{"ip":"160.119.76.152","data_as_of":"2026-10-25T13:01:49+00:00","observed":true,"total_events":3034,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"40+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 40 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,595,654 bytes sent","bytes_sent":1595654,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-24T13:35:04","last_seen":"2026-10-24T14:02:11","events_24h":3034,"events_7d":3034,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":"160-119-76-152.ptr.as49870.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":247,"protocols":[{"protocol":"udp","events":247}],"ports":[{"port":5060,"events":50},{"port":5098,"events":15},{"port":5086,"events":15},{"port":5097,"events":11},{"port":5091,"events":9},{"port":5087,"events":9},{"port":5081,"events":9},{"port":5095,"events":8},{"port":5088,"events":8},{"port":5074,"events":7}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-24T13:35:02","last_seen":"2026-10-24T14:02:13","recent":[{"timestamp":"2026-10-24T14:02:13","port":5095,"src_port":50904,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+9011442037691293@<HONEYPOT>:5095 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-e3357176ab76;rport\r\nMax-Forwards: 70\r\nFrom: <sip:19309507299@<HONEYPOT>:5095>;tag=2ba22f46\r\nTo: <sip:+9011442037691293@<HONEYPOT>:5095>\r\nCall-ID: 4e998f243bd44e188d8b16bd39485340\r\nCSeq: 1 INVITE\r\nContact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3930313134343230333736393132393340<HONEYPOT>3a35303935205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039353b6272616e63683d7a39684734624b2d6533333537313736616237363b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313933303935303732393940<HONEYPOT>3a353039353e3b7461673d32626132326634360d0a546f3a203c7369703a2b3930313134343230333736393132393340<HONEYPOT>3a353039353e0d0a43616c6c2d49443a2034653939386632343362643434653138386438623136626433393438353334300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313933303935303732393940<HONEYPOT>3a353039353b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"ee6cdf97-84af-475c-9de4-a870fc7938c3","bytes_in":527,"source_verified":false,"enriched":{"digest":"77df0e14d2e6c2e7","label":"SIP","strings":["INVITE sip:+9011442037691293@<HONEYPOT>:5095 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-e3357176ab76;rport","Max-Forwards: 70","From: <sip:19309507299@<HONEYPOT>:5095>;tag=2ba22f46","To: <sip:+9011442037691293@<HONEYPOT>:5095>","Call-ID: 4e998f243bd44e188d8b16bd39485340","CSeq: 1 INVITE","Contact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:13","port":5095,"src_port":50899,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+4592451291@<HONEYPOT>:5095 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-8898ff4a4c96;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+19309507299@<HONEYPOT>:5095>;tag=71d3a209\r\nTo: <sip:+4592451291@<HONEYPOT>:5095>\r\nCall-ID: 2d788033fb564b03bc0d77e05fdacad1\r\nCSeq: 1 INVITE\r\nContact: <sip:+19309507299@<HONEYPOT>:5095;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3435393234353132393140<HONEYPOT>3a35303935205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039353b6272616e63683d7a39684734624b2d3838393866663461346339363b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313933303935303732393940<HONEYPOT>3a353039353e3b7461673d37316433613230390d0a546f3a203c7369703a2b3435393234353132393140<HONEYPOT>3a353039353e0d0a43616c6c2d49443a2032643738383033336662353634623033626330643737653035666461636164310d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313933303935303732393940<HONEYPOT>3a353039353b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"5c27c713-5b83-4043-b202-23f87db5025e","bytes_in":523,"source_verified":false,"enriched":{"digest":"1bea4cbbd9572ef6","label":"SIP","strings":["INVITE sip:+4592451291@<HONEYPOT>:5095 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-8898ff4a4c96;rport","Max-Forwards: 70","From: <sip:+19309507299@<HONEYPOT>:5095>;tag=71d3a209","To: <sip:+4592451291@<HONEYPOT>:5095>","Call-ID: 2d788033fb564b03bc0d77e05fdacad1","CSeq: 1 INVITE","Contact: <sip:+19309507299@<HONEYPOT>:5095;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:13","port":5098,"src_port":50774,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:9011442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-477738e1b831;rport\r\nMax-Forwards: 70\r\nFrom: <sip:10874728482@<HONEYPOT>:5098>;tag=b72e9879\r\nTo: <sip:9011442037691293@<HONEYPOT>:5098>\r\nCall-ID: 8596e286df074ef3867d00d0576a45f5\r\nCSeq: 1 INVITE\r\nContact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d3437373733386531623833313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313038373437323834383240<HONEYPOT>3a353039383e3b7461673d62373265393837390d0a546f3a203c7369703a3930313134343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2038353936653238366466303734656633383637643030643035373661343566350d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"37701368-535b-4d42-bf71-33b5d346d836","bytes_in":536,"source_verified":false,"enriched":{"digest":"3afce5258cedb39d","label":"SIP","strings":["INVITE sip:9011442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-477738e1b831;rport","Max-Forwards: 70","From: <sip:10874728482@<HONEYPOT>:5098>;tag=b72e9879","To: <sip:9011442037691293@<HONEYPOT>:5098>","Call-ID: 8596e286df074ef3867d00d0576a45f5","CSeq: 1 INVITE","Contact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:13","port":5098,"src_port":50723,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-bb3de622ea64;rport\r\nMax-Forwards: 70\r\nFrom: <sip:10874728482@<HONEYPOT>:5098>;tag=b1552183\r\nTo: <sip:+442037691293@<HONEYPOT>:5098>\r\nCall-ID: ef31b75a5547485c9083636bd2c7e375\r\nCSeq: 1 INVITE\r\nContact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b34343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d6262336465363232656136343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313038373437323834383240<HONEYPOT>3a353039383e3b7461673d62313535323138330d0a546f3a203c7369703a2b34343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2065663331623735613535343734383563393038333633366264326337653337350d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"fbc4aaca-49b7-4226-848a-73fa484a9e21","bytes_in":525,"source_verified":false,"enriched":{"digest":"6de9d79508ff0569","label":"SIP","strings":["INVITE sip:+442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-bb3de622ea64;rport","Max-Forwards: 70","From: <sip:10874728482@<HONEYPOT>:5098>;tag=b1552183","To: <sip:+442037691293@<HONEYPOT>:5098>","Call-ID: ef31b75a5547485c9083636bd2c7e375","CSeq: 1 INVITE","Contact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63091,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:911442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-e18bd033ea8f;rport\r\nMax-Forwards: 70\r\nFrom: <sip:12745099726@<HONEYPOT>:5087>;tag=cfddadf5\r\nTo: <sip:911442037691293@<HONEYPOT>:5087>\r\nCall-ID: 1f7f0b51928c4647b312d2e6a221ba16\r\nCSeq: 1 INVITE\r\nContact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: SnomD785/10.1.64.0\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39313134343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d6531386264303333656138663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313237343530393937323640<HONEYPOT>3a353038373e3b7461673d63666464616466350d0a546f3a203c7369703a39313134343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2031663766306235313932386334363437623331326432653661323231626131360d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20536e6f6d443738352f31302e312e36342e300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"bbd07486-a6f5-4370-a190-4176b9bf6fa6","bytes_in":524,"source_verified":false,"enriched":{"digest":"dcba7e235c33ccbb","label":"SIP","strings":["INVITE sip:911442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-e18bd033ea8f;rport","Max-Forwards: 70","From: <sip:12745099726@<HONEYPOT>:5087>;tag=cfddadf5","To: <sip:911442037691293@<HONEYPOT>:5087>","Call-ID: 1f7f0b51928c4647b312d2e6a221ba16","CSeq: 1 INVITE","Contact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: SnomD785/10.1.64.0","Supported: replaces, timer, path"],"iocs":{"ips":["10.1.64.