{"ip":"86.104.190.123","total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"658 bytes sent","bytes_sent":658,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T22:44:50","last_seen":"2026-09-23T22:49:26","events_24h":0,"events_7d":2,"geo":{"country_code":"PS","country_name":"Palestine","region":"","city":"","lat":31.9225,"lon":35.1972,"asn":12975,"org":"Palestine Telecommunications Company (PALTEL)"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as12975","label":"Palestinian Telecommunications","category":"isp","url":"https://www.peeringdb.com/asn/12975"},"cve_matches":[],"malware":[],"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T22:49:26","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 10.0.0.37:60592;branch=z9hG4bK6aafd97f.29153.2548605;rport\r\nMax-Forwards: 70\r\nFrom: \"1000\" <sip:1000@10.0.0.37>;tag=31fc17d743\r\nTo: <sip:<HONEYPOT>>\r\nCall-ID: 4815e4fb65b02dd7@127.0.0.1\r\nCSeq: 1 OPTIONS\r\nAccept: application/sdp\r\nUser-Agent: PJSUA v2.12\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f5443502031302e302e302e33373a36303539323b6272616e63683d7a39684734624b36616166643937662e32393135332e323534383630353b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a20223130303022203c7369703a313030304031302e302e302e33373e3b7461673d333166633137643734330d0a546f3a203c7369703a<HONEYPOT>3e0d0a43616c6c2d49443a2034383135653466623635623032646437403132372e302e302e310d0a435365713a2031204f5054494f4e530d0a4163636570743a206170706c69636174696f6e2f7364700d0a557365722d4167656e743a20504a5355412076322e31320d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"888fb8fa-cfc9-4037-96e7-96c0e2d4f109","seq":1,"duration_ms":100,"bytes_in":328,"bytes_out":79,"enriched":{"digest":"1200d0d6562851e4","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 10.0.0.37:60592;branch=z9hG4bK6aafd97f.29153.2548605;rport","Max-Forwards: 70","From: \"1000\" <sip:1000@10.0.0.37>;tag=31fc17d743","To: <sip:<HONEYPOT>>","Call-ID: 4815e4fb65b02dd7@127.0.0.1","CSeq: 1 OPTIONS","Accept: application/sdp","User-Agent: PJSUA v2.12","Content-Length: 0"],"iocs":{"ips":["10.0.0.37","127.0.0.1"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-23T22:44:50","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 10.0.0.37:55944;branch=z9hG4bKdb74c7d8.29153.2262593;rport\r\nMax-Forwards: 70\r\nFrom: \"1000\" <sip:1000@10.0.0.37>;tag=bbf0ea3dc3\r\nTo: <sip:<HONEYPOT>>\r\nCall-ID: 4b9f358068403ba5@127.0.0.1\r\nCSeq: 1 OPTIONS\r\nAccept: application/sdp\r\nUser-Agent: PJSUA v2.12\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f5443502031302e302e302e33373a35353934343b6272616e63683d7a39684734624b64623734633764382e32393135332e323236323539333b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a20223130303022203c7369703a313030304031302e302e302e33373e3b7461673d626266306561336463330d0a546f3a203c7369703a<HONEYPOT>3e0d0a43616c6c2d49443a2034623966333538303638343033626135403132372e302e302e310d0a435365713a2031204f5054494f4e530d0a4163636570743a206170706c69636174696f6e2f7364700d0a557365722d4167656e743a20504a5355412076322e31320d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"17a9a721-c7e0-4476-aa71-e745501ed342","seq":1,"duration_ms":100,"bytes_in":330,"bytes_out":79,"enriched":{"digest":"1034973ddebf3890","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 10.0.0.37:55944;branch=z9hG4bKdb74c7d8.29153.2262593;rport","Max-Forwards: 70","From: \"1000\" <sip:1000@10.0.0.37>;tag=bbf0ea3dc3","To: <sip:<HONEYPOT>>","Call-ID: 4b9f358068403ba5@127.0.0.1","CSeq: 1 OPTIONS","Accept: application/sdp","User-Agent: PJSUA v2.12","Content-Length: 0"],"iocs":{"ips":["10.0.0.37","127.0.0.1"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T19:38:19.921602+00:00"}