Check an IP Address, Domain Name, Subnet, or ASN
172.110.223.84 has a threat confidence score of 65%. This IP address from Hong Kong (AS23470, ReliableSite.Net LLC) has been observed in 80 honeypot sessions targeting SIP protocols. First observed on February 16, 2026, most recently active April 10, 2026.
SIP activity where the Call-ID follows a token@IP format, a pattern commonly generated by automated scanners and SIP tooling rather than standard client implementations, indicating non-human or enumeration-driven behavior.
Automated SIP INVITE requests initiating direct call setup toward a numeric extension, indicating scripted VoIP interaction rather than passive capability probing. The client attempts to establish a call session (e.g., extension-to-extension dialing such as 100 → 100) using high-entropy Call-ID values, a pattern frequently associated with automated dialers, toll-fraud reconnaissance, or PBX abuse tooling. These interactions validate whether the endpoint accepts call initiation and may precede brute-force registration attempts, relay abuse, or fraudulent outbound call campaigns.