Built for VoIP ops, trusted by enterprises_185.243.115.84
09:42:11
98Critical
- Geo
- RU
- Port
- 5060
- User-agent
- friendly-scanner
Built for VoIP ops, trusted by enterprises_
Automated VoIP & SIP
Threat Intelligence
Stop SIP toll fraud before it happens. Real-time blacklist feeds and on-demand PBX security audits for Kamailio, Asterisk, and 3CX — powered by a global honeypot network.
~/customer-feedback
$ sipradar deploy blacklist --env production✔ Validating Fail2Ban rulesThinking..
Live
~/models/threat-analysis$ sipradar lookup 185.243.115.84 --verbose> Processing input..▍> Model: threat-v3> Completed in 118ms
~/onboarding-sequence
$ sipradar scan pbx.example.com --full> Fetching SIP endpoints...> Classifying with honeypot graphThinking..
Integrates with your entire VoIP stack.
const next = await fetch("https://api.sipradar.net/v1/threats");
Faster deployment_
From honeypot signal to production block in one request
Effortlessly gather, score, and block SIP attackers without the usual complexity of homegrown scripts and stale IP lists.
Detect
Score
Block
Audit
🌐⏺
Platform_
Three layers of SIP defense.
SipRadar unifies passive threat collection, real-time blacklist distribution, and active vulnerability scanning.
Passive intelligence
Global honeypot network
A worldwide mesh of SIP honeypots silently records every scan, brute-force, and toll-fraud attempt.
Learn more →Drop-in integrationReal-time blacklist API
Stream our curated SIP IP blacklist directly into Fail2Ban, iptables, Kamailio, or Asterisk ACLs.
Learn more →On-demand auditActive vulnerability scanner
Point SipRadar at your PBX to surface exposed port 5060, weak passwords, and TLS misconfigurations.
Learn more →Precision scoringThreat score engine
Every IP is graded 0–100 by SIP-specific behavior with near-zero false positives on carrier peers.
Learn more →const next = await fetch("https://api.sipradar.net/v1/threats");
Honeypot lookup_
Check any IP against our global SIP honeypot database.
See instantly whether an address has been recorded probing SIP endpoints, brute-forcing extensions, or attempting toll fraud. The same signal powers our Threat Intelligence API.
- · Cross-referenced against 214 active honeypots
- · First-seen and last-seen timestamps
- · Attack pattern & suspected user-agent
Query/v1/ip/lookup
Seamless deployment_
From honeypots to hardened PBX fleets.
// Learn how SipRadar elevates your security posture //
Built to the standards your security team already audits.
SipRadar is architected for regulated environments, from independent MSPs to enterprise call centers. Independent auditors, transparent controls, and data residency you can point at.
- · Verified processes & compliance
- · Reliable long-term partnership
- · Data-driven decision support
- SOC 2 Type II
Operational controls, audited annually
Independent AICPA audit of our security, availability, and confidentiality controls. Report available under NDA.
- ISO/IEC 27001
Certified information security management
End-to-end ISMS covering the honeypot fleet, threat graph, and customer-facing APIs. Recertified every 12 months.
- GDPR
EU data protection by default
DPA on request, EU-hosted primary region, sub-processor registry, and full data-subject request tooling for your customers.
- HIPAA-ready
For healthcare call centers
BAAs available for Enterprise plans. No PHI ever transits SipRadar honeypots; SIP metadata is minimized at capture.
Live feed
Real-time SIP attack telemetry.
Streaming from our global honeypot network. The same feed powers our GET /v1/threats endpoint.
Streaming · live128,412 events · last 60 min
Live attacks
185.243.115.84 · RU · score 98
45.227.253.109
09:41:57
95Critical
- Geo
- PA
- Port
- 5060
- User-agent
- SIPVicious
193.32.162.44
09:41:33
91Critical
- Geo
- NL
- Port
- 5061
- User-agent
- sipcli/v1.8
141.98.10.63
09:40:58
87Critical
- Geo
- LT
- Port
- 5060
- User-agent
- VaxSIPUserAgent
89.248.165.201
09:40:22
84High
- Geo
- NL
- Port
- 5060
- User-agent
- sundayddr
212.70.149.71
09:39:47
79High
- Geo
- BG
- Port
- 5060
- User-agent
- SIPVicious
77.83.36.219
09:39:12
72High
- Geo
- RU
- Port
- 5060
- User-agent
- friendly-scanner
185.156.73.52
09:38:41
46Watch
- Geo
- RU
- Port
- 5062
- User-agent
- sipsak 0.9
Showing 1–8 of 20 filtered
1 / 3
PBX security audit
Audit your PBX in under 60 seconds.
SipRadar probes your public endpoint for exposed SIP ports, weak REGISTER credentials, verbose responses that leak extensions, and misconfigured TLS, then hands you a remediation checklist your team can ship today.