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63086,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+4592451291@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-392c23f9106c;rport\r\nMax-Forwards: 70\r\nFrom: <sip:12745099726@<HONEYPOT>:5087>;tag=2de94241\r\nTo: <sip:+4592451291@<HONEYPOT>:5087>\r\nCall-ID: f597ded5c21c42bf8b2fbb6f8c980ed7\r\nCSeq: 1 INVITE\r\nContact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3435393234353132393140<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d3339326332336639313036633b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313237343530393937323640<HONEYPOT>3a353038373e3b7461673d32646539343234310d0a546f3a203c7369703a2b3435393234353132393140<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2066353937646564356332316334326266386232666262366638633938306564370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"d5c7526c-c3f3-4b3e-90a6-f388c39b20ed","bytes_in":521,"source_verified":false,"enriched":{"digest":"421c1127a78d35f6","label":"SIP","strings":["INVITE sip:+4592451291@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-392c23f9106c;rport","Max-Forwards: 70","From: <sip:12745099726@<HONEYPOT>:5087>;tag=2de94241","To: <sip:+4592451291@<HONEYPOT>:5087>","Call-ID: f597ded5c21c42bf8b2fbb6f8c980ed7","CSeq: 1 INVITE","Contact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63080,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:004592451291@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-63db199ee377;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+12745099726@<HONEYPOT>:5087>;tag=2cb04cc7\r\nTo: <sip:004592451291@<HONEYPOT>:5087>\r\nCall-ID: e2039c3a23be437e95b4a015f56ad1f4\r\nCSeq: 1 INVITE\r\nContact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: SnomD785/10.1.64.0\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303435393234353132393140<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d3633646231393965653337373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373e3b7461673d32636230346363370d0a546f3a203c7369703a30303435393234353132393140<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2065323033396333613233626534333765393562346130313566353661643166340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20536e6f6d443738352f31302e312e36342e300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"6431f182-193f-45bd-b90f-98ae20316020","bytes_in":520,"source_verified":false,"enriched":{"digest":"80ad0d8aa5e41a79","label":"SIP","strings":["INVITE sip:004592451291@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-63db199ee377;rport","Max-Forwards: 70","From: <sip:+12745099726@<HONEYPOT>:5087>;tag=2cb04cc7","To: <sip:004592451291@<HONEYPOT>:5087>","Call-ID: e2039c3a23be437e95b4a015f56ad1f4","CSeq: 1 INVITE","Contact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: SnomD785/10.1.64.0","Supported: replaces, timer, path"],"iocs":{"ips":["10.1.64.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63077,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:001442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-8fbea5c20ffb;rport\r\nMax-Forwards: 70\r\nFrom: <sip:12745099726@<HONEYPOT>:5087>;tag=fef0d43e\r\nTo: <sip:001442037691293@<HONEYPOT>:5087>\r\nCall-ID: 96198c15358a442684680382ffef0658\r\nCSeq: 1 INVITE\r\nContact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: Grandstream GXP2130/1.0.11.10\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303134343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d3866626561356332306666623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313237343530393937323640<HONEYPOT>3a353038373e3b7461673d66656630643433650d0a546f3a203c7369703a30303134343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2039363139386331353335386134343236383436383033383266666566303635380d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a204772616e6473747265616d20475850323133302f312e302e31312e31300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"a0c89bbb-6a25-45be-83db-f763a2d25ecb","bytes_in":535,"source_verified":false,"enriched":{"digest":"73c3e3d13a5a86f8","label":"SIP","strings":["INVITE sip:001442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-8fbea5c20ffb;rport","Max-Forwards: 70","From: <sip:12745099726@<HONEYPOT>:5087>;tag=fef0d43e","To: <sip:001442037691293@<HONEYPOT>:5087>","Call-ID: 96198c15358a442684680382ffef0658","CSeq: 1 INVITE","Contact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: Grandstream GXP2130/1.0.11.10","Supported: replaces, timer, path"],"iocs":{"ips":["1.0.11.10"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63076,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:011442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-f7e10889f7e1;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+12745099726@<HONEYPOT>:5087>;tag=9ba585b1\r\nTo: <sip:011442037691293@<HONEYPOT>:5087>\r\nCall-ID: 11cc8aba9b4d4d68b4521b4c7417faf9\r\nCSeq: 1 INVITE\r\nContact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30313134343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d6637653130383839663765313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373e3b7461673d39626135383562310d0a546f3a203c7369703a30313134343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2031316363386162613962346434643638623435323162346337343137666166390d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"e0ecdd85-204b-4afb-89ca-3adc118148ec","bytes_in":531,"source_verified":false,"enriched":{"digest":"25a27b4c2ecc2df3","label":"SIP","strings":["INVITE sip:011442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-f7e10889f7e1;rport","Max-Forwards: 70","From: <sip:+12745099726@<HONEYPOT>:5087>;tag=9ba585b1","To: <sip:011442037691293@<HONEYPOT>:5087>","Call-ID: 11cc8aba9b4d4d68b4521b4c7417faf9","CSeq: 1 INVITE","Contact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:10","port":5087,"src_port":63058,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:9011442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-8d9d1ef33897;rport\r\nMax-Forwards: 70\r\nFrom: <sip:12745099726@<HONEYPOT>:5087>;tag=a414262c\r\nTo: <sip:9011442037691293@<HONEYPOT>:5087>\r\nCall-ID: 325dd49e9c6143b88a4a85ed465eb050\r\nCSeq: 1 