185.243.115.84
09:42:11
98Critical
- Geo
- RU
- Port
- 5060
- User-agent
- friendly-scanner
Live dashboard
SIP threat intelligence feed
Full-fidelity honeypot telemetry from 214 global sensors. Filter, export, and wire the same stream into Fail2Ban, Kamailio, or your SOC via GET /v1/threats.
128,412 events · last 60 min
Events in buffer
20
Critical threats (≥85)
8
Top country
RU (5)
Avg threat score
75
High · 60–84
Threat score
Each IP is scored 0–100 from honeypot telemetry: attack type, frequency, user-agent reputation, ASN history, and correlation with known fraud campaigns.
Watch · 0–59
Unusual SIP probes or scans. Review logs before blocking.
Investigate
Elevated · 60–84
Strong attack signals: brute-force, scanning, or repeated hits across honeypots.
Consider blocking
Critical · 85–100
Known toll-fraud or brute-force infrastructure. Safe for automatic edge blocks.
Block recommended
Most operators auto-block at 60+ · investigate 40–59 manually
Attacks by country
Attacks by port
Event rate (by minute)
Event stream
Live attack log
Click any row or card for full event context. Export filtered results as CSV for your SIEM.
Live attacks
185.243.115.84 · RU · score 98
0–59 Watch60–84 High85–100 Critical
45.227.253.109
09:41:57
95Critical
- Geo
- PA
- Port
- 5060
- User-agent
- SIPVicious
193.32.162.44
09:41:33
91Critical
- Geo
- NL
- Port
- 5061
- User-agent
- sipcli/v1.8
141.98.10.63
09:40:58
87Critical
- Geo
- LT
- Port
- 5060
- User-agent
- VaxSIPUserAgent
89.248.165.201
09:40:22
84High
- Geo
- NL
- Port
- 5060
- User-agent
- sundayddr
212.70.149.71
09:39:47
79High
- Geo
- BG
- Port
- 5060
- User-agent
- SIPVicious
77.83.36.219
09:39:12
72High
- Geo
- RU
- Port
- 5060
- User-agent
- friendly-scanner
185.156.73.52
09:38:41
46Watch
- Geo
- RU
- Port
- 5062
- User-agent
- sipsak 0.9
103.145.13.9
09:38:15
88Critical
- Geo
- IN
- Port
- 5060
- User-agent
- SIPVicious
5.188.86.174
09:37:52
92Critical
- Geo
- RU
- Port
- 5060
- User-agent
- friendly-scanner
94.102.61.7
09:37:29
68High
- Geo
- NL
- Port
- 5061
- User-agent
- sipcli/v1.8
162.243.144.55
09:37:03
55Watch
- Geo
- US
- Port
- 5060
- User-agent
- VaxSIPUserAgent
159.203.31.148
09:36:41
41Watch
- Geo
- US
- Port
- 5062
- User-agent
- sipsak 0.9
45.148.10.180
09:36:18
96Critical
- Geo
- NL
- Port
- 5060
- User-agent
- SIPVicious
80.94.95.115
09:35:57
81High
- Geo
- BG
- Port
- 5060
- User-agent
- sundayddr
222.186.42.155
09:35:33
89Critical
- Geo
- CN
- Port
- 5060
- User-agent
- friendly-scanner
62.210.181.62
09:35:11
74High
- Geo
- FR
- Port
- 5061
- User-agent
- sipcli/v1.8
195.133.144.90
09:34:48
63High
- Geo
- RU
- Port
- 5060
- User-agent
- SIPVicious
185.213.155.169
09:34:22
58Watch
- Geo
- RO
- Port
- 5060
- User-agent
- VaxSIPUserAgent
203.113.11.72
09:33:58
39Watch
- Geo
- VN
- Port
- 5062
- User-agent
- sipsak 0.9
Showing 1–20 of 20 filtered
1 / 1
Developer
Stream into your stack
Pull the same feed programmatically. WebSocket streaming is available on Active Defense and Enterprise plans. Full API reference →
API integrationGET /v1/threats
Request
$ curl -H "Authorization: Bearer sk_live_..." \
"https://api.sipradar.net/v1/threats?limit=50&min_score=60"Response
{
"events": [
{
"ip": "185.243.115.84",
"port": 5060,
"country": "RU",
"user_agent": "SIPVicious",
"score": 98,
"pattern": "sip-register-bruteforce",
"ts": "2026-07-15T09:42:11Z"
}
],
"meta": { "buffer": 60, "streaming": true }
}Automate your defense
Block toll-fraud infrastructure before it hits your PBX.
Get an API key for real-time blacklist feeds, unlimited PBX audits, and webhook alerts.