{"ip":"185.243.5.10","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,709 bytes sent","bytes_sent":3709,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T04:45:48","last_seen":"2026-10-05T16:08:12","events_24h":0,"events_7d":5,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":23470,"org":"ReliableSite.Net LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as23470","label":"ReliableSite.Net","category":"cdn","url":"https://www.peeringdb.com/asn/23470"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":5065,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T14:34:53","last_seen":"2026-10-05T14:34:53","recent":[{"timestamp":"2026-10-05T14:34:53","port":5065,"src_port":61838,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT>:5065 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a9056018270168481EBC\r\nVia: SIP/2.0/UDP 185.243.5.10:61838;branch=z9hG4bK-d87543-914182270168482-1--d87543-;rport\r\nCall-ID: e5f4a905601895270168480e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:61838>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303635205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d6535663461393035363031383237303136383438314542430d0a5669613a205349502f322e302f554450203138352e3234332e352e31303a36313833383b6272616e63683d7a39684734624b2d6438373534332d3931343138323237303136383438322d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a20653566346139303536303138393532373031363834383065346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36313833383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"853b8074-945b-4523-8884-1c678dabdba2","bytes_in":476,"source_verified":false,"enriched":{"digest":"c4412a8cf617052e","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5065 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a9056018270168481EBC","Via: SIP/2.0/UDP 185.243.5.10:61838;branch=z9hG4bK-d87543-914182270168482-1--d87…","Call-ID: e5f4a905601895270168480e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:61838>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/UDP"]}}}]},"top_ports":[{"port":5061,"proto":"tcp","label":"SIPS","count":2},{"port":5063,"proto":"tcp","label":"","count":2},{"port":5064,"proto":"tcp","label":"","count":2},{"port":5065,"proto":"tcp","label":"","count":1},{"port":5062,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i240600_9295eb73ea51_e52a70c5eba9"],"tls_client_hello":"16030300920100008e0303645dd1a329f57925cf9fd73cc8524c835acf2df92f58167d150c0b8f75cabf95000030c028009f009e009d009cc02bc023c027c014c013003d003c0035002fc02cc024c00ac009006a004000380032000a001301000035000a0006000400170018000b00020100000d001400120601060304010501020104030503020302020023000000170000ff01000100","tls_ja3":["ad963d4bce50b9fdf99bb8402a022e42"],"http_akin":[]},"fingerprint_peers":{"t12i240600_9295eb73ea51_e52a70c5eba9":1},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":1},{"date":"2026-09-30","count":2},{"date":"2026-10-03","count":2},{"date":"2026-10-05","count":1}],"recent_events":[{"timestamp":"2026-10-05T16:08:12","port":5065,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5065 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a55757822359EBC\r\nVia: SIP/2.0/TLS 185.243.5.10:63160;branch=z9hG4bK-d87543-5977972360-1--d87543-;rport\r\nCall-ID: e5f4a5575782602358e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:63160>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303635205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d653566346135353735373832323335394542430d0a5669613a205349502f322e302f544c53203138352e3234332e352e31303a36333136303b6272616e63683d7a39684734624b2d6438373534332d353937373937323336302d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a2065356634613535373537383236303233353865346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36333136303e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"ad963d4bce50b9fdf99bb8402a022e42","session":"245473af-40dc-4974-9ae3-8cb44963f70b","seq":1,"duration_ms":120,"bytes_in":463,"bytes_out":12,"enriched":{"digest":"f6bd6c6cce6aed74","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5065 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a55757822359EBC","Via: SIP/2.0/TLS 185.243.5.10:63160;branch=z9hG4bK-d87543-5977972360-1--d87543-;…","Call-ID: e5f4a5575782602358e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:63160>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-03T07:43:50","port":5064,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5064 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a3449132188EBC\r\nVia: SIP/2.0/TLS 185.243.5.10:64736;branch=z9hG4bK-d87543-1222642189-1--d87543-;rport\r\nCall-ID: e5f4a344913602187e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:64736>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303634205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d6535663461333434393133323138384542430d0a5669613a205349502f322e302f544c53203138352e3234332e352e31303a36343733363b6272616e63683d7a39684734624b2d6438373534332d313232323634323138392d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a20653566346133343439313336303231383765346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36343733363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"ad963d4bce50b9fdf99bb8402a022e42","session":"028e87d8-5879-4d91-a117-1faf9ad69f9d","seq":1,"duration_ms":120,"bytes_in":461,"bytes_out":12,"enriched":{"digest":"3030546b8e96bbf5","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5064 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a3449132188EBC","Via: SIP/2.0/TLS 185.243.5.10:64736;branch=z9hG4bK-d87543-1222642189-1--d87543-;…","Call-ID: e5f4a344913602187e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:64736>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-03T07:42:53","port":5064,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5064 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a612890371273EBC\r\nVia: SIP/2.0/TCP 185.243.5.10:59076;branch=z9hG4bK-d87543-64808171274-1--d87543-;rport\r\nCall-ID: e5f4a61289039771272e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:59076>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303634205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d65356634613631323839303337313237334542430d0a5669613a205349502f322e302f544350203138352e3234332e352e31303a35393037363b6272616e63683d7a39684734624b2d6438373534332d36343830383137313237342d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a206535663461363132383930333937373132373265346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a35393037363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"4fbeac1b-a679-4374-9229-37915b0a9f80","seq":1,"duration_ms":100,"bytes_in":466,"bytes_out":12,"enriched":{"digest":"6c0f440d5ed6e5a9","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5064 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a612890371273EBC","Via: SIP/2.0/TCP 185.243.5.10:59076;branch=z9hG4bK-d87543-64808171274-1--d87543-…","Call-ID: e5f4a61289039771272e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:59076>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-30T23:21:27","port":5063,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5063 