INVITE\r\nContact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d3864396431656633333839373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313237343530393937323640<HONEYPOT>3a353038373e3b7461673d61343134323632630d0a546f3a203c7369703a3930313134343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2033323564643439653963363134336238386134613835656434363565623035300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"593bf19d-e7b5-459c-95d2-11e340e80378","bytes_in":525,"source_verified":false,"enriched":{"digest":"67a2203a24cddd4d","label":"SIP","strings":["INVITE sip:9011442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-8d9d1ef33897;rport","Max-Forwards: 70","From: <sip:12745099726@<HONEYPOT>:5087>;tag=a414262c","To: <sip:9011442037691293@<HONEYPOT>:5087>","Call-ID: 325dd49e9c6143b88a4a85ed465eb050","CSeq: 1 INVITE","Contact: <sip:12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:09","port":5087,"src_port":62883,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-d4354608aff1;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+12745099726@<HONEYPOT>:5087>;tag=ca268965\r\nTo: <sip:+442037691293@<HONEYPOT>:5087>\r\nCall-ID: a35d6fc7ea274206b3fef9272c597c5c\r\nCSeq: 1 INVITE\r\nContact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b34343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d6434333534363038616666313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373e3b7461673d63613236383936350d0a546f3a203c7369703a2b34343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2061333564366663376561323734323036623366656639323732633539376335630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"489a481c-9b06-4c99-b82d-15e80742778a","bytes_in":521,"source_verified":false,"enriched":{"digest":"f4e4bf966b9573c1","label":"SIP","strings":["INVITE sip:+442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-d4354608aff1;rport","Max-Forwards: 70","From: <sip:+12745099726@<HONEYPOT>:5087>;tag=ca268965","To: <sip:+442037691293@<HONEYPOT>:5087>","Call-ID: a35d6fc7ea274206b3fef9272c597c5c","CSeq: 1 INVITE","Contact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:09","port":5087,"src_port":62820,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:9011442037691293@<HONEYPOT>:5087 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-2d3b3307fbb8;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+12745099726@<HONEYPOT>:5087>;tag=fd3bd1b1\r\nTo: <sip:9011442037691293@<HONEYPOT>:5087>\r\nCall-ID: aa02f98a6340486ba5c77f767459d49a\r\nCSeq: 1 INVITE\r\nContact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333736393132393340<HONEYPOT>3a35303837205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353038373b6272616e63683d7a39684734624b2d3264336233333037666262383b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373e3b7461673d66643362643162310d0a546f3a203c7369703a3930313134343230333736393132393340<HONEYPOT>3a353038373e0d0a43616c6c2d49443a2061613032663938613633343034383662613563373766373637343539643439610d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313237343530393937323640<HONEYPOT>3a353038373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"38525832-467b-4b09-bdc7-07fb9abccd36","bytes_in":538,"source_verified":false,"enriched":{"digest":"bb6d89c0ec240ec6","label":"SIP","strings":["INVITE sip:9011442037691293@<HONEYPOT>:5087 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5087;branch=z9hG4bK-2d3b3307fbb8;rport","Max-Forwards: 70","From: <sip:+12745099726@<HONEYPOT>:5087>;tag=fd3bd1b1","To: <sip:9011442037691293@<HONEYPOT>:5087>","Call-ID: aa02f98a6340486ba5c77f767459d49a","CSeq: 1 INVITE","Contact: <sip:+12745099726@<HONEYPOT>:5087;transport=udp>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:09","port":5096,"src_port":62751,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+442037691293@<HONEYPOT>:5096 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5096;branch=z9hG4bK-feac740dd7e6;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+17000283010@<HONEYPOT>:5096>;tag=961a5fc1\r\nTo: <sip:+442037691293@<HONEYPOT>:5096>\r\nCall-ID: 8c3f9242b2544b678a8a0f977a41b037\r\nCSeq: 1 INVITE\r\nContact: <sip:+17000283010@<HONEYPOT>:5096;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b34343230333736393132393340<HONEYPOT>3a35303936205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039363b6272616e63683d7a39684734624b2d6665616337343064643765363b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313730303032383330313040<HONEYPOT>3a353039363e3b7461673d39363161356663310d0a546f3a203c7369703a2b34343230333736393132393340<HONEYPOT>3a353039363e0d0a43616c6c2d49443a2038633366393234326232353434623637386138613066393737613431623033370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313730303032383330313040<HONEYPOT>3a353039363b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"a32bcb23-6671-4802-bfaa-a3e3acaef577","bytes_in":527,"source_verified":false,"enriched":{"digest":"319a01ef859a7665","label":"SIP","strings":["INVITE sip:+442037691293@<HONEYPOT>:5096 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5096;branch=z9hG4bK-feac740dd7e6;rport","Max-Forwards: 70","From: <sip:+17000283010@<HONEYPOT>:5096>;tag=961a5fc1","To: <sip:+442037691293@<HONEYPOT>:5096>","Call-ID: 8c3f9242b2544b678a8a0f977a41b037","CSeq: 1 INVITE","Contact: <sip:+17000283010@<HONEYPOT>:5096;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:08","port":5097,"src_port":62736,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:011442037691293@<HONEYPOT>:5097 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5097;branch=z9hG4bK-d576c729257e;rport\r\nMax-Forwards: 70\r\nFrom: <sip:19084975936@<HONEYPOT>:5097>;tag=f8f87676\r\nTo: <sip:011442037691293@<HONEYPOT>:5097>\r\nCall-ID: 2881451c86f64f12a3e72d34f8a244be\r\nCSeq: 1 INVITE\r\nContact: <sip:19084975936@<HONEYPOT>:5097;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30313134343230333736393132393340<HONEYPOT>3a35303937205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039373b6272616e63683d7a39684734624b2d6435373663373239323537653b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313930383439373539333640<HONEYPOT>3a353039373e3b7461673d66386638373637360d0a546f3a203c7369703a30313134343230333736393132393340<HONEYPOT>3a353039373e0d0a43616c6c2d49443a2032383831343531633836663634663132613365373264333466386132343462650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313930383439373539333640<HONEYPOT>3a353039373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"9b19486c-bdd8-437b-a81a-5cb4f1bfae73","bytes_in":523,"source_verified":false,"enriched":{"digest":"49deea8ef1be5c7e","label":"SIP","strings":["INVITE sip:011442037691293@<HONEYPOT>:5097 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5097;branch=z9hG4bK-d576c729257e;rport","Max-Forwards: 70","From: <sip:19084975936@<HONEYPOT>:5097>;tag=f8f87676","To: <sip:011442037691293@<HONEYPOT>:5097>","Call-ID: 2881451c86f64f12a3e72d34f8a244be","CSeq: 1 INVITE","Contact: <sip:19084975936@<HONEYPOT>:5097;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:08","port":5095,"src_port":62725,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:911442037691293@<HONEYPOT>:5095 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-d5eb2804ab87;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+19309507299@<HONEYPOT>:5095>;tag=57034812\r\nTo: <sip:911442037691293@<HONEYPOT>:5095>\r\nCall-ID: bd7c53e2fd2543c78561d995604e9844\r\nCSeq: 1 INVITE\r\nContact: <sip:+19309507299@<HONEYPOT>:5095;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39313134343230333736393132393340<HONEYPOT>3a35303935205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039353b6272616e63683d7a39684734624b2d6435656232383034616238373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313933303935303732393940<HONEYPOT>3a353039353e3b7461673d35373033343831320d0a546f3a203c7369703a39313134343230333736393132393340<HONEYPOT>3a353039353e0d0a43616c6c2d49443a2062643763353365326664323534336337383536316439393536303465393834340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313933303935303732393940<HONEYPOT>3a353039353b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"fc316028-b482-4179-9ed7-7e818b141d5f","bytes_in":525,"source_verified":false,"enriched":{"digest":"5bcbc3d175643a38","label":"SIP","strings":["INVITE sip:911442037691293@<HONEYPOT>:5095 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-d5eb2804ab87;rport","Max-Forwards: 70","From: <sip:+19309507299@<HONEYPOT>:5095>;tag=57034812","To: <sip:911442037691293@<HONEYPOT>:5095>","Call-ID: bd7c53e2fd2543c78561d995604e9844","CSeq: 1 INVITE","Contact: <sip:+19309507299@<HONEYPOT>:5095;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:08","port":5095,"src_port":62682,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:001442037691293@<HONEYPOT>:5095 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-5d44afc6a983;rport\r\nMax-Forwards: 70\r\nFrom: <sip:19309507299@<HONEYPOT>:5095>;tag=ef247e03\r\nTo: <sip:001442037691293@<HONEYPOT>:5095>\r\nCall-ID: 0ab52fbc90294ac0859b2ab960a35a4a\r\nCSeq: 1 INVITE\r\nContact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>\r\nUser-Agent: Grandstream GXP2130/1.0.11.10\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303134343230333736393132393340<HONEYPOT>3a35303935205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039353b6272616e63683d7a39684734624b2d3564343461666336613938333b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313933303935303732393940<HONEYPOT>3a353039353e3b7461673d65663234376530330d0a546f3a203c7369703a30303134343230333736393132393340<HONEYPOT>3a353039353e0d0a43616c6c2d49443a2030616235326662633930323934616330383539623261623936306133356134610d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313933303935303732393940<HONEYPOT>3a353039353b7472616e73706f72743d7564703e0d0a557365722d4167656e743a204772616e6473747265616d20475850323133302f312e302e31312e31300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"49dd29b7-2257-4783-b6eb-d2a4eb8dcf0c","bytes_in":535,"source_verified":false,"enriched":{"digest":"c7981576ffbaf735","label":"SIP","strings":["INVITE sip:001442037691293@<HONEYPOT>:5095 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-5d44afc6a983;rport","Max-Forwards: 70","From: <sip:19309507299@<HONEYPOT>:5095>;tag=ef247e03","To: <sip:001442037691293@<HONEYPOT>:5095>","Call-ID: 0ab52fbc90294ac0859b2ab960a35a4a","CSeq: 1 INVITE","Contact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>","User-Agent: Grandstream GXP2130/1.0.11.10","Supported: replaces, timer, path"],"iocs":{"ips":["1.0.11.10"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:08","port":5098,"src_port":62609,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:00442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-76ccd08040b5;rport\r\nMax-Forwards: 70\r\nFrom: <sip:10874728482@<HONEYPOT>:5098>;tag=f1fe7744\r\nTo: <sip:00442037691293@<HONEYPOT>:5098>\r\nCall-ID: 6b2b2b3e6051414dbcc67b0d306b3f55\r\nCSeq: 1 INVITE\r\nContact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a303034343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d3736636364303830343062353b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313038373437323834383240<HONEYPOT>3a353039383e3b7461673d66316665373734340d0a546f3a203c7369703a303034343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2036623262326233653630353134313464626363363762306433303662336635350d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"76d63ff6-7f46-4a6d-b0f1-75be3b9473f2","bytes_in":532,"source_verified":false,"enriched":{"digest":"b3cb6abbbb3511f7","label":"SIP","strings":["INVITE sip:00442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-76ccd08040b5;rport","Max-Forwards: 70","From: <sip:10874728482@<HONEYPOT>:5098>;tag=f1fe7744","To: <sip:00442037691293@<HONEYPOT>:5098>","Call-ID: 6b2b2b3e6051414dbcc67b0d306b3f55","CSeq: 1 INVITE","Contact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:08","port":5098,"src_port":62610,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:900442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-68e38da323c7;rport\r\nMax-Forwards: 70\r\nFrom: <sip:10874728482@<HONEYPOT>:5098>;tag=b6b3acca\r\nTo: <sip:900442037691293@<HONEYPOT>:5098>\r\nCall-ID: 71e7ab4b0a79487f919bd0f8fee609c2\r\nCSeq: 1 INVITE\r\nContact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39303034343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d3638653338646133323363373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313038373437323834383240<HONEYPOT>3a353039383e3b7461673d62366233616363610d0a546f3a203c7369703a39303034343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2037316537616234623061373934383766393139626430663866656536303963320d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"dd26e8ed-0043-4866-9972-8ef2fd4e75e7","bytes_in":534,"source_verified":false,"enriched":{"digest":"ff514a7e0c59a3fa","label":"SIP","strings":["INVITE sip:900442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-68e38da323c7;rport","Max-Forwards: 70","From: <sip:10874728482@<HONEYPOT>:5098>;tag=b6b3acca","To: <sip:900442037691293@<HONEYPOT>:5098>","Call-ID: 71e7ab4b0a79487f919bd0f8fee609c2","CSeq: 1 INVITE","Contact: <sip:10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:07","port":5099,"src_port":62559,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+9011442037691293@<HONEYPOT>:5099 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5099;branch=z9hG4bK-22e77ee47b36;rport\r\nMax-Forwards: 70\r\nFrom: <sip:19986426541@<HONEYPOT>:5099>;tag=f15447a8\r\nTo: <sip:+9011442037691293@<HONEYPOT>:5099>\r\nCall-ID: a5f9837ab3824d4fa1d45300fc500c3a\r\nCSeq: 1 INVITE\r\nContact: <sip:19986426541@<HONEYPOT>:5099;transport=udp>\r\nUser-Agent: Grandstream GXP2130/1.0.11.10\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3930313134343230333736393132393340<HONEYPOT>3a35303939205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039393b6272616e63683d7a39684734624b2d3232653737656534376233363b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313939383634323635343140<HONEYPOT>3a353039393e3b7461673d66313534343761380d0a546f3a203c7369703a2b3930313134343230333736393132393340<HONEYPOT>3a353039393e0d0a43616c6c2d49443a2061356639383337616233383234643466613164343533303066633530306333610d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313939383634323635343140<HONEYPOT>3a353039393b7472616e73706f72743d7564703e0d0a557365722d4167656e743a204772616e6473747265616d20475850323133302f312e302e31312e31300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"028e26fc-8af4-459d-82b1-1443eafd3035","bytes_in":539,"source_verified":false,"enriched":{"digest":"904b0f9c9cef71ef","label":"SIP","strings":["INVITE sip:+9011442037691293@<HONEYPOT>:5099 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5099;branch=z9hG4bK-22e77ee47b36;rport","Max-Forwards: 70","From: <sip:19986426541@<HONEYPOT>:5099>;tag=f15447a8","To: <sip:+9011442037691293@<HONEYPOT>:5099>","Call-ID: a5f9837ab3824d4fa1d45300fc500c3a","CSeq: 1 INVITE","Contact: <sip:19986426541@<HONEYPOT>:5099;transport=udp>","User-Agent: Grandstream GXP2130/1.0.11.10","Supported: replaces, timer, path"],"iocs":{"ips":["1.0.11.10"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:07","port":5098,"src_port":62545,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:00442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-c0a10685122a;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+10874728482@<HONEYPOT>:5098>;tag=e9c59026\r\nTo: <sip:00442037691293@<HONEYPOT>:5098>\r\nCall-ID: 56fba6b64f8345e2a305e8171dfbd596\r\nCSeq: 1 INVITE\r\nContact: <sip:+10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: SnomD785/10.1.64.0\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a303034343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d6330613130363835313232613b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313038373437323834383240<HONEYPOT>3a353039383e3b7461673d65396335393032360d0a546f3a203c7369703a303034343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2035366662613662363466383334356532613330356538313731646662643539360d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20536e6f6d443738352f31302e312e36342e300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"14b6f7bb-2f92-4a6a-a0b6-15c34003029d","bytes_in":524,"source_verified":false,"enriched":{"digest":"457fc658d4e35b8c","label":"SIP","strings":["INVITE sip:00442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-c0a10685122a;rport","Max-Forwards: 70","From: <sip:+10874728482@<HONEYPOT>:5098>;tag=e9c59026","To: <sip:00442037691293@<HONEYPOT>:5098>","Call-ID: 56fba6b64f8345e2a305e8171dfbd596","CSeq: 1 INVITE","Contact: <sip:+10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: SnomD785/10.1.64.0","Supported: replaces, timer, path"],"iocs":{"ips":["10.1.64.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:07","port":5098,"src_port":62542,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+442037691293@<HONEYPOT>:5098 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-1e7aa0196fd1;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+10874728482@<HONEYPOT>:5098>;tag=93966194\r\nTo: <sip:+442037691293@<HONEYPOT>:5098>\r\nCall-ID: feb05981299b464287f547523751c15c\r\nCSeq: 1 INVITE\r\nContact: <sip:+10874728482@<HONEYPOT>:5098;transport=udp>\r\nUser-Agent: Grandstream GXP2130/1.0.11.10\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b34343230333736393132393340<HONEYPOT>3a35303938205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039383b6272616e63683d7a39684734624b2d3165376161303139366664313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313038373437323834383240<HONEYPOT>3a353039383e3b7461673d39333936363139340d0a546f3a203c7369703a2b34343230333736393132393340<HONEYPOT>3a353039383e0d0a43616c6c2d49443a2066656230353938313239396234363432383766353437353233373531633135630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313038373437323834383240<HONEYPOT>3a353039383b7472616e73706f72743d7564703e0d0a557365722d4167656e743a204772616e6473747265616d20475850323133302f312e302e31312e31300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"59f0d6e1-39b5-4ec4-8fa3-66aaf3ed51d4","bytes_in":533,"source_verified":false,"enriched":{"digest":"3e356a31c9c90688","label":"SIP","strings":["INVITE sip:+442037691293@<HONEYPOT>:5098 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5098;branch=z9hG4bK-1e7aa0196fd1;rport","Max-Forwards: 70","From: <sip:+10874728482@<HONEYPOT>:5098>;tag=93966194","To: <sip:+442037691293@<HONEYPOT>:5098>","Call-ID: feb05981299b464287f547523751c15c","CSeq: 1 INVITE","Contact: <sip:+10874728482@<HONEYPOT>:5098;transport=udp>","User-Agent: Grandstream GXP2130/1.0.11.10","Supported: replaces, timer, path"],"iocs":{"ips":["1.0.11.10"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:07","port":5097,"src_port":62540,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:004592451291@<HONEYPOT>:5097 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5097;branch=z9hG4bK-78adbf955452;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+19084975936@<HONEYPOT>:5097>;tag=3a916442\r\nTo: <sip:004592451291@<HONEYPOT>:5097>\r\nCall-ID: fb6933e29ea545458226bce7147d654a\r\nCSeq: 1 INVITE\r\nContact: <sip:+19084975936@<HONEYPOT>:5097;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303435393234353132393140<HONEYPOT>3a35303937205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039373b6272616e63683d7a39684734624b2d3738616462663935353435323b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313930383439373539333640<HONEYPOT>3a353039373e3b7461673d33613931363434320d0a546f3a203c7369703a30303435393234353132393140<HONEYPOT>3a353039373e0d0a43616c6c2d49443a2066623639333365323965613534353435383232366263653731343764363534610d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313930383439373539333640<HONEYPOT>3a353039373b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"49061df3-e280-4060-acd5-e01f3b354a90","bytes_in":519,"source_verified":false,"enriched":{"digest":"718225ffd93e5acf","label":"SIP","strings":["INVITE sip:004592451291@<HONEYPOT>:5097 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5097;branch=z9hG4bK-78adbf955452;rport","Max-Forwards: 70","From: <sip:+19084975936@<HONEYPOT>:5097>;tag=3a916442","To: <sip:004592451291@<HONEYPOT>:5097>","Call-ID: fb6933e29ea545458226bce7147d654a","CSeq: 1 INVITE","Contact: <sip:+19084975936@<HONEYPOT>:5097;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:07","port":5095,"src_port":62465,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:900442037691293@<HONEYPOT>:5095 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-c322513ceccb;rport\r\nMax-Forwards: 70\r\nFrom: <sip:19309507299@<HONEYPOT>:5095>;tag=8228d5bc\r\nTo: <sip:900442037691293@<HONEYPOT>:5095>\r\nCall-ID: baafad7a4c8c4d528fbc03aed3f00f1c\r\nCSeq: 1 INVITE\r\nContact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39303034343230333736393132393340<HONEYPOT>3a35303935205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039353b6272616e63683d7a39684734624b2d6333323235313363656363623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313933303935303732393940<HONEYPOT>3a353039353e3b7461673d38323238643562630d0a546f3a203c7369703a39303034343230333736393132393340<HONEYPOT>3a353039353e0d0a43616c6c2d49443a2062616166616437613463386334643532386662633033616564336630306631630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313933303935303732393940<HONEYPOT>3a353039353b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"f6cdbf55-b94c-4603-a295-365b5cb89c6f","bytes_in":523,"source_verified":false,"enriched":{"digest":"3c9afb52757b05de","label":"SIP","strings":["INVITE sip:900442037691293@<HONEYPOT>:5095 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5095;branch=z9hG4bK-c322513ceccb;rport","Max-Forwards: 70","From: <sip:19309507299@<HONEYPOT>:5095>;tag=8228d5bc","To: <sip:900442037691293@<HONEYPOT>:5095>","Call-ID: baafad7a4c8c4d528fbc03aed3f00f1c","CSeq: 1 INVITE","Contact: <sip:19309507299@<HONEYPOT>:5095;transport=udp>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:06","port":5093,"src_port":62451,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+9011442037691293@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5093;branch=z9hG4bK-893cf8aad7f1;rport\r\nMax-Forwards: 