Check an IP Address, Domain Name, Subnet, or ASN
194.26.192.102 has a very high threat confidence level of 91%, originating from Lelystad, The Netherlands, on the 1337 Services GmbH network (210558). It has been observed across 11,426 sessions targeting SIP, SMTP, First observed on January 30, 2026, most recently active March 2, 2026.
Represents an automated SIP INVITE request likely generated by a scanner or bot rather than a legitimate user agent. The behavior is inferred from a combination of a numeric-only SIP Call-ID format and a direct INVITE to a long numeric target without prior registration or dialog context. This pattern is commonly associated with SIP service probing, extension discovery, or early-stage toll-fraud reconnaissance. This behavior indicates reconnaissance activity against a SIP service but does not, by itself, confirm successful call setup or financial abuse.