{"ip":"172.110.223.109","total_events":7,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["7 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,409 bytes sent","bytes_sent":2409,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-06T01:16:05","last_seen":"2026-09-07T01:14:12","events_24h":0,"events_7d":0,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":23470,"org":"ReliableSite.Net LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as23470","label":"ReliableSite.Net","category":"cdn","url":"https://www.peeringdb.com/asn/23470"},"cve_matches":[],"malware":[],"top_ports":[{"port":5061,"proto":"tcp","label":"SIPS","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i200600_22c523c4c553_2dae41c691ec"],"tls_client_hello":"","tls_ja3":["113d359fe776f0b5704058d8b6474b77"],"http_akin":["b11cun030_00040011_213543bf"]},"fingerprint_peers":{"t12i200600_22c523c4c553_2dae41c691ec":2,"b11cun030_00040011_213543bf":9},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0"],"timeline":[{"date":"2026-09-06","count":6},{"date":"2026-09-07","count":1}],"recent_events":[{"timestamp":"2026-09-07T01:14:12","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:+39250200000@<HONEYPOT>>\r\nFrom: <sip:+39250200000@<HONEYPOT>>;tag=3536c12ba\r\nVia: SIP/2.0/TLS 172.110.223.109:55768;branch=z9hG4bK-d87543-553144875-1--d87543;rport\r\nCall-ID: 0afa4193018740ae9ed324ab1289cabf\r\nCSeq: 1 REGISTER\r\nContact: <sip:+39250200000@172.110.223.109:55768>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a2b333932353032303030303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a2b333932353032303030303040<HONEYPOT>3e3b7461673d3335333663313262610d0a5669613a205349502f322e302f544c53203137322e3131302e3232332e3130393a35353736383b6272616e63683d7a39684734624b2d6438373534332d3535333134343837352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2030616661343139333031383734306165396564333234616231323839636162660d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a2b3339323530323030303030403137322e3131302e3232332e3130393a35353736383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"113d359fe776f0b5704058d8b6474b77","session":"614fb975-0294-4071-8df7-aac5323e879d","seq":1,"duration_ms":185,"bytes_in":488,"bytes_out":15,"enriched":{"digest":"5e1b9f63ad5b1ddf","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:+39250200000@<HONEYPOT>>","From: <sip:+39250200000@<HONEYPOT>>;tag=3536c12ba","Via: SIP/2.0/TLS 172.110.223.109:55768;branch=z9hG4bK-d87543-553144875-1--d87543…","Call-ID: 0afa4193018740ae9ed324ab1289cabf","CSeq: 1 REGISTER","Contact: <sip:+39250200000@172.110.223.109:55768>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["172.110.223.109"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-06T22:03:59","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:+39250200000@<HONEYPOT>>\r\nFrom: <sip:+39250200000@<HONEYPOT>>;tag=431843587\r\nVia: SIP/2.0/TLS 172.110.223.109:53006;branch=z9hG4bK-d87543-736479781-1--d87543;rport\r\nCall-ID: 988285fa840642c4812a45dfc1b0c598\r\nCSeq: 1 REGISTER\r\nContact: <sip:+39250200000@172.110.223.109:53006>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a2b333932353032303030303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a2b333932353032303030303040<HONEYPOT>3e3b7461673d3433313834333538370d0a5669613a205349502f322e302f544c53203137322e3131302e3232332e3130393a35333030363b6272616e63683d7a39684734624b2d6438373534332d3733363437393738312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039383832383566613834303634326334383132613435646663316230633539380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a2b3339323530323030303030403137322e3131302e3232332e3130393a35333030363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"113d359fe776f0b5704058d8b6474b77","session":"3176e518-a1aa-4271-93a9-9c55c6778422","seq":1,"duration_ms":187,"bytes_in":491,"bytes_out":15,"enriched":{"digest":"6b5fc70e0d113be1","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:+39250200000@<HONEYPOT>>","From: <sip:+39250200000@<HONEYPOT>>;tag=431843587","Via: SIP/2.0/TLS 172.110.223.109:53006;branch=z9hG4bK-d87543-736479781-1--d87543…","Call-ID: 988285fa840642c4812a45dfc1b0c598","CSeq: 1 REGISTER","Contact: <sip:+39250200000@172.110.223.109:53006>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["172.110.223.109"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-06T21:25:34","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:+39250200000@<HONEYPOT>>\r\nFrom: <sip:+39250200000@<HONEYPOT>>;tag=e2f910483\r\nVia: SIP/2.0/TLS 172.110.223.109:63599;branch=z9hG4bK-d87543-515764071-1--d87543;rport\r\nCall-ID: 60fca48a82884ff28d8402dff4436ce9\r\nCSeq: 1 REGISTER\r\nContact: <sip:+39250200000@172.110.223.109:63599>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a2b333932353032303030303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a2b333932353032303030303040<HONEYPOT>3e3b7461673d6532663931303438330d0a5669613a205349502f322e302f544c53203137322e3131302e3232332e3130393a36333539393b6272616e63683d7a39684734624b2d6438373534332d3531353736343037312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2036306663613438613832383834666632386438343032646666343433366365390d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a2b3339323530323030303030403137322e3131302e3232332e3130393a36333539393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"113d359fe776f0b5704058d8b6474b77","session":"bae072b5-4944-4bf4-ba84-2be0b149d6ed","seq":1,"duration_ms":120,"bytes_in":485,"bytes_out":15,"enriched":{"digest":"a340f77d226666ae","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:+39250200000@<HONEYPOT>>","From: <sip:+39250200000@<HONEYPOT>>;tag=e2f910483","Via: SIP/2.0/TLS 172.110.223.109:63599;branch=z9hG4bK-d87543-515764071-1--d87543…","Call-ID: 60fca48a82884ff28d8402dff4436ce9","CSeq: 1 REGISTER","Contact: <sip:+39250200000@172.110.223.109:63599>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["172.110.223.109"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-06T20:44:05","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:+39250200000@<HONEYPOT>>\r\nFrom: <sip:+39250200000@<HONEYPOT>>;tag=536d32d80\r\nVia: SIP/2.0/TLS 172.110.223.109:64096;branch=z9hG4bK-d87543-121174484-1--d87543;rport\r\nCall-ID: f8fc41b233744979a91ef76bebebb06d\r\nCSeq: 1 REGISTER\r\nContact: <sip:+39250200000@172.110.223.109:64096>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a2b333932353032303030303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a2b333932353032303030303040<HONEYPOT>3e3b7461673d3533366433326438300d0a5669613a205349502f322e302f544c53203137322e3131302e3232332e3130393a36343039363b6272616e63683d7a39684734624b2d6438373534332d3132313137343438342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2066386663343162323333373434393739613931656637366265626562623036640d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a2b3339323530323030303030403137322e3131302e3232332e3130393a36343039363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"113d359fe776f0b5704058d8b6474b77","session":"81f2559c-03ae-4399-9e05-e5b5e6fa9224","seq":1,"duration_ms":122,"bytes_in":485,"bytes_out":15,"enriched":{"digest":"823d62937459be16","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:+39250200000@<HONEYPOT>>","From: <sip:+39250200000@<HONEYPOT>>;tag=536d32d80","Via: SIP/2.0/TLS 172.110.223.109:64096;branch=z9hG4bK-d87543-121174484-1--d87543…","Call-ID: f8fc41b233744979a91ef76bebebb06d","CSeq: 1 REGISTER","Contact: <sip:+39250200000@172.110.223.109:64096>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["172.110.223.109"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-06T11:16:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a35362e3029204765636b6f2f32303130303130312046697265666f782f35362e300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0","ja3":"","session":"2da1b644-ff84-4eab-a45b-b64f6e16fa2c","seq":1,"duration_ms":100,"bytes_in":154,"bytes_out":80},{"timestamp":"2026-09-06T08:28:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a35362e3029204765636b6f2f32303130303130312046697265666f782f35362e300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0","ja3":"","session":"a2f76d4d-5014-490d-aaca-6f54e2481502","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":80},{"timestamp":"2026-09-06T01:16:05","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a35362e3029204765636b6f2f32303130303130312046697265666f782f35362e300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0","ja3":"","session":"fbca0db7-be22-4ad7-91d7-8ba33f1e9403","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":80}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":3,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-09-30T17:48:08.273861+00:00"}