70\r\nFrom: <sip:16361553003@<HONEYPOT>:5093>;tag=2bcd96ca\r\nTo: <sip:+9011442037691293@<HONEYPOT>:5093>\r\nCall-ID: c0056dc9eb4646f29d905cd4dff6a19e\r\nCSeq: 1 INVITE\r\nContact: <sip:16361553003@<HONEYPOT>:5093;transport=udp>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3930313134343230333736393132393340<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d3839336366386161643766313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313633363135353330303340<HONEYPOT>3a353039333e3b7461673d32626364393663610d0a546f3a203c7369703a2b3930313134343230333736393132393340<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2063303035366463396562343634366632396439303563643464666636613139650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d7564703e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"069511c5-bcb3-4563-9ec1-be9bfa35f342","bytes_in":538,"source_verified":false,"enriched":{"digest":"cfa3de6b020b9ac3","label":"SIP","strings":["INVITE sip:+9011442037691293@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5093;branch=z9hG4bK-893cf8aad7f1;rport","Max-Forwards: 70","From: <sip:16361553003@<HONEYPOT>:5093>;tag=2bcd96ca","To: <sip:+9011442037691293@<HONEYPOT>:5093>","Call-ID: c0056dc9eb4646f29d905cd4dff6a19e","CSeq: 1 INVITE","Contact: <sip:16361553003@<HONEYPOT>:5093;transport=udp>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-24T14:02:06","port":5093,"src_port":62443,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:00442037691293@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/UDP <HONEYPOT>:5093;branch=z9hG4bK-a701a143dbd4;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+16361553003@<HONEYPOT>:5093>;tag=a16f5820\r\nTo: <sip:00442037691293@<HONEYPOT>:5093>\r\nCall-ID: a6628dd4d91f4e3982d14ffb0b515042\r\nCSeq: 1 INVITE\r\nContact: <sip:+16361553003@<HONEYPOT>:5093;transport=udp>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a303034343230333736393132393340<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f55445020<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d6137303161313433646264343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333e3b7461673d61313666353832300d0a546f3a203c7369703a303034343230333736393132393340<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2061363632386464346439316634653339383264313466666230623531353034320d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d7564703e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","sni":"","session":"6f4e4d7d-fcbb-4b0b-be4d-a2fdefa6c458","bytes_in":529,"source_verified":false,"enriched":{"digest":"2b452a937645885a","label":"SIP","strings":["INVITE sip:00442037691293@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/UDP <HONEYPOT>:5093;branch=z9hG4bK-a701a143dbd4;rport","Max-Forwards: 70","From: <sip:+16361553003@<HONEYPOT>:5093>;tag=a16f5820","To: <sip:00442037691293@<HONEYPOT>:5093>","Call-ID: a6628dd4d91f4e3982d14ffb0b515042","CSeq: 1 INVITE","Contact: <sip:+16361553003@<HONEYPOT>:5093;transport=udp>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/UDP"]}}}]},"interaction":null,"top_ports":[{"port":5076,"proto":"tcp","label":"","count":80},{"port":5077,"proto":"tcp","label":"","count":80},{"port":5079,"proto":"tcp","label":"","count":80},{"port":5091,"proto":"tcp","label":"","count":80},{"port":5085,"proto":"tcp","label":"","count":80},{"port":5087,"proto":"tcp","label":"","count":80},{"port":5080,"proto":"tcp","label":"","count":80},{"port":5082,"proto":"tcp","label":"","count":80},{"port":5060,"proto":"tcp","label":"SIP","count":80},{"port":5062,"proto":"tcp","label":"","count":80},{"port":5068,"proto":"tcp","label":"","count":80},{"port":5065,"proto":"tcp","label":"","count":80},{"port":5064,"proto":"tcp","label":"","count":80},{"port":5063,"proto":"tcp","label":"","count":80},{"port":5061,"proto":"tcp","label":"SIPS","count":80}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d751100_479067518aa3_24695f2957a7"],"tls_client_hello":"1603010200010001fc03032dbab6bacb137cf974df39f683415cde0bf99225222f45741b2c415550654ddc20862efa55a67dc8dbdb6e9e1952146e54fc0d193a71a7096c176fb5594269e7200096130213031301c02bc02fc02cc030009e009fc027c02800a3cca9cca8ccaac0afc0adc0a3c09fc05dc061c057c05300a2c0aec0acc0a2c09ec05cc060c056c052c024006b006ac073c07700c400c3c02300670040c072c07600be00bdc00ac0140039003800880087c009c0130033003200450044009dc0a1c09dc051009cc0a0c09cc050003d00c0003c00ba00350084002f004100ff0100011d0000001700150000123139322e332e3131382e3134363a35303933000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602002b00050403040303002d00020101003300260024001d00205582ad5726222f9d99da07e80f9d16f55334afe6f9624ca42a1b242b01729b3b00150063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["128ef52818391816ed9b3ece21686a6f"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d751100_479067518aa3_24695f2957a7":1},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-24","count":3034}],"recent_events":[{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:004592451291@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-07617404d86b;rport\r\nMax-Forwards: 70\r\nFrom: <sip:16361553003@<HONEYPOT>:5093>;tag=ed77d19e\r\nTo: <sip:004592451291@<HONEYPOT>:5093>\r\nCall-ID: 74359b8dbdcf4e17a98cc9586f37f681\r\nCSeq: 1 INVITE\r\nContact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: SnomD785/10.1.64.0\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303435393234353132393140<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d3037363137343034643836623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313633363135353330303340<HONEYPOT>3a353039333e3b7461673d65643737643139650d0a546f3a203c7369703a30303435393234353132393140<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2037343335396238646264636634653137613938636339353836663337663638310d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a20536e6f6d443738352f31302e312e36342e300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"a5180b52-1a48-440d-b1c9-a2e3c201e023","seq":1,"duration_ms":195,"bytes_in":518,"bytes_out":14,"enriched":{"digest":"26ed130bf03e11a2","label":"SIP","strings":["INVITE sip:004592451291@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-07617404d86b;rport","Max-Forwards: 70","From: <sip:16361553003@<HONEYPOT>:5093>;tag=ed77d19e","To: <sip:004592451291@<HONEYPOT>:5093>","Call-ID: 74359b8dbdcf4e17a98cc9586f37f681","CSeq: 1 INVITE","Contact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: SnomD785/10.1.64.0","Supported: replaces, timer, path"],"iocs":{"ips":["10.1.64.0"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:+4592451291@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-1b0e30647c54;rport\r\nMax-Forwards: 70\r\nFrom: <sip:16361553003@<HONEYPOT>:5093>;tag=e3dc74e5\r\nTo: <sip:+4592451291@<HONEYPOT>:5093>\r\nCall-ID: 6d93389f0e624db996d208ae6a9ec555\r\nCSeq: 1 INVITE\r\nContact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3435393234353132393140<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d3162306533303634376335343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313633363135353330303340<HONEYPOT>3a353039333e3b7461673d65336463373465350d0a546f3a203c7369703a2b3435393234353132393140<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2036643933333839663065363234646239393664323038616536613965633535350d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"7c0da9a8-81eb-45d4-a889-b6c835aa80e1","seq":1,"duration_ms":194,"bytes_in":526,"bytes_out":14,"enriched":{"digest":"f7c7114860daa497","label":"SIP","strings":["INVITE