- Detects open UDP/TCP 5060 & 5061 exposure
- Enumerates weak or default extension passwords
- Flags dangerous Asterisk allowguest and 3CX defaults
- Exports remediation as Markdown, PDF, or Jira tickets
target pbx.acme-corp.example ports open 5060/udp 5060/tcp 5061/tcp sip banner Asterisk PBX 18.9.0 (exposed) weak exts 3 found 1001, 1050, 2001 allowguest yes (toll fraud risk) tls / srtp disabled blacklist 0 inbound from known bad IPs recommended rotate 3 extension secrets · disable allowguest · enable SIP-TLS on 5061 · subscribe to SipRadar blacklist feed
const next = await fetch("https://api.sipradar.net/v1/threats");
Automate tasks directly from your apps.
Trigger lookups, manage blacklists, and automate PBX audits with clean, predictable endpoints designed for VoIP operators and MSPs.
Get StartedAPI and Webhook
Request API KeyIntegration Guides
Browse Docsimport SipRadar from "@sipradar/sdk";
const client = new SipRadar({
apiKey: "YOUR_API_KEY",
});
const response = await client.lookup("185.243.115.84");
console.log(response.score);const next = await fetch("https://api.sipradar.net/v1/threats");
Trusted by VoIP operators, MSPs, and call-center teams worldwide.
NordvoxTelarioPBXWorksCallForgeSipHavenVoxMesh
“SipRadar cut brute-force REGISTER attempts on our carrier edge by 96% in the first week.”
“The honeypot feed catches attackers weeks before commercial IP reputation lists.”
“Their PBX audit found a misconfigured allowguest that would have cost us mid five figures.”
“We blocked 4127 malicious IPs in the first month. API integration took less than an hour.”
“SipRadar cut brute-force REGISTER attempts on our carrier edge by 96% in the first week.”
“The honeypot feed catches attackers weeks before commercial IP reputation lists.”
“Their PBX audit found a misconfigured allowguest that would have cost us mid five figures.”
“We blocked 4127 malicious IPs in the first month. API integration took less than an hour.”
“SipRadar cut brute-force REGISTER attempts on our carrier edge by 96% in the first week.”
“The honeypot feed catches attackers weeks before commercial IP reputation lists.”
“Their PBX audit found a misconfigured allowguest that would have cost us mid five figures.”
“We blocked 4127 malicious IPs in the first month. API integration took less than an hour.”
“SipRadar cut brute-force REGISTER attempts on our carrier edge by 96% in the first week.”
“The honeypot feed catches attackers weeks before commercial IP reputation lists.”
“Their PBX audit found a misconfigured allowguest that would have cost us mid five figures.”
“We blocked 4127 malicious IPs in the first month. API integration took less than an hour.”
const next = await fetch("https://api.sipradar.net/v1/threats");
Scalable plans_
Pay for real-time defense, not per-seat.
Start free with delayed threat intel. Upgrade when you need Fail2Ban and iptables scripts blocking attackers in real time.
Community
For developers and sysadmins exploring SipRadar. Enough to find your first vulnerabilities and check suspicious IPs from logs.
$0/Forever- 1 on-demand PBX scan per month
- 100 API lookup requests per month
- Threat feed with 48-hour delay
- Community support (Discord)
Single PBX
For small businesses, solo call centers, and local IT admins protecting one PBX edge.
$29/Monthly- 1 active PBX IP (continuous monitoring)
- Real-time Threat API for Fail2Ban & iptables
- Weekly automated PBX audit (Monday email)
- 7-day log retention
Active Defense
For MSPs and serious VoIP providers managing multiple customer PBX fleets from one account.
$89/Monthly- Up to 10 PBX IP addresses
- Unlimited on-demand PBX scans
- Webhook & Slack alerts on brute-force
- PDF audit reports (MSP-ready)
- 30-day log retention
Enterprise
For telecom operators and large-scale VoIP infrastructure. Custom capacity and carrier-grade feeds.
$249+/Monthly- Unlimited IPs and API requests
- White-label PDF reports
- BGP Blackhole / SIP-URI feeds
- SOC 2 report, private honeypots, SSO
- 99.95% uptime SLA · 24×7 on-call
const next = await fetch("https://api.sipradar.net/v1/threats");
Ready to ship faster_
Point SipRadar at your PBX. Get a remediation checklist in 60 seconds.
Free audit · no credit card · no agent to install. Works with Asterisk, Kamailio, FreeSWITCH, 3CX, OpenSIPS, and FreePBX.
Early access_
SipRadar Pro launches Q4 2026.
Reserve your seat and receive one month of complimentary Threat Intelligence API access at launch: unlimited lookups, the streaming feed, and priority honeypot signal.
FAQ
Questions we get from VoIP ops teams.
Straight answers on detection, integration, retention, and support. Missing something? Our team replies to security questions within one business day.
Ask a question →We operate 214 SIP honeypots across 38 countries. Each pretends to be a live PBX and silently records every REGISTER, INVITE, OPTIONS, and SUBSCRIBE probe. Attack patterns are graded 0–100 by our threat graph and streamed to the /v1/threats API within seconds.