{"ip":"199.195.250.193","total_events":36,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["36 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 18,377 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"18,377 bytes sent","bytes_sent":18377,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-29T03:20:32","last_seen":"2026-08-13T18:26:54","events_24h":0,"events_7d":28,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Staten Island","lat":40.6063,"lon":-74.1774,"asn":53667,"org":"FranTech Solutions"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5061,"proto":"tcp","label":"SIPS","count":8},{"port":6161,"proto":"tcp","label":"","count":4},{"port":6061,"proto":"tcp","label":"","count":4},{"port":8933,"proto":"tcp","label":"","count":4},{"port":15060,"proto":"tcp","label":"","count":4},{"port":15061,"proto":"tcp","label":"","count":4},{"port":5060,"proto":"tcp","label":"SIP","count":4},{"port":6060,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i260600_db6bc8f7861c_e52a70c5eba9"],"tls_ja3":["1f587d8031d98b69da197bc38f8ca923"],"ja4h":[]},"fingerprint_peers":{"t12i260600_db6bc8f7861c_e52a70c5eba9":5},"user_agents":[],"timeline":[{"date":"2026-07-29","count":5},{"date":"2026-07-30","count":3},{"date":"2026-08-10","count":14},{"date":"2026-08-11","count":10},{"date":"2026-08-13","count":4}],"recent_events":[{"timestamp":"2026-08-13T18:26:54","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=39961a244\r\nVia: SIP/2.0/TLS 199.195.250.193:50200;branch=z9hG4bK-d87543-743157311-1--d87543;rport\r\nCall-ID: d9e7cc9d07534d1590d948929d1ae440\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:50200>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3339393631613234340d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35303230303b6272616e63683d7a39684734624b2d6438373534332d3734333135373331312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2064396537636339643037353334643135393064393438393239643161653434300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35303230303e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"909b5d48-f3c7-4696-9d42-2eb1da3348d6","seq":1,"duration_ms":120,"bytes_in":494,"bytes_out":15,"enriched":{"digest":"82aefcc539161ef3","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=39961a244","Via: SIP/2.0/TLS 199.195.250.193:50200;branch=z9hG4bK-d87543-743157311-1--d87543…","Call-ID: d9e7cc9d07534d1590d948929d1ae440","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:50200>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-13T18:15:12","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=1c1e77c49\r\nVia: SIP/2.0/TLS 199.195.250.193:49787;branch=z9hG4bK-d87543-221316697-1--d87543;rport\r\nCall-ID: 46cfd6038385410894899badad6b59a4\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:49787>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3163316537376334390d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a34393738373b6272616e63683d7a39684734624b2d6438373534332d3232313331363639372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2034366366643630333833383534313038393438393962616461643662353961340d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a34393738373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"9ce902d5-813e-4709-9754-10627634e76e","seq":1,"duration_ms":121,"bytes_in":494,"bytes_out":15,"enriched":{"digest":"e67a0e4b17227b96","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=1c1e77c49","Via: SIP/2.0/TLS 199.195.250.193:49787;branch=z9hG4bK-d87543-221316697-1--d87543…","Call-ID: 46cfd6038385410894899badad6b59a4","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:49787>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-13T17:25:02","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=fb8bd52a5\r\nVia: SIP/2.0/TLS 199.195.250.193:59869;branch=z9hG4bK-d87543-875744057-1--d87543;rport\r\nCall-ID: cb01ff8788f84c2f83467369a0012d00\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:59869>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d6662386264353261350d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35393836393b6272616e63683d7a39684734624b2d6438373534332d3837353734343035372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2063623031666638373838663834633266383334363733363961303031326430300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35393836393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"edf41f38-4128-4a0c-8e08-14a8c8b3f6d3","seq":1,"duration_ms":195,"bytes_in":500,"bytes_out":15,"enriched":{"digest":"d18832400793b7b4","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=fb8bd52a5","Via: SIP/2.0/TLS 199.195.250.193:59869;branch=z9hG4bK-d87543-875744057-1--d87543…","Call-ID: cb01ff8788f84c2f83467369a0012d00","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:59869>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-13T16:54:22","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=e752c427a\r\nVia: SIP/2.0/TLS 199.195.250.193:65308;branch=z9hG4bK-d87543-394584625-1--d87543;rport\r\nCall-ID: 4471d18bef344d318f6b2a02a9c8094b\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:65308>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d6537353263343237610d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a36353330383b6272616e63683d7a39684734624b2d6438373534332d3339343538343632352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2034343731643138626566333434643331386636623261303261396338303934620d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a36353330383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"d3048f5d-4228-4a95-8666-1b0e94f98c11","seq":1,"duration_ms":185,"bytes_in":497,"bytes_out":15,"enriched":{"digest":"0eb2472edc9faf92","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=e752c427a","Via: SIP/2.0/TLS 199.195.250.193:65308;branch=z9hG4bK-d87543-394584625-1--d87543…","Call-ID: 4471d18bef344d318f6b2a02a9c8094b","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:65308>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T10:02:49","port":8933,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=7e63e132e\r\nVia: SIP/2.0/TLS 199.195.250.193:49888;branch=z9hG4bK-d87543-828405830-1--d87543;rport\r\nCall-ID: bee4effe84ae4786a88788afd082c0b2\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:49888>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3765363365313332650d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a34393838383b6272616e63683d7a39684734624b2d6438373534332d3832383430353833302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2062656534656666653834616534373836613838373838616664303832633062320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a34393838383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"638ec2b6-95e7-4c28-9b2d-6173d8b63062","seq":1,"duration_ms":185,"bytes_in":520,"bytes_out":15,"enriched":{"digest":"a8e3a08d02451818","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=7e63e132e","Via: SIP/2.0/TLS 199.195.250.193:49888;branch=z9hG4bK-d87543-828405830-1--d87543…","Call-ID: bee4effe84ae4786a88788afd082c0b2","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:49888>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T09:45:42","port":8933,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=a74790317\r\nVia: SIP/2.0/TLS 199.195.250.193:54751;branch=z9hG4bK-d87543-113395562-1--d87543;rport\r\nCall-ID: c1847babc43c4af0b0829aa1dbcb9a37\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:54751>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d6137343739303331370d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35343735313b6272616e63683d7a39684734624b2d6438373534332d3131333339353536322d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2063313834376261626334336334616630623038323961613164626362396133370d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35343735313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"3a7ccd4d-2ee0-4d7c-8052-69fe494ca062","seq":1,"duration_ms":196,"bytes_in":523,"bytes_out":15,"enriched":{"digest":"748fd5807b30e1d2","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=a74790317","Via: SIP/2.0/TLS 199.195.250.193:54751;branch=z9hG4bK-d87543-113395562-1--d87543…","Call-ID: c1847babc43c4af0b0829aa1dbcb9a37","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:54751>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T08:25:47","port":8933,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=480759b00\r\nVia: SIP/2.0/TLS 199.195.250.193:58247;branch=z9hG4bK-d87543-350457394-1--d87543;rport\r\nCall-ID: c1832294d9e7462b96dd279db06ed704\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:58247>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3438303735396230300d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35383234373b6272616e63683d7a39684734624b2d6438373534332d3335303435373339342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2063313833323239346439653734363262393664643237396462303665643730340d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35383234373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"f21de0a4-1458-44dd-9555-bc7a89ce1e45","seq":1,"duration_ms":121,"bytes_in":517,"bytes_out":15,"enriched":{"digest":"0ee0169fad87f436","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=480759b00","Via: SIP/2.0/TLS 199.195.250.193:58247;branch=z9hG4bK-d87543-350457394-1--d87543…","Call-ID: c1832294d9e7462b96dd279db06ed704","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:58247>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T07:22:04","port":15060,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=530eea7a8\r\nVia: SIP/2.0/TLS 199.195.250.193:49841;branch=z9hG4bK-d87543-596468046-1--d87543;rport\r\nCall-ID: e622443f07464996ace3aeec358744a5\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:49841>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3533306565613761380d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a34393834313b6272616e63683d7a39684734624b2d6438373534332d3539363436383034362d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065363232343433663037343634393936616365336165656333353837343461350d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a34393834313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"78306193-32bf-408f-9e66-a3da900861d6","seq":1,"duration_ms":121,"bytes_in":517,"bytes_out":15,"enriched":{"digest":"b48f2b0b4efc1e33","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=530eea7a8","Via: SIP/2.0/TLS 199.195.250.193:49841;branch=z9hG4bK-d87543-596468046-1--d87543…","Call-ID: e622443f07464996ace3aeec358744a5","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:49841>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T06:48:40","port":15060,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=c2e846910\r\nVia: SIP/2.0/TLS 199.195.250.193:54735;branch=z9hG4bK-d87543-450152150-1--d87543;rport\r\nCall-ID: fe0a685800c2408bb039460b77093af9\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:54735>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d6332653834363931300d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35343733353b6272616e63683d7a39684734624b2d6438373534332d3435303135323135302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2066653061363835383030633234303862623033393436306237373039336166390d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35343733353e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"69fd49e0-15d1-4896-b55c-6bfdbf6e3096","seq":1,"duration_ms":120,"bytes_in":517,"bytes_out":15,"enriched":{"digest":"4e337c4f9cd5f870","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=c2e846910","Via: SIP/2.0/TLS 199.195.250.193:54735;branch=z9hG4bK-d87543-450152150-1--d87543…","Call-ID: fe0a685800c2408bb039460b77093af9","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:54735>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-08-11T06:24:10","port":6061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:10320940854504@<HONEYPOT>>\r\nFrom: <sip:10320940854504@<HONEYPOT>>;tag=97131bf44\r\nVia: SIP/2.0/TLS 199.195.250.193:56226;branch=z9hG4bK-d87543-704450188-1--d87543;rport\r\nCall-ID: 49f361f16a1b432d8af3634f8ed3da5c\r\nCSeq: 1 REGISTER\r\nContact: <sip:10320940854504@199.195.250.193:56226>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc teams (sparkwindows/43.9.0.\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a313033323039343038353435303440<HONEYPOT>3e0d0a46726f6d3a203c7369703a313033323039343038353435303440<HONEYPOT>3e3b7461673d3937313331626634340d0a5669613a205349502f322e302f544c53203139392e3139352e3235302e3139333a35363232363b6272616e63683d7a39684734624b2d6438373534332d3730343435303138382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2034396633363166313661316234333264386166333633346638656433646135630d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130333230393430383534353034403139392e3139352e3235302e3139333a35363232363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d7563207465616d732028737061726b77696e646f77732f34332e392e302e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"2764c315-15c0-4521-a284-c8ce82991d80","seq":1,"duration_ms":122,"bytes_in":517,"bytes_out":15,"enriched":{"digest":"cef86de6cb55d210","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:10320940854504@<HONEYPOT>>","From: <sip:10320940854504@<HONEYPOT>>;tag=97131bf44","Via: SIP/2.0/TLS 199.195.250.193:56226;branch=z9hG4bK-d87543-704450188-1--d87543…","Call-ID: 49f361f16a1b432d8af3634f8ed3da5c","CSeq: 1 REGISTER","Contact: <sip:10320940854504@199.195.250.193:56226>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.250.193"],"paths":["/2.0/TLS"]}}}],"http_methods":[],"distinct_ports_total":8,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T04:45:49.591818+00:00"}