sip:+4592451291@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-1b0e30647c54;rport","Max-Forwards: 70","From: <sip:16361553003@<HONEYPOT>:5093>;tag=e3dc74e5","To: <sip:+4592451291@<HONEYPOT>:5093>","Call-ID: 6d93389f0e624db996d208ae6a9ec555","CSeq: 1 INVITE","Contact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5092,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5092","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:004592451291@<HONEYPOT>:5092 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5092;branch=z9hG4bK-7f9f1c565e87;rport\r\nMax-Forwards: 70\r\nFrom: <sip:14271862253@<HONEYPOT>:5092>;tag=50f1781d\r\nTo: <sip:004592451291@<HONEYPOT>:5092>\r\nCall-ID: 2a0ec35cade843f7a711e0978866e56e\r\nCSeq: 1 INVITE\r\nContact: <sip:14271862253@<HONEYPOT>:5092;transport=tls>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303435393234353132393140<HONEYPOT>3a35303932205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039323b6272616e63683d7a39684734624b2d3766396631633536356538373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313432373138363232353340<HONEYPOT>3a353039323e3b7461673d35306631373831640d0a546f3a203c7369703a30303435393234353132393140<HONEYPOT>3a353039323e0d0a43616c6c2d49443a2032613065633335636164653834336637613731316530393738383636653536650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313432373138363232353340<HONEYPOT>3a353039323b7472616e73706f72743d746c733e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"321ef327-dbc6-448f-930a-cd80a4524011","seq":1,"duration_ms":195,"bytes_in":528,"bytes_out":14,"enriched":{"digest":"fb3b8e9fb33c712d","label":"SIP","strings":["INVITE sip:004592451291@<HONEYPOT>:5092 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5092;branch=z9hG4bK-7f9f1c565e87;rport","Max-Forwards: 70","From: <sip:14271862253@<HONEYPOT>:5092>;tag=50f1781d","To: <sip:004592451291@<HONEYPOT>:5092>","Call-ID: 2a0ec35cade843f7a711e0978866e56e","CSeq: 1 INVITE","Contact: <sip:14271862253@<HONEYPOT>:5092;transport=tls>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5092,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5092","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:004592451291@<HONEYPOT>:5092 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5092;branch=z9hG4bK-2bcd8b8023fb;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+14271862253@<HONEYPOT>:5092>;tag=1708d15f\r\nTo: <sip:004592451291@<HONEYPOT>:5092>\r\nCall-ID: 087fe48798664948b7da782dbd5e8094\r\nCSeq: 1 INVITE\r\nContact: <sip:+14271862253@<HONEYPOT>:5092;transport=tls>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303435393234353132393140<HONEYPOT>3a35303932205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039323b6272616e63683d7a39684734624b2d3262636438623830323366623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313432373138363232353340<HONEYPOT>3a353039323e3b7461673d31373038643135660d0a546f3a203c7369703a30303435393234353132393140<HONEYPOT>3a353039323e0d0a43616c6c2d49443a2030383766653438373938363634393438623764613738326462643565383039340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313432373138363232353340<HONEYPOT>3a353039323b7472616e73706f72743d746c733e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"d72247a5-87b3-4603-9c6f-a10c02b50eb2","seq":1,"duration_ms":194,"bytes_in":530,"bytes_out":14,"enriched":{"digest":"9f91352e3483495a","label":"SIP","strings":["INVITE sip:004592451291@<HONEYPOT>:5092 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5092;branch=z9hG4bK-2bcd8b8023fb;rport","Max-Forwards: 70","From: <sip:+14271862253@<HONEYPOT>:5092>;tag=1708d15f","To: <sip:004592451291@<HONEYPOT>:5092>","Call-ID: 087fe48798664948b7da782dbd5e8094","CSeq: 1 INVITE","Contact: <sip:+14271862253@<HONEYPOT>:5092;transport=tls>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:+442037691293@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-0cc758e8dbc8;rport\r\nMax-Forwards: 70\r\nFrom: <sip:16361553003@<HONEYPOT>:5093>;tag=88ae926f\r\nTo: <sip:+442037691293@<HONEYPOT>:5093>\r\nCall-ID: 703cb517c2de4df9af9fba56f5669659\r\nCSeq: 1 INVITE\r\nContact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: Yealink-SIP-T46U/108.86.0.40\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b34343230333736393132393340<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d3063633735386538646263383b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313633363135353330303340<HONEYPOT>3a353039333e3b7461673d38386165393236660d0a546f3a203c7369703a2b34343230333736393132393340<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2037303363623531376332646534646639616639666261353666353636393635390d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a205965616c696e6b2d5349502d543436552f3130382e38362e302e34300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"61e6ac93-107e-43ce-834b-025c6d847393","seq":1,"duration_ms":194,"bytes_in":530,"bytes_out":14,"enriched":{"digest":"ec6f4675a84cd4e7","label":"SIP","strings":["INVITE sip:+442037691293@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-0cc758e8dbc8;rport","Max-Forwards: 70","From: <sip:16361553003@<HONEYPOT>:5093>;tag=88ae926f","To: <sip:+442037691293@<HONEYPOT>:5093>","Call-ID: 703cb517c2de4df9af9fba56f5669659","CSeq: 1 INVITE","Contact: <sip:16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: Yealink-SIP-T46U/108.86.0.40","Supported: replaces, timer, path"],"iocs":{"ips":["108.86.0.40"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:+4592451291@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-b36aad7b5ee9;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+16361553003@<HONEYPOT>:5093>;tag=19eda304\r\nTo: <sip:+4592451291@<HONEYPOT>:5093>\r\nCall-ID: ad1957e32d5a411fbe7580563f8ff596\r\nCSeq: 1 INVITE\r\nContact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a2b3435393234353132393140<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d6233366161643762356565393b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333e3b7461673d31396564613330340d0a546f3a203c7369703a2b3435393234353132393140<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2061643139353765333264356134313166626537353830353633663866663539360d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"eb9c5554-9884-4866-aa4a-c2cd61121f85","seq":1,"duration_ms":194,"bytes_in":523,"bytes_out":14,"enriched":{"digest":"a94d13ae6e9c7837","label":"SIP","strings":["INVITE sip:+4592451291@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-b36aad7b5ee9;rport","Max-Forwards: 70","From: <sip:+16361553003@<HONEYPOT>:5093>;tag=19eda304","To: <sip:+4592451291@<HONEYPOT>:5093>","Call-ID: ad1957e32d5a411fbe7580563f8ff596","CSeq: 1 INVITE","Contact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:900442037691293@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-36756896ce69;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+16361553003@<HONEYPOT>:5093>;tag=720a8764\r\nTo: <sip:900442037691293@<HONEYPOT>:5093>\r\nCall-ID: 2914c80a6bde4c52b5cbb53e59b88529\r\nCSeq: 1 INVITE\r\nContact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: Grandstream