{"ip":"198.98.57.120","total_events":90,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"37+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 37 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"43,853 bytes sent","bytes_sent":43853,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-05T01:01:31","last_seen":"2026-08-14T11:25:23","events_24h":1,"events_7d":56,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Staten Island","lat":40.6063,"lon":-74.1774,"asn":53667,"org":"FranTech Solutions"},"source_domain":"s1.storage.chilldns.net","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8933,"proto":"tcp","label":"","count":4},{"port":5076,"proto":"tcp","label":"","count":4},{"port":6161,"proto":"tcp","label":"","count":4},{"port":5061,"proto":"tcp","label":"SIPS","count":4},{"port":5072,"proto":"tcp","label":"","count":4},{"port":6061,"proto":"tcp","label":"","count":4},{"port":5073,"proto":"tcp","label":"","count":4},{"port":5075,"proto":"tcp","label":"","count":4},{"port":5079,"proto":"tcp","label":"","count":4},{"port":5074,"proto":"tcp","label":"","count":4},{"port":15061,"proto":"tcp","label":"","count":4},{"port":15060,"proto":"tcp","label":"","count":4},{"port":5071,"proto":"tcp","label":"","count":4},{"port":6060,"proto":"tcp","label":"","count":4},{"port":5077,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i260600_db6bc8f7861c_e52a70c5eba9"],"tls_ja3":["1f587d8031d98b69da197bc38f8ca923"],"ja4h":[]},"fingerprint_peers":{"t12i260600_db6bc8f7861c_e52a70c5eba9":5},"user_agents":[],"timeline":[{"date":"2026-08-05","count":4},{"date":"2026-08-06","count":15},{"date":"2026-08-07","count":15},{"date":"2026-08-08","count":9},{"date":"2026-08-09","count":13},{"date":"2026-08-10","count":14},{"date":"2026-08-11","count":15},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":1}],"recent_events":[{"timestamp":"2026-08-14T11:25:23","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=9551c029d\r\nVia: SIP/2.0/TCP 198.98.57.120:61534;branch=z9hG4bK-d87543-346103331-1--d87543;rport\r\nCall-ID: bd8354a068bf49bea0cdbbf0c161b510\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:61534>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3935353163303239640d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a36313533343b6272616e63683d7a39684734624b2d6438373534332d3334363130333333312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2062643833353461303638626634396265613063646262663063313631623531300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a36313533343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"68e45569-5691-4e26-a200-fc78343265eb","seq":1,"duration_ms":100,"bytes_in":487,"bytes_out":13,"enriched":{"digest":"11129b291873ef8a","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=9551c029d","Via: SIP/2.0/TCP 198.98.57.120:61534;branch=z9hG4bK-d87543-346103331-1--d87543;r…","Call-ID: bd8354a068bf49bea0cdbbf0c161b510","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:61534>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-13T18:02:52","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=02e06207f\r\nVia: SIP/2.0/TCP 198.98.57.120:49789;branch=z9hG4bK-d87543-381534231-1--d87543;rport\r\nCall-ID: e38b05bc719648f4abca50b2f836fcfa\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:49789>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3032653036323037660d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a34393738393b6272616e63683d7a39684734624b2d6438373534332d3338313533343233312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065333862303562633731393634386634616263613530623266383336666366610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a34393738393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"e8bd5254-3144-4f3b-b7fb-aeaa02d522ad","seq":1,"duration_ms":100,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"1b7ef220e559e07a","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=02e06207f","Via: SIP/2.0/TCP 198.98.57.120:49789;branch=z9hG4bK-d87543-381534231-1--d87543;r…","Call-ID: e38b05bc719648f4abca50b2f836fcfa","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:49789>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-13T17:46:00","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=1a1537603\r\nVia: SIP/2.0/TCP 198.98.57.120:63136;branch=z9hG4bK-d87543-142728964-1--d87543;rport\r\nCall-ID: 