{"ip":"199.195.249.249","total_events":149,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"31+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 31 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"71,079 bytes sent","bytes_sent":71079,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-21T01:58:58","last_seen":"2026-09-15T20:34:35","events_24h":0,"events_7d":6,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Staten Island","lat":40.6063,"lon":-74.1774,"asn":53667,"org":"FranTech Solutions"},"source_domain":"mail.quickstartseo.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":54697,"proto":"tcp","label":"","count":27},{"port":5067,"proto":"tcp","label":"","count":13},{"port":5062,"proto":"tcp","label":"","count":12},{"port":5063,"proto":"tcp","label":"","count":11},{"port":5068,"proto":"tcp","label":"","count":10},{"port":5060,"proto":"tcp","label":"SIP","count":7},{"port":5078,"proto":"tcp","label":"","count":5},{"port":5091,"proto":"tcp","label":"","count":4},{"port":5080,"proto":"tcp","label":"","count":4},{"port":5065,"proto":"tcp","label":"","count":4},{"port":6670,"proto":"tcp","label":"","count":4},{"port":5064,"proto":"tcp","label":"","count":4},{"port":5066,"proto":"tcp","label":"","count":4},{"port":5069,"proto":"tcp","label":"","count":4},{"port":5090,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i260600_db6bc8f7861c_e52a70c5eba9"],"tls_ja3":["1f587d8031d98b69da197bc38f8ca923"],"ja4h":[]},"fingerprint_peers":{"t12i260600_db6bc8f7861c_e52a70c5eba9":8},"user_agents":[],"timeline":[{"date":"2026-08-21","count":15},{"date":"2026-08-22","count":21},{"date":"2026-08-23","count":2},{"date":"2026-08-24","count":1},{"date":"2026-08-26","count":1},{"date":"2026-08-27","count":3},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":18},{"date":"2026-09-02","count":29},{"date":"2026-09-03","count":2},{"date":"2026-09-05","count":7},{"date":"2026-09-06","count":19},{"date":"2026-09-07","count":8},{"date":"2026-09-10","count":12},{"date":"2026-09-11","count":3},{"date":"2026-09-15","count":6}],"recent_events":[{"timestamp":"2026-09-15T20:34:35","port":37215,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=1bbef8ba0\r\nVia: SIP/2.0/TCP 199.195.249.249:61217;branch=z9hG4bK-d87543-645155602-1--d87543;rport\r\nCall-ID: 7c3dfb026dad4fb4bd72a25999f5c6db\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:61217>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3162626566386261300d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a36313231373b6272616e63683d7a39684734624b2d6438373534332d3634353135353630322d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037633364666230323664616434666234626437326132353939396635633664620d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a36313231373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"a5492fee-6399-4136-9e97-22740b76fd44","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"395e1aa69e2d8696","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=1bbef8ba0","Via: SIP/2.0/TCP 199.195.249.249:61217;branch=z9hG4bK-d87543-645155602-1--d87543…","Call-ID: 7c3dfb026dad4fb4bd72a25999f5c6db","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:61217>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-15T10:11:46","port":6041,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=293ed32f3\r\nVia: SIP/2.0/TCP 199.195.249.249:49632;branch=z9hG4bK-d87543-944550295-1--d87543;rport\r\nCall-ID: 7c17bca4ba8445a58fd8d52d5c3b1c89\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:49632>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3239336564333266330d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a34393633323b6272616e63683d7a39684734624b2d6438373534332d3934343535303239352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037633137626361346261383434356135386664386435326435633362316338390d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a34393633323e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"2639680e-032c-412e-ae00-356c9541b69f","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"1d31a645913a3b2d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=293ed32f3","Via: SIP/2.0/TCP 199.195.249.249:49632;branch=z9hG4bK-d87543-944550295-1--d87543…","Call-ID: 7c17bca4ba8445a58fd8d52d5c3b1c89","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:49632>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-15T09:34:25","port":32414,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=99538fc9c\r\nVia: SIP/2.0/TCP 199.195.249.249:57381;branch=z9hG4bK-d87543-614038494-1--d87543;rport\r\nCall-ID: 