Honeypot intelligence
SIP IP reputation lookup
Check any address against 214 active honeypots. See threat score, attack patterns, first/last seen, geo, and ASN. The same signal powers GET /v1/ip/{addr}.
45,312
Malicious IPs on file
214
Honeypots online
128,400
Lookups per day
Query
Check an IP address
Cross-referenced against our global honeypot mesh. Geo data via public providers.
Threat score
Each IP is scored 0–100 from honeypot telemetry: attack type, frequency, user-agent reputation, ASN history, and correlation with known fraud campaigns.
Watch · 0–59
Unusual SIP probes or scans. Review logs before blocking.
Investigate
Elevated · 60–84
Strong attack signals: brute-force, scanning, or repeated hits across honeypots.
Consider blocking
Critical · 85–100
Known toll-fraud or brute-force infrastructure. Safe for automatic edge blocks.
Block recommended
Most operators auto-block at 60+ · investigate 40–59 manually
Enter an IPv4 address to check against 214 global SIP honeypots.
Developer
Automate lookups via API
Real-time API access on Single PBX and above. Same reputation data, programmatic access.
Request
$ curl -H "Authorization: Bearer sk_live_..." \
https://api.sipradar.net/v1/ip/185.243.115.84Response
{
"ip": "185.243.115.84",
"malicious": true,
"score": 98,
"first_seen": "2026-05-02T11:14:07Z",
"last_seen": "2026-07-15T09:42:11Z",
"hits": 4127,
"pattern": "sip-register-bruteforce",
"asn": "AS49505",
"country": "RU"
}Scale your defense
Unlimited lookups on Active Defense and Enterprise.
Wire IP reputation into Fail2Ban, Kamailio, or your SOC with a single API key.