3dbad115d623440e96189edb53b6e56e\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:63136>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3161313533373630330d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a36333133363b6272616e63683d7a39684734624b2d6438373534332d3134323732383936342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2033646261643131356436323334343065393631383965646235336236653536650d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a36333133363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"655940a1-a0a2-4e00-87d0-80c388a48d3e","seq":1,"duration_ms":100,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"1a6b7115d49e9e71","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=1a1537603","Via: SIP/2.0/TCP 198.98.57.120:63136;branch=z9hG4bK-d87543-142728964-1--d87543;r…","Call-ID: 3dbad115d623440e96189edb53b6e56e","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:63136>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-13T16:20:30","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=7dda47ea6\r\nVia: SIP/2.0/TCP 198.98.57.120:56126;branch=z9hG4bK-d87543-591007275-1--d87543;rport\r\nCall-ID: b2b6d292068a42678ba5cc1ed30599b8\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:56126>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3764646134376561360d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35363132363b6272616e63683d7a39684734624b2d6438373534332d3539313030373237352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2062326236643239323036386134323637386261356363316564333035393962380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35363132363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"e251b8f4-945f-4ae5-b91e-bf110070989a","seq":1,"duration_ms":100,"bytes_in":484,"bytes_out":13,"enriched":{"digest":"1adb21d11d84249d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=7dda47ea6","Via: SIP/2.0/TCP 198.98.57.120:56126;branch=z9hG4bK-d87543-591007275-1--d87543;r…","Call-ID: b2b6d292068a42678ba5cc1ed30599b8","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:56126>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-13T12:39:54","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=efb839acb\r\nVia: SIP/2.0/TCP 198.98.57.120:57062;branch=z9hG4bK-d87543-704958028-1--d87543;rport\r\nCall-ID: 952930b10aef43cf888e2e0bdd6b5b09\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:57062>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d6566623833396163620d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35373036323b6272616e63683d7a39684734624b2d6438373534332d3730343935383032382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039353239333062313061656634336366383838653265306264643662356230390d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35373036323e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"8e561249-764a-4c41-be0a-cb8e2d835161","seq":1,"duration_ms":100,"bytes_in":487,"bytes_out":13,"enriched":{"digest":"d47ee20fac01b2ee","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=efb839acb","Via: SIP/2.0/TCP 198.98.57.120:57062;branch=z9hG4bK-d87543-704958028-1--d87543;r…","Call-ID: 952930b10aef43cf888e2e0bdd6b5b09","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:57062>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T07:42:35","port":8933,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=0bb526a84\r\nVia: SIP/2.0/TCP 198.98.57.120:57713;branch=z9hG4bK-d87543-423045390-1--d87543;rport\r\nCall-ID: 78dc1c10eac1477097c41f2b9e2acd05\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:57713>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3062623532366138340d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35373731333b6272616e63683d7a39684734624b2d6438373534332d3432333034353339302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037386463316331306561633134373730393763343166326239653261636430350d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35373731333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"8e78d86b-7268-4a7d-8591-14aba2a5913e","seq":1,"duration_ms":100,"bytes_in":507,"bytes_out":13,"enriched":{"digest":"d9294a9046661da7","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=0bb526a84","Via: SIP/2.0/TCP 198.98.57.120:57713;branch=z9hG4bK-d87543-423045390-1--d87543;r…","Call-ID: 78dc1c10eac1477097c41f2b9e2acd05","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:57713>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T07:30:18","port":6060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=4ebb2e057\r\nVia: SIP/2.0/TCP 198.98.57.120:51615;branch=z9hG4bK-d87543-242293637-1--d87543;rport\r\nCall-ID: 