{"ip":"199.195.254.198","total_events":37,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"16+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 16 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,425 bytes sent","bytes_sent":17425,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-21T16:18:02","last_seen":"2026-09-12T02:28:15","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Staten Island","lat":40.6063,"lon":-74.1774,"asn":53667,"org":"FranTech Solutions"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":20331,"proto":"tcp","label":"","count":9},{"port":5061,"proto":"tcp","label":"SIPS","count":8},{"port":54697,"proto":"tcp","label":"","count":7},{"port":5077,"proto":"tcp","label":"","count":1},{"port":5078,"proto":"tcp","label":"","count":1},{"port":5079,"proto":"tcp","label":"","count":1},{"port":5072,"proto":"tcp","label":"","count":1},{"port":5074,"proto":"tcp","label":"","count":1},{"port":5060,"proto":"tcp","label":"SIP","count":1},{"port":5062,"proto":"tcp","label":"","count":1},{"port":5076,"proto":"tcp","label":"","count":1},{"port":5070,"proto":"tcp","label":"","count":1},{"port":5071,"proto":"tcp","label":"","count":1},{"port":5075,"proto":"tcp","label":"","count":1},{"port":5073,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i260600_db6bc8f7861c_e52a70c5eba9"],"tls_ja3":["1f587d8031d98b69da197bc38f8ca923"],"ja4h":[]},"fingerprint_peers":{"t12i260600_db6bc8f7861c_e52a70c5eba9":8},"user_agents":[],"timeline":[{"date":"2026-08-21","count":3},{"date":"2026-08-22","count":6},{"date":"2026-08-23","count":3},{"date":"2026-08-27","count":2},{"date":"2026-09-02","count":15},{"date":"2026-09-03","count":5},{"date":"2026-09-09","count":2},{"date":"2026-09-12","count":1}],"recent_events":[{"timestamp":"2026-09-12T02:28:15","port":5060,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=e74453739\r\nVia: SIP/2.0/TLS 199.195.254.198:56423;branch=z9hG4bK-d87543-978493400-1--d87543;rport\r\nCall-ID: 952e11e4dccb471eac3fffe4b7206120\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:56423>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d6537343435333733390d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a35363432333b6272616e63683d7a39684734624b2d6438373534332d3937383439333430302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039353265313165346463636234373165616333666666653462373230363132300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a35363432333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d75630d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"8cd72758-4907-4c3c-af56-a3200b487164","seq":1,"duration_ms":194,"bytes_in":462,"bytes_out":15,"enriched":{"digest":"dd598b715e997b6f","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=e74453739","Via: SIP/2.0/TLS 199.195.254.198:56423;branch=z9hG4bK-d87543-978493400-1--d87543…","Call-ID: 952e11e4dccb471eac3fffe4b7206120","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:56423>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-09T21:29:22","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=4fdfba3c5\r\nVia: SIP/2.0/TLS 199.195.254.198:64387;branch=z9hG4bK-d87543-491739496-1--d87543;rport\r\nCall-ID: ef0ceb44835742e698778a7772ef018a\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:64387>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3466646662613363350d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a36343338373b6272616e63683d7a39684734624b2d6438373534332d3439313733393439362d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065663063656234343833353734326536393837373861373737326566303138610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a36343338373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"4ce7b296-aab5-44f1-8ca2-9f2c8e460d94","seq":1,"duration_ms":196,"bytes_in":464,"bytes_out":15,"enriched":{"digest":"403ae7471b8a0315","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=4fdfba3c5","Via: SIP/2.0/TLS 199.195.254.198:64387;branch=z9hG4bK-d87543-491739496-1--d87543…","Call-ID: ef0ceb44835742e698778a7772ef018a","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:64387>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-09T21:14:07","port":5070,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=6cff0536a\r\nVia: SIP/2.0/TLS 199.195.254.198:50771;branch=z9hG4bK-d87543-032015930-1--d87543;rport\r\nCall-ID: 795e41eab22e4147a365aa9ae385862f\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:50771>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3663666630353336610d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a35303737313b6272616e63683d7a39684734624b2d6438373534332d3033323031353933302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2037393565343165616232326534313437613336356161396165333835383632660d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a35303737313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"891fa442-741b-4e49-acce-ae5f3ff6bbef","seq":1,"duration_ms":192,"bytes_in":464,"bytes_out":15,"enriched":{"digest":"749c041c2acc9c69","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=6cff0536a","Via: