{"ip":"198.98.62.191","total_events":105,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"31+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 31 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"50,659 bytes sent","bytes_sent":50659,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-29T02:37:20","last_seen":"2026-08-14T12:39:26","events_24h":2,"events_7d":71,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Staten Island","lat":40.6063,"lon":-74.1774,"asn":53667,"org":"FranTech Solutions"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5087,"proto":"tcp","label":"","count":6},{"port":5093,"proto":"tcp","label":"","count":5},{"port":5099,"proto":"tcp","label":"","count":5},{"port":5096,"proto":"tcp","label":"","count":5},{"port":5085,"proto":"tcp","label":"","count":5},{"port":5089,"proto":"tcp","label":"","count":5},{"port":5072,"proto":"tcp","label":"","count":4},{"port":5094,"proto":"tcp","label":"","count":4},{"port":5061,"proto":"tcp","label":"SIPS","count":4},{"port":5075,"proto":"tcp","label":"","count":4},{"port":5073,"proto":"tcp","label":"","count":4},{"port":5090,"proto":"tcp","label":"","count":3},{"port":5091,"proto":"tcp","label":"","count":3},{"port":5077,"proto":"tcp","label":"","count":3},{"port":5084,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i260600_db6bc8f7861c_e52a70c5eba9"],"tls_ja3":["1f587d8031d98b69da197bc38f8ca923"],"ja4h":[]},"fingerprint_peers":{"t12i260600_db6bc8f7861c_e52a70c5eba9":5},"user_agents":[],"timeline":[{"date":"2026-07-29","count":4},{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":21},{"date":"2026-08-07","count":7},{"date":"2026-08-08","count":28},{"date":"2026-08-09","count":22},{"date":"2026-08-10","count":19},{"date":"2026-08-14","count":2}],"recent_events":[{"timestamp":"2026-08-14T12:39:26","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=77bc82a95\r\nVia: SIP/2.0/TCP 198.98.62.191:63224;branch=z9hG4bK-d87543-446157985-1--d87543;rport\r\nCall-ID: 5d0dbad76bf24b04a021d455b4107fc6\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:63224>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3737626338326139350d0a5669613a205349502f322e302f544350203139382e39382e36322e3139313a36333232343b6272616e63683d7a39684734624b2d6438373534332d3434363135373938352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2035643064626164373662663234623034613032316434353562343130376663360d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a36333232343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"eabf9945-a20f-4588-92ef-e17dea839f4d","seq":1,"duration_ms":100,"bytes_in":484,"bytes_out":13,"enriched":{"digest":"064c86eb6f12f8f3","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=77bc82a95","Via: SIP/2.0/TCP 198.98.62.191:63224;branch=z9hG4bK-d87543-446157985-1--d87543;r…","Call-ID: 5d0dbad76bf24b04a021d455b4107fc6","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:63224>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-14T06:50:06","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=a091daeba\r\nVia: SIP/2.0/TCP 198.98.62.191:54319;branch=z9hG4bK-d87543-771723012-1--d87543;rport\r\nCall-ID: 2564a42919174a639f059cd06d13b4e8\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:54319>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d6130393164616562610d0a5669613a205349502f322e302f544350203139382e39382e36322e3139313a35343331393b6272616e63683d7a39684734624b2d6438373534332d3737313732333031322d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2032353634613432393139313734613633396630353963643036643133623465380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35343331393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"57892713-7145-45ba-8972-b49968ddafea","seq":1,"duration_ms":100,"bytes_in":487,"bytes_out":13,"enriched":{"digest":"9aaec89b3c636d4d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=a091daeba","Via: SIP/2.0/TCP 198.98.62.191:54319;branch=z9hG4bK-d87543-771723012-1--d87543;r…","Call-ID: 2564a42919174a639f059cd06d13b4e8","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:54319>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-10T10:53:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=42815bbc7\r\nVia: SIP/2.0/TLS 198.98.62.191:64017;branch=z9hG4bK-d87543-217552732-1--d87543;rport\r\nCall-ID: 96b6ace9e8a54f64b1171c4f24d96ed7\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:64017>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3432383135626263370d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a36343031373b6272616e63683d7a39684734624b2d6438373534332d3231373535323733322d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039366236616365396538613534663634623131373163346632346439366564370d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a36343031373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"a7b341b6-e629-453f-b8cd-cd7ea573f56e","seq":1,"duration_ms":160,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"5322ec295de85c95","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=42815bbc7","Via: SIP/2.0/TLS 198.98.62.191:64017;branch=z9hG4bK-d87543-217552732-1--d87543;r…","Call-ID: 96b6ace9e8a54f64b1171c4f24d96ed7","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:64017>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T10:53:04","port":5087,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=b9bc30b15\r\nVia: SIP/2.0/TLS 198.98.62.191:51482;branch=z9hG4bK-d87543-714144583-1--d87543;rport\r\nCall-ID: 2af862d95e8447aca7c54325135123f3\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:51482>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d6239626333306231350d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35313438323b6272616e63683d7a39684734624b2d6438373534332d3731343134343538332d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2032616638363264393565383434376163613763353433323531333531323366330d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35313438323e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"35bfd0cb-03df-492b-b7ce-ba01fd098cde","seq":1,"duration_ms":122,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"e587852f2a6e1906","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=b9bc30b15","Via: SIP/2.0/TLS 198.98.62.191:51482;branch=z9hG4bK-d87543-714144583-1--d87543;r…","Call-ID: 2af862d95e8447aca7c54325135123f3","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:51482>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T10:29:15","port":5098,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=833672117\r\nVia: SIP/2.0/TLS 198.98.62.191:53991;branch=z9hG4bK-d87543-810201001-1--d87543;rport\r\nCall-ID: 