34ae864ccfb04932833db766d9eb41f0\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:51615>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3465626232653035370d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35313631353b6272616e63683d7a39684734624b2d6438373534332d3234323239333633372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2033346165383634636366623034393332383333646237363664396562343166300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35313631353e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"12fbdfdd-3d2e-4421-a167-cb6830f1d497","seq":1,"duration_ms":100,"bytes_in":507,"bytes_out":13,"enriched":{"digest":"594edb926b27a2da","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=4ebb2e057","Via: SIP/2.0/TCP 198.98.57.120:51615;branch=z9hG4bK-d87543-242293637-1--d87543;r…","Call-ID: 34ae864ccfb04932833db766d9eb41f0","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:51615>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T06:11:29","port":6161,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=9e8a798e2\r\nVia: SIP/2.0/TCP 198.98.57.120:54959;branch=z9hG4bK-d87543-813465477-1--d87543;rport\r\nCall-ID: 853a4caff6bf40d7afc195eb5bce6782\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:54959>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3965386137393865320d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35343935393b6272616e63683d7a39684734624b2d6438373534332d3831333436353437372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2038353361346361666636626634306437616663313935656235626365363738320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35343935393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"7efc8e01-609b-4191-a5cd-d37aea164884","seq":1,"duration_ms":100,"bytes_in":510,"bytes_out":13,"enriched":{"digest":"6e5344add0e01c8d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=9e8a798e2","Via: SIP/2.0/TCP 198.98.57.120:54959;branch=z9hG4bK-d87543-813465477-1--d87543;r…","Call-ID: 853a4caff6bf40d7afc195eb5bce6782","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:54959>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T06:11:11","port":15061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=ef396ee0c\r\nVia: SIP/2.0/TCP 198.98.57.120:51638;branch=z9hG4bK-d87543-044404764-1--d87543;rport\r\nCall-ID: 0c579106f2b745ed9afb53e296a25318\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:51638>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d6566333936656530630d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35313633383b6272616e63683d7a39684734624b2d6438373534332d3034343430343736342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2030633537393130366632623734356564396166623533653239366132353331380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35313633383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"fed62246-95a7-4272-872a-759cf2d01e69","seq":1,"duration_ms":100,"bytes_in":507,"bytes_out":13,"enriched":{"digest":"67acbe7df5241b0c","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=ef396ee0c","Via: SIP/2.0/TCP 198.98.57.120:51638;branch=z9hG4bK-d87543-044404764-1--d87543;r…","Call-ID: 0c579106f2b745ed9afb53e296a25318","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:51638>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T05:57:09","port":6061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10019854054@<HONEYPOT>>\r\nFrom: <sip:10019854054@<HONEYPOT>>;tag=25fdd70d3\r\nVia: SIP/2.0/TCP 198.98.57.120:58120;branch=z9hG4bK-d87543-888054256-1--d87543;rport\r\nCall-ID: ec1078f4d9974e73b2bd4da7359903f4\r\nCSeq: 1 REGISTER\r\nContact: <sip:10019854054@198.98.57.120:58120>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313030313938353430353440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313030313938353430353440<HONEYPOT>3e3b7461673d3235666464373064330d0a5669613a205349502f322e302f544350203139382e39382e35372e3132303a35383132303b6272616e63683d7a39684734624b2d6438373534332d3838383035343235362d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065633130373866346439393734653733623262643464613733353939303366340d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130303139383534303534403139382e39382e35372e3132303a35383132303e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"e38a4a92-8370-40de-a7da-d08ed7007287","seq":1,"duration_ms":100,"bytes_in":510,"bytes_out":13,"enriched":{"digest":"8ce24491ca7298b3","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10019854054@<HONEYPOT>>","From: <sip:10019854054@<HONEYPOT>>;tag=25fdd70d3","Via: SIP/2.0/TCP 198.98.57.120:58120;branch=z9hG4bK-d87543-888054256-1--d87543;r…","Call-ID: ec1078f4d9974e73b2bd4da7359903f4","CSeq: 1 REGISTER","Contact: <sip:10019854054@198.98.57.120:58120>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.57.120"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":37,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T04:45:51.110711+00:00"}