SIP/2.0/TLS 199.195.254.198:50771;branch=z9hG4bK-d87543-032015930-1--d87543…","Call-ID: 795e41eab22e4147a365aa9ae385862f","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:50771>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-03T16:50:51","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=c8f9d1b63\r\nVia: SIP/2.0/TLS 199.195.254.198:57257;branch=z9hG4bK-d87543-538301131-1--d87543;rport\r\nCall-ID: 57f4b51692cf4296880c98a020596343\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:57257>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d6338663964316236330d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a35373235373b6272616e63683d7a39684734624b2d6438373534332d3533383330313133312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2035376634623531363932636634323936383830633938613032303539363334330d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a35373235373e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"4f0f8c67-81b2-4f18-ae4f-ab56d3d894b8","seq":1,"duration_ms":120,"bytes_in":461,"bytes_out":15,"enriched":{"digest":"d89538d8ac0d4e90","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=c8f9d1b63","Via: SIP/2.0/TLS 199.195.254.198:57257;branch=z9hG4bK-d87543-538301131-1--d87543…","Call-ID: 57f4b51692cf4296880c98a020596343","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:57257>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-03T16:20:06","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=8fcfbe45b\r\nVia: SIP/2.0/TLS 199.195.254.198:52288;branch=z9hG4bK-d87543-243715518-1--d87543;rport\r\nCall-ID: e8dfea7bdc64474b970e2a14f52202a3\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:52288>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3866636662653435620d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a35323238383b6272616e63683d7a39684734624b2d6438373534332d3234333731353531382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2065386466656137626463363434373462393730653261313466353232303261330d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a35323238383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"425f898e-5cb8-4828-8d16-c3225462ea5f","seq":1,"duration_ms":122,"bytes_in":461,"bytes_out":15,"enriched":{"digest":"5bbee79c0cdb4cff","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=8fcfbe45b","Via: SIP/2.0/TLS 199.195.254.198:52288;branch=z9hG4bK-d87543-243715518-1--d87543…","Call-ID: e8dfea7bdc64474b970e2a14f52202a3","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:52288>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-03T15:25:46","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=9d3555be1\r\nVia: SIP/2.0/TLS 199.195.254.198:62761;branch=z9hG4bK-d87543-732353341-1--d87543;rport\r\nCall-ID: 83d65b7e344943b7911836fd20f7c42d\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:62761>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3964333535356265310d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a36323736313b6272616e63683d7a39684734624b2d6438373534332d3733323335333334312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2038336436356237653334343934336237393131383336666432306637633432640d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a36323736313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"b1eddbb8-98ef-41e8-b3a3-3dcb45b0f384","seq":1,"duration_ms":185,"bytes_in":464,"bytes_out":15,"enriched":{"digest":"9664fcf0926ee6a6","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=9d3555be1","Via: SIP/2.0/TLS 199.195.254.198:62761;branch=z9hG4bK-d87543-732353341-1--d87543…","Call-ID: 83d65b7e344943b7911836fd20f7c42d","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:62761>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-03T11:50:18","port":5061,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=d74580e05\r\nVia: SIP/2.0/TLS 199.195.254.198:64961;branch=z9hG4bK-d87543-240149460-1--d87543;rport\r\nCall-ID: 9e49d7da9d1743888c11f5470ec9427b\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:64961>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Polycom450\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d6437343538306530350d0a5669613a205349502f322e302f544c53203139392e3139352e3235342e3139383a36343936313b6272616e63683d7a39684734624b2d6438373534332d3234303134393436302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039653439643764613964313734333838386331316635343730656339343237620d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a36343936313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a20506f6c79636f6d3435300d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"1f587d8031d98b69da197bc38f8ca923","session":"1b90012e-dded-44b2-a907-5fc5923aa6f9","seq":1,"duration_ms":196,"bytes_in":467,"bytes_out":15,"enriched":{"digest":"9a6adef24437e8a6","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=d74580e05","Via: SIP/2.0/TLS 199.195.254.198:64961;branch=z9hG4bK-d87543-240149460-1--d87543…","Call-ID: 9e49d7da9d1743888c11f5470ec9427b","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:64961>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-09-03T01:00:16","port":20331,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=176596c33\r\nVia: SIP/2.0/TCP 199.195.254.198:63054;branch=z9hG4bK-d87543-565255558-1--d87543;rport\r\nCall-ID: d9720a6a36af4565a1f2ecd059a310e6\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:63054>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3137363539366333330d0a5669613a205349502f322e302f544350203139392e3139352e3235342e3139383a36333035343b6272616e63683d7a39684734624b2d6438373534332d3536353235353535382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2064393732306136613336616634353635613166326563643035396133313065360d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a36333035343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d75630d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"ab3abcc4-4d55-4bc5-a369-3b24a6cc54eb","seq":1,"duration_ms":100,"bytes_in":459,"bytes_out":15,"enriched":{"digest":"59248c7359e20c21","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=176596c33","Via: SIP/2.0/TCP 199.195.254.198:63054;branch=z9hG4bK-d87543-565255558-1--d87543…","Call-ID: d9720a6a36af4565a1f2ecd059a310e6","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:63054>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-02T22:53:07","port":20331,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=fe935309d\r\nVia: SIP/2.0/TCP 199.195.254.198:62849;branch=z9hG4bK-d87543-307126587-1--d87543;rport\r\nCall-ID: 112dec3f987446d1ba299aaa1c9e35aa\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:62849>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d6665393335333039640d0a5669613a205349502f322e302f544350203139392e3139352e3235342e3139383a36323834393b6272616e63683d7a39684734624b2d6438373534332d3330373132363538372d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2031313264656333663938373434366431626132393961616131633965333561610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a36323834393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d75630d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"518ea4dd-1f22-471a-9e17-47169bba0c58","seq":1,"duration_ms":100,"bytes_in":462,"bytes_out":15,"enriched":{"digest":"c422b3ab49ad8f5d","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=fe935309d","Via: SIP/2.0/TCP 199.195.254.198:62849;branch=z9hG4bK-d87543-307126587-1--d87543…","Call-ID: 112dec3f987446d1ba299aaa1c9e35aa","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:62849>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-02T22:46:09","port":20331,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=646373be1\r\nVia: SIP/2.0/TCP 199.195.254.198:50196;branch=z9hG4bK-d87543-284193203-1--d87543;rport\r\nCall-ID: 8a4f9ca7d21a405a8d8f0aee1aadcaba\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@199.195.254.198:50196>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: bc-uc\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3634363337336265310d0a5669613a205349502f322e302f544350203139392e3139352e3235342e3139383a35303139363b6272616e63683d7a39684734624b2d6438373534332d3238343139333230332d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2038613466396361376432316134303561386438663061656531616164636162610d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a313030403139392e3139352e3235342e3139383a35303139363e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a2062632d75630d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"99ea9073-c476-4a29-94de-8783c0d6ce4f","seq":1,"duration_ms":100,"bytes_in":462,"bytes_out":15,"enriched":{"digest":"0c18c9c47af557dc","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=646373be1","Via: SIP/2.0/TCP 199.195.254.198:50196;branch=z9hG4bK-d87543-284193203-1--d87543…","Call-ID: 8a4f9ca7d21a405a8d8f0aee1aadcaba","CSeq: 1 REGISTER","Contact: <sip:100@199.195.254.198:50196>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["199.195.254.198"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":16,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-21T09:42:18.562467+00:00"}