world.
For example, in a search result for an exposed Axis camera, you might see a line of HTML source code like this:
Many exposed cameras still use standard factory login combinations (e.g., admin/admin or root/pass), which automated scanners easily bypass.