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a97474182056EBC\r\nVia: SIP/2.0/TLS 185.243.5.10:62228;branch=z9hG4bK-d87543-9770372057-1--d87543-;rport\r\nCall-ID: e5f4a9747419442055e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:62228>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303633205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d653566346139373437343138323035364542430d0a5669613a205349502f322e302f544c53203138352e3234332e352e31303a36323232383b6272616e63683d7a39684734624b2d6438373534332d393737303337323035372d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a2065356634613937343734313934343230353565346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36323232383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"ad963d4bce50b9fdf99bb8402a022e42","session":"99f3cae7-817f-401a-ae0c-d247eb250f9a","seq":1,"duration_ms":120,"bytes_in":463,"bytes_out":12,"enriched":{"digest":"02f766bd2055ab3f","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5063 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a97474182056EBC","Via: SIP/2.0/TLS 185.243.5.10:62228;branch=z9hG4bK-d87543-9770372057-1--d87543-;…","Call-ID: e5f4a9747419442055e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:62228>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-30T23:20:45","port":5063,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5063 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a435542460842EBC\r\nVia: SIP/2.0/TCP 185.243.5.10:60493;branch=z9hG4bK-d87543-48685660843-1--d87543-;rport\r\nCall-ID: e5f4a43554251260841e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:60493>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303633205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d65356634613433353534323436303834324542430d0a5669613a205349502f322e302f544350203138352e3234332e352e31303a36303439333b6272616e63683d7a39684734624b2d6438373534332d34383638353636303834332d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a206535663461343335353432353132363038343165346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36303439333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"c9bcbebb-fdd2-47c1-a51f-d25ff68cefa7","seq":1,"duration_ms":100,"bytes_in":466,"bytes_out":12,"enriched":{"digest":"c34aec53857e45d9","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5063 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a435542460842EBC","Via: SIP/2.0/TCP 185.243.5.10:60493;branch=z9hG4bK-d87543-48685660843-1--d87543-…","Call-ID: e5f4a43554251260841e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:60493>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-28T14:08:25","port":5062,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5062 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a17994901912EBC\r\nVia: SIP/2.0/TLS 185.243.5.10:60755;branch=z9hG4bK-d87543-2544981913-1--d87543-;rport\r\nCall-ID: e5f4a1799490501911e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:60755>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303632205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d653566346131373939343930313931324542430d0a5669613a205349502f322e302f544c53203138352e3234332e352e31303a36303735353b6272616e63683d7a39684734624b2d6438373534332d323534343938313931332d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a2065356634613137393934393035303139313165346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36303735353e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"ad963d4bce50b9fdf99bb8402a022e42","session":"d24e7b1e-1c37-47aa-8571-7129435e6d21","seq":1,"duration_ms":121,"bytes_in":463,"bytes_out":12,"enriched":{"digest":"4a1735c91a551620","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5062 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a17994901912EBC","Via: SIP/2.0/TLS 185.243.5.10:60755;branch=z9hG4bK-d87543-2544981913-1--d87543-;…","Call-ID: e5f4a1799490501911e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:60755>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-26T04:46:10","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5061 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a2019641273EBC\r\nVia: SIP/2.0/TLS 185.243.5.10:61824;branch=z9hG4bK-d87543-1092691274-1--d87543-;rport\r\nCall-ID: e5f4a201964581272e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:61824>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303631205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d6535663461323031393634313237334542430d0a5669613a205349502f322e302f544c53203138352e3234332e352e31303a36313832343b6272616e63683d7a39684734624b2d6438373534332d313039323639313237342d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a20653566346132303139363435383132373265346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a36313832343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"ad963d4bce50b9fdf99bb8402a022e42","session":"db073047-1581-4de1-b772-f6687474a6e1","seq":1,"duration_ms":120,"bytes_in":461,"bytes_out":12,"enriched":{"digest":"a5aa29c1cd2b5788","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5061 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a2019641273EBC","Via: SIP/2.0/TLS 185.243.5.10:61824;branch=z9hG4bK-d87543-1092691274-1--d87543-;…","Call-ID: e5f4a201964581272e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:61824>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-26T04:45:48","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT>:5061 SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=e5f4a321724040206EBC\r\nVia: SIP/2.0/TCP 185.243.5.10:58997;branch=z9hG4bK-d87543-38338540207-1--d87543-;rport\r\nCall-ID: e5f4a32172410540205e4f7a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@185.243.5.10:58997>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: SIPVOIP\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>3a35303631205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d65356634613332313732343034303230364542430d0a5669613a205349502f322e302f544350203138352e3234332e352e31303a35383939373b6272616e63683d7a39684734624b2d6438373534332d33383333383534303230372d312d2d6438373534332d3b72706f72740d0a43616c6c2d49443a206535663461333231373234313035343032303565346637610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403138352e3234332e352e31303a35383939373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20534950564f49500d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"5cc08bc0-80b3-496f-86cb-86e39275499f","seq":1,"duration_ms":100,"bytes_in":466,"bytes_out":12,"enriched":{"digest":"b7667376416eb6c8","label":"SIP","strings":["REGISTER sip:<HONEYPOT>:5061 SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=e5f4a321724040206EBC","Via: SIP/2.0/TCP 185.243.5.10:58997;branch=z9hG4bK-d87543-38338540207-1--d87543-…","Call-ID: e5f4a32172410540205e4f7a","CSeq: 1 REGISTER","Contact: <sip:1000@185.243.5.10:58997>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["185.243.5.10"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":5,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-06T21:17:53.669452+00:00"}