6167f7cf8f1c404cb452661e46827db2\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:53991>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3833333637323131370d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35333939313b6272616e63683d7a39684734624b2d6438373534332d3831303230313030312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2036313637663763663866316334303463623435323636316534363832376462320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35333939313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"ed5a23ee-fe70-4496-9875-85a2f27216c6","seq":1,"duration_ms":120,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"15bc9c537504457f","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=833672117","Via: SIP/2.0/TLS 198.98.62.191:53991;branch=z9hG4bK-d87543-810201001-1--d87543;r…","Call-ID: 6167f7cf8f1c404cb452661e46827db2","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:53991>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T08:54:53","port":5091,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=c9eca06e7\r\nVia: SIP/2.0/TLS 198.98.62.191:56490;branch=z9hG4bK-d87543-550021657-1--d87543;rport\r\nCall-ID: c3acc1bb078f41bbaf2c76bb3963de58\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:56490>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d6339656361303665370d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35363439303b6272616e63683d7a39684734624b2d6438373534332d3535303032313635372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2063336163633162623037386634316262616632633736626233393633646535380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35363439303e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"fb58f5f9-2f1c-4a8b-91cb-119a49361583","seq":1,"duration_ms":121,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"0ade2d64794d72e4","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=c9eca06e7","Via: SIP/2.0/TLS 198.98.62.191:56490;branch=z9hG4bK-d87543-550021657-1--d87543;r…","Call-ID: c3acc1bb078f41bbaf2c76bb3963de58","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:56490>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T08:25:33","port":5094,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=b3bb31caf\r\nVia: SIP/2.0/TLS 198.98.62.191:52448;branch=z9hG4bK-d87543-527220680-1--d87543;rport\r\nCall-ID: aba365fbed46408cab442f1cf579edb5\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:52448>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d6233626233316361660d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35323434383b6272616e63683d7a39684734624b2d6438373534332d3532373232303638302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2061626133363566626564343634303863616234343266316366353739656462350d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35323434383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"952264ef-9ddc-4b9d-b43c-5d44fa0decaa","seq":1,"duration_ms":121,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"5990d13cc971f495","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=b3bb31caf","Via: SIP/2.0/TLS 198.98.62.191:52448;branch=z9hG4bK-d87543-527220680-1--d87543;r…","Call-ID: aba365fbed46408cab442f1cf579edb5","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:52448>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T07:36:31","port":5097,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=477ec8a62\r\nVia: SIP/2.0/TLS 198.98.62.191:51043;branch=z9hG4bK-d87543-525154223-1--d87543;rport\r\nCall-ID: 74d53e0979774e6bbe39c0d965969bb8\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:51043>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3437376563386136320d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35313034333b6272616e63683d7a39684734624b2d6438373534332d3532353135343232332d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037346435336530393739373734653662626533396330643936353936396262380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35313034333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"0182cfe3-a73d-4a43-aabb-426daa32eb52","seq":1,"duration_ms":125,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"16457b67343445df","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=477ec8a62","Via: SIP/2.0/TLS 198.98.62.191:51043;branch=z9hG4bK-d87543-525154223-1--d87543;r…","Call-ID: 74d53e0979774e6bbe39c0d965969bb8","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:51043>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T07:26:32","port":5096,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=33223ff2a\r\nVia: SIP/2.0/TLS 198.98.62.191:64977;branch=z9hG4bK-d87543-002472480-1--d87543;rport\r\nCall-ID: 7466ad0480f045d18c0ebcba73fd1eb2\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:64977>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3333323233666632610d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a36343937373b6272616e63683d7a39684734624b2d6438373534332d3030323437323438302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037343636616430343830663034356431386330656263626137336664316562320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a36343937373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"83ce4360-0935-49ce-a363-36af5729b3d5","seq":1,"duration_ms":122,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"0becbd529c001452","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=33223ff2a","Via: SIP/2.0/TLS 198.98.62.191:64977;branch=z9hG4bK-d87543-002472480-1--d87543;r…","Call-ID: 7466ad0480f045d18c0ebcba73fd1eb2","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:64977>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-10T07:11:51","port":5085,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:120019804004@<HONEYPOT>>\r\nFrom: <sip:120019804004@<HONEYPOT>>;tag=0b78fd308\r\nVia: SIP/2.0/TLS 198.98.62.191:51987;branch=z9hG4bK-d87543-501224334-1--d87543;rport\r\nCall-ID: 7152f7a1e4844146a8394cfd290db160\r\nCSeq: 1 REGISTER\r\nContact: <sip:120019804004@198.98.62.191:51987>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31323030313938303430303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a31323030313938303430303440<HONEYPOT>3e3b7461673d3062373866643330380d0a5669613a205349502f322e302f544c53203139382e39382e36322e3139313a35313938373b6272616e63683d7a39684734624b2d6438373534332d3530313232343333342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037313532663761316534383434313436613833393463666432393064623136300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313230303139383034303034403139382e39382e36322e3139313a35313938373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"8e19f89f-de27-4f11-bc84-8fe7e288d7a9","seq":1,"duration_ms":120,"bytes_in":481,"bytes_out":13,"enriched":{"digest":"0ca77249dbe97da7","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:120019804004@<HONEYPOT>>","From: <sip:120019804004@<HONEYPOT>>;tag=0b78fd308","Via: SIP/2.0/TLS 198.98.62.191:51987;branch=z9hG4bK-d87543-501224334-1--d87543;r…","Call-ID: 7152f7a1e4844146a8394cfd290db160","CSeq: 1 REGISTER","Contact: <sip:120019804004@198.98.62.191:51987>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["198.98.62.191"],"paths":["/2.0/TLS"]}}}],"http_methods":[],"distinct_ports_total":31,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T04:45:50.606023+00:00"}