5fb55b4038f84fc7a7813f7065bd2d1a\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:57381>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3939353338666339630d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a35373338313b6272616e63683d7a39684734624b2d6438373534332d3631343033383439342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2035666235356234303338663834666337613738313366373036356264326431610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35373338313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"f956c850-aa14-4f58-8cd1-175af7b8d729","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"c210b8446be2959e","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=99538fc9c","Via: SIP/2.0/TCP 199.195.249.249:57381;branch=z9hG4bK-d87543-614038494-1--d87543…","Call-ID: 5fb55b4038f84fc7a7813f7065bd2d1a","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:57381>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-15T07:34:51","port":32410,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=0e91a4550\r\nVia: SIP/2.0/TCP 199.195.249.249:49622;branch=z9hG4bK-d87543-114171854-1--d87543;rport\r\nCall-ID: ddeaaa457365420599e01661218d99d8\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:49622>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3065393161343535300d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a34393632323b6272616e63683d7a39684734624b2d6438373534332d3131343137313835342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2064646561616134353733363534323035393965303136363132313864393964380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a34393632323e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"826e9e5c-9a4b-4450-9b30-e7ee7fe5fbfd","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"0d44dfb9111f95db","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=0e91a4550","Via: SIP/2.0/TCP 199.195.249.249:49622;branch=z9hG4bK-d87543-114171854-1--d87543…","Call-ID: ddeaaa457365420599e01661218d99d8","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:49622>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-15T06:33:18","port":6040,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=1e3be91f8\r\nVia: SIP/2.0/TCP 199.195.249.249:57994;branch=z9hG4bK-d87543-443211992-1--d87543;rport\r\nCall-ID: e712888ba6f44bd1873d3b91030df36e\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:57994>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3165336265393166380d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a35373939343b6272616e63683d7a39684734624b2d6438373534332d3434333231313939322d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065373132383838626136663434626431383733643362393130333064663336650d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35373939343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"bb27825a-7dd6-41b6-b38b-9209ea2ef8cd","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"445b622ac327f772","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=1e3be91f8","Via: SIP/2.0/TCP 199.195.249.249:57994;branch=z9hG4bK-d87543-443211992-1--d87543…","Call-ID: e712888ba6f44bd1873d3b91030df36e","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:57994>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-15T00:09:58","port":8933,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=6562afeab\r\nVia: SIP/2.0/TCP 199.195.249.249:55989;branch=z9hG4bK-d87543-536789354-1--d87543;rport\r\nCall-ID: d51d0cce983f4333b71d092d50593a6b\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:55989>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3635363261666561620d0a5669613a205349502f322e302f544350203139392e3139352e3234392e3234393a35353938393b6272616e63683d7a39684734624b2d6438373534332d3533363738393335342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2064353164306363653938336634333333623731643039326435303539336136620d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35353938393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"3a4177f9-bb6d-4773-af00-e2312ae030ec","seq":1,"duration_ms":100,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"c7118bd62ce6b0f7","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=6562afeab","Via: SIP/2.0/TCP 199.195.249.249:55989;branch=z9hG4bK-d87543-536789354-1--d87543…","Call-ID: d51d0cce983f4333b71d092d50593a6b","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:55989>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-11T20:08:39","port":5091,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=f634fcc76\r\nVia: SIP/2.0/TLS 199.195.249.249:60604;branch=z9hG4bK-d87543-422321759-1--d87543;rport\r\nCall-ID: df6b9e982f3b479e9360dee9a2fe4d86\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:60604>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d6636333466636337360d0a5669613a205349502f322e302f544c53203139392e3139352e3234392e3234393a36303630343b6272616e63683d7a39684734624b2d6438373534332d3432323332313735392d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2064663662396539383266336234373965393336306465653961326665346438360d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a36303630343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"fbdd6156-ca4d-49cc-8a73-585ff4c19fab","seq":1,"duration_ms":196,"bytes_in":493,"bytes_out":15,"enriched":{"digest":"7d4fe6e6dc95e8a7","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=f634fcc76","Via: SIP/2.0/TLS 199.195.249.249:60604;branch=z9hG4bK-d87543-422321759-1--d87543…","Call-ID: df6b9e982f3b479e9360dee9a2fe4d86","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:60604>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-11T19:42:23","port":5080,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=c1affb61b\r\nVia: SIP/2.0/TLS 199.195.249.249:58455;branch=z9hG4bK-d87543-711334203-1--d87543;rport\r\nCall-ID: f8f6f8af83c44b499257140ecf961f40\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:58455>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d6331616666623631620d0a5669613a205349502f322e302f544c53203139392e3139352e3234392e3234393a35383435353b6272616e63683d7a39684734624b2d6438373534332d3731313333343230332d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2066386636663861663833633434623439393235373134306563663936316634300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35383435353e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"814e1102-74a1-48fc-b775-c81bd13d0d30","seq":1,"duration_ms":193,"bytes_in":493,"bytes_out":15,"enriched":{"digest":"a66e0783620f4a2f","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=c1affb61b","Via: SIP/2.0/TLS 199.195.249.249:58455;branch=z9hG4bK-d87543-711334203-1--d87543…","Call-ID: f8f6f8af83c44b499257140ecf961f40","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:58455>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-11T10:53:03","port":5090,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=739a53897\r\nVia: SIP/2.0/TLS 199.195.249.249:54574;branch=z9hG4bK-d87543-869574191-1--d87543;rport\r\nCall-ID: a203cca15bad40148c16e59a9e58c1e6\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:54574>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3733396135333839370d0a5669613a205349502f322e302f544c53203139392e3139352e3234392e3234393a35343537343b6272616e63683d7a39684734624b2d6438373534332d3836393537343139312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2061323033636361313562616434303134386331366535396139653538633165360d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35343537343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"4b80f68a-97a7-4687-bcbc-08540a64cf94","seq":1,"duration_ms":192,"bytes_in":493,"bytes_out":15,"enriched":{"digest":"d900180c28eab00d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=739a53897","Via: SIP/2.0/TLS 199.195.249.249:54574;branch=z9hG4bK-d87543-869574191-1--d87543…","Call-ID: a203cca15bad40148c16e59a9e58c1e6","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:54574>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-10T17:27:42","port":5091,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:1000@<HONEYPOT>>\r\nFrom: <sip:1000@<HONEYPOT>>;tag=694ba9db0\r\nVia: SIP/2.0/TLS 199.195.249.249:59362;branch=z9hG4bK-d87543-013415588-1--d87543;rport\r\nCall-ID: fad2bc870fa8481e95d85ac33034ff8f\r\nCSeq: 1 REGISTER\r\nContact: <sip:1000@199.195.249.249:59362>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a3130303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a3130303040<HONEYPOT>3e3b7461673d3639346261396462300d0a5669613a205349502f322e302f544c53203139392e3139352e3234392e3234393a35393336323b6272616e63683d7a39684734624b2d6438373534332d3031333431353538382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2066616432626338373066613834383165393564383561633333303334666638660d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a31303030403139392e3139352e3234392e3234393a35393336323e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"33982ef0-ddc6-4f88-94ee-e3119a730970","seq":1,"duration_ms":185,"bytes_in":490,"bytes_out":15,"enriched":{"digest":"a1d5584df8d83f58","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:1000@<HONEYPOT>>","From: <sip:1000@<HONEYPOT>>;tag=694ba9db0","Via: SIP/2.0/TLS 199.195.249.249:59362;branch=z9hG4bK-d87543-013415588-1--d87543…","Call-ID: fad2bc870fa8481e95d85ac33034ff8f","CSeq: 1 REGISTER","Contact: <sip:1000@199.195.249.249:59362>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.249.249"],"paths":["/2.0/TLS"]}}}],"http_methods":[],"distinct_ports_total":31,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T09:42:16.147415+00:00"}