GXP2130/1.0.11.10\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39303034343230333736393132393340<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d3336373536383936636536393b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333e3b7461673d37323061383736340d0a546f3a203c7369703a39303034343230333736393132393340<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2032393134633830613662646534633532623563626235336535396238383532390d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a204772616e6473747265616d20475850323133302f312e302e31312e31300d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"15ea354c-6781-462d-b949-59c840d6925a","seq":1,"duration_ms":195,"bytes_in":537,"bytes_out":14,"enriched":{"digest":"6da35e62e259894c","label":"SIP","strings":["INVITE sip:900442037691293@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-36756896ce69;rport","Max-Forwards: 70","From: <sip:+16361553003@<HONEYPOT>:5093>;tag=720a8764","To: <sip:900442037691293@<HONEYPOT>:5093>","Call-ID: 2914c80a6bde4c52b5cbb53e59b88529","CSeq: 1 INVITE","Contact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: Grandstream GXP2130/1.0.11.10","Supported: replaces, timer, path"],"iocs":{"ips":["1.0.11.10"],"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5093,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5093","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:001442037691293@<HONEYPOT>:5093 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-d90c96097662;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+16361553003@<HONEYPOT>:5093>;tag=79a606ce\r\nTo: <sip:001442037691293@<HONEYPOT>:5093>\r\nCall-ID: fd2a6c693caf439cb92732978acd9e17\r\nCSeq: 1 INVITE\r\nContact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>\r\nUser-Agent: PolycomVVX-VVX410-5.9.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a30303134343230333736393132393340<HONEYPOT>3a35303933205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039333b6272616e63683d7a39684734624b2d6439306339363039373636323b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333e3b7461673d37396136303663650d0a546f3a203c7369703a30303134343230333736393132393340<HONEYPOT>3a353039333e0d0a43616c6c2d49443a2066643261366336393363616634333963623932373332393738616364396531370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313633363135353330303340<HONEYPOT>3a353039333b7472616e73706f72743d746c733e0d0a557365722d4167656e743a20506f6c79636f6d5656582d5656583431302d352e392e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"7603edaf-c999-4741-9b6a-ec85099a592f","seq":1,"duration_ms":194,"bytes_in":531,"bytes_out":14,"enriched":{"digest":"82bc2f1fccf4be8f","label":"SIP","strings":["INVITE sip:001442037691293@<HONEYPOT>:5093 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5093;branch=z9hG4bK-d90c96097662;rport","Max-Forwards: 70","From: <sip:+16361553003@<HONEYPOT>:5093>;tag=79a606ce","To: <sip:001442037691293@<HONEYPOT>:5093>","Call-ID: fd2a6c693caf439cb92732978acd9e17","CSeq: 1 INVITE","Contact: <sip:+16361553003@<HONEYPOT>:5093;transport=tls>","User-Agent: PolycomVVX-VVX410-5.9.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5094,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5094","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:9011442037691293@<HONEYPOT>:5094 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5094;branch=z9hG4bK-52025e89d234;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+10732784895@<HONEYPOT>:5094>;tag=a465ea2e\r\nTo: <sip:9011442037691293@<HONEYPOT>:5094>\r\nCall-ID: 41006c503571432ba2947f44150d8160\r\nCSeq: 1 INVITE\r\nContact: <sip:+10732784895@<HONEYPOT>:5094;transport=tls>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333736393132393340<HONEYPOT>3a35303934205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039343b6272616e63683d7a39684734624b2d3532303235653839643233343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313037333237383438393540<HONEYPOT>3a353039343e3b7461673d61343635656132650d0a546f3a203c7369703a3930313134343230333736393132393340<HONEYPOT>3a353039343e0d0a43616c6c2d49443a2034313030366335303335373134333262613239343766343431353064383136300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313037333237383438393540<HONEYPOT>3a353039343b7472616e73706f72743d746c733e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"ce23ae89-87fc-44e0-b7b9-5c94bcdb3816","seq":1,"duration_ms":195,"bytes_in":527,"bytes_out":14,"enriched":{"digest":"c8d4764dd5e1c0e6","label":"SIP","strings":["INVITE sip:9011442037691293@<HONEYPOT>:5094 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5094;branch=z9hG4bK-52025e89d234;rport","Max-Forwards: 70","From: <sip:+10732784895@<HONEYPOT>:5094>;tag=a465ea2e","To: <sip:9011442037691293@<HONEYPOT>:5094>","Call-ID: 41006c503571432ba2947f44150d8160","CSeq: 1 INVITE","Contact: <sip:+10732784895@<HONEYPOT>:5094;transport=tls>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS"]}}},{"timestamp":"2026-10-24T14:02:11","port":5094,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5094","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:00442037691293@<HONEYPOT>:5094 SIP/2.0\r\nVia: SIP/2.0/TLS <HONEYPOT>:5094;branch=z9hG4bK-8d9530faa7cc;rport\r\nMax-Forwards: 70\r\nFrom: <sip:10732784895@<HONEYPOT>:5094>;tag=44e4e540\r\nTo: <sip:00442037691293@<HONEYPOT>:5094>\r\nCall-ID: 70011618a94044daa7ac59e5ebbb8662\r\nCSeq: 1 INVITE\r\nContact: <sip:10732784895@<HONEYPOT>:5094;transport=tls>\r\nUser-Agent: Cisco-CP8841/11.5\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY, INFO, PRACK\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a303034343230333736393132393340<HONEYPOT>3a35303934205349502f322e300d0a5669613a205349502f322e302f544c5320<HONEYPOT>3a353039343b6272616e63683d7a39684734624b2d3864393533306661613763633b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313037333237383438393540<HONEYPOT>3a353039343e3b7461673d34346534653534300d0a546f3a203c7369703a303034343230333736393132393340<HONEYPOT>3a353039343e0d0a43616c6c2d49443a2037303031313631386139343034346461613761633539653565626262383636320d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a313037333237383438393540<HONEYPOT>3a353039343b7472616e73706f72743d746c733e0d0a557365722d4167656e743a20436973636f2d4350383834312f31312e350d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946592c20494e464f2c20505241434b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"128ef52818391816ed9b3ece21686a6f","session":"33173e5f-0607-49af-9432-34249d91e18a","seq":1,"duration_ms":194,"bytes_in":521,"bytes_out":14,"enriched":{"digest":"6ac91d0e2cbb1f39","label":"SIP","strings":["INVITE sip:00442037691293@<HONEYPOT>:5094 SIP/2.0","Via: SIP/2.0/TLS <HONEYPOT>:5094;branch=z9hG4bK-8d9530faa7cc;rport","Max-Forwards: 70","From: <sip:10732784895@<HONEYPOT>:5094>;tag=44e4e540","To: <sip:00442037691293@<HONEYPOT>:5094>","Call-ID: 70011618a94044daa7ac59e5ebbb8662","CSeq: 1 INVITE","Contact: <sip:10732784895@<HONEYPOT>:5094;transport=tls>","User-Agent: Cisco-CP8841/11.5","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS"]}}}],"http_methods":[],"distinct_ports_total":40,"top_paths":[],"distinct_paths_total":0,"top_snis":[{"value":"<HONEYPOT>:5060","count":40},{"value":"<HONEYPOT>:5065","count":40},{"value":"<HONEYPOT>:5077","count":40},{"value":"<HONEYPOT>:5064","count":40},{"value":"<HONEYPOT>:5091","count":40},{"value":"<HONEYPOT>:5080","count":40},{