{"ip":"84.32.71.44","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,181 bytes sent","bytes_sent":1181,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-18T23:08:55","last_seen":"2026-09-19T03:08:13","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":204770,"org":"UAB Cherry Servers"},"source_domain":"ip-84-32-71-44.007.ptr.cherryservers.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as204770","label":"Cherry Servers US","category":"cdn","url":"https://www.peeringdb.com/asn/204770"},"cve_matches":[],"malware":[],"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":1}],"recent_events":[{"timestamp":"2026-09-19T03:08:13","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 84.32.71.44:18794;branch=z9hG4bKffd3a794dd114c66a69fadc99feefd7f;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"559180362\" <sip:559180362@84.32.71.44>;tag=493635144\r\nCall-ID: 97b2a721c925418d80686884389b25e9\r\nContact: <sip:559180362@84.32.71.44:18794>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>3a35303630205349502f322e300d0a5669613a205349502f322e302f5443502038342e33322e37312e34343a31383739343b6272616e63683d7a39684734624b66666433613739346464313134633636613639666164633939666565666437663b72706f72740d0a4d61782d466f7277617264733a2037300d0a546f3a203c7369703a<HONEYPOT>3a353036303e0d0a46726f6d3a202235353931383033363222203c7369703a3535393138303336324038342e33322e37312e34343e3b7461673d3439333633353134340d0a43616c6c2d49443a2039376232613732316339323534313864383036383638383433383962323565390d0a436f6e746163743a203c7369703a3535393138303336324038342e33322e37312e34343a31383739343e0d0a557365722d4167656e743a205a20352e362e342076322e31302e32302e340d0a435365713a2031204f5054494f4e530d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"2210afaf-19a8-417d-9b4f-f7aeb44e31f5","seq":1,"duration_ms":100,"bytes_in":395,"bytes_out":76,"enriched":{"digest":"993409e8bb4ccf1a","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT>:5060 SIP/2.0","Via: SIP/2.0/TCP 84.32.71.44:18794;branch=z9hG4bKffd3a794dd114c66a69fadc99feefd7…","Max-Forwards: 70","To: <sip:<HONEYPOT>:5060>","From: \"559180362\" <sip:559180362@84.32.71.44>;tag=493635144","Call-ID: 97b2a721c925418d80686884389b25e9","Contact: <sip:559180362@84.32.71.44:18794>","User-Agent: Z 5.6.4 v2.10.20.4","CSeq: 1 OPTIONS","Content-Length: 0"],"iocs":{"ips":["84.32.71.44","2.10.20.4"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-18T23:09:06","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 84.32.71.44:30198;branch=z9hG4bK876902d46ae74c978c90e1fb1f141968;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"340773916\" <sip:340773916@84.32.71.44>;tag=678269141\r\nCall-ID: d23a2002c49c4d1fb7a4859fb2d540fa\r\nContact: <sip:340773916@84.32.71.44:30198>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>3a35303630205349502f322e300d0a5669613a205349502f322e302f5443502038342e33322e37312e34343a33303139383b6272616e63683d7a39684734624b38373639303264343661653734633937386339306531666231663134313936383b72706f72740d0a4d61782d466f7277617264733a2037300d0a546f3a203c7369703a<HONEYPOT>3a353036303e0d0a46726f6d3a202233343037373339313622203c7369703a3334303737333931364038342e33322e37312e34343e3b7461673d3637383236393134310d0a43616c6c2d49443a2064323361323030326334396334643166623761343835396662326435343066610d0a436f6e746163743a203c7369703a3334303737333931364038342e33322e37312e34343a33303139383e0d0a557365722d4167656e743a205a20352e362e342076322e31302e32302e340d0a435365713a2031204f5054494f4e530d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"5f93aad1-2cab-4acb-8379-72c65ea0df0c","seq":1,"duration_ms":100,"bytes_in":393,"bytes_out":76,"enriched":{"digest":"789f4335e1c7c665","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT>:5060 SIP/2.0","Via: SIP/2.0/TCP 84.32.71.44:30198;branch=z9hG4bK876902d46ae74c978c90e1fb1f14196…","Max-Forwards: 70","To: <sip:<HONEYPOT>:5060>","From: \"340773916\" <sip:340773916@84.32.71.44>;tag=678269141","Call-ID: d23a2002c49c4d1fb7a4859fb2d540fa","Contact: <sip:340773916@84.32.71.44:30198>","User-Agent: Z 5.6.4 v2.10.20.4","CSeq: 1 OPTIONS","Content-Length: 0"],"iocs":{"ips":["84.32.71.44","2.10.20.4"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-18T23:08:55","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT>:5060 SIP/2.0\r\nVia: SIP/2.0/TCP 84.32.71.44:38449;branch=z9hG4bKbadf0e4105184008be34159422510877;rport\r\nMax-Forwards: 70\r\nTo: <sip:<HONEYPOT>:5060>\r\nFrom: \"792445418\" <sip:792445418@84.32.71.44>;tag=826896693\r\nCall-ID: 8c8595015c1445d1b7c84b5501e7719e\r\nContact: <sip:792445418@84.32.71.44:38449>\r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>3a35303630205349502f322e300d0a5669613a205349502f322e302f5443502038342e33322e37312e34343a33383434393b6272616e63683d7a39684734624b62616466306534313035313834303038626533343135393432323531303837373b72706f72740d0a4d61782d466f7277617264733a2037300d0a546f3a203c7369703a<HONEYPOT>3a353036303e0d0a46726f6d3a202237393234343534313822203c7369703a3739323434353431384038342e33322e37312e34343e3b7461673d3832363839363639330d0a43616c6c2d49443a2038633835393530313563313434356431623763383462353530316537373139650d0a436f6e746163743a203c7369703a3739323434353431384038342e33322e37312e34343a33383434393e0d0a557365722d4167656e743a205a20352e362e342076322e31302e32302e340d0a435365713a2031204f5054494f4e530d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"125cf91a-5a9c-4f28-b116-c799a3bd7b00","seq":1,"duration_ms":101,"bytes_in":393,"bytes_out":76,"enriched":{"digest":"028ede4f18965d4e","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT>:5060 SIP/2.0","Via: SIP/2.0/TCP 84.32.71.44:38449;branch=z9hG4bKbadf0e4105184008be3415942251087…","Max-Forwards: 70","To: <sip:<HONEYPOT>:5060>","From: \"792445418\" <sip:792445418@84.32.71.44>;tag=826896693","Call-ID: 8c8595015c1445d1b7c84b5501e7719e","Contact: <sip:792445418@84.32.71.44:38449>","User-Agent: Z 5.6.4 v2.10.20.4","CSeq: 1 OPTIONS","Content-Length: 0"],"iocs":{"ips":["84.32.71.44","2.10.20.4"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T17:43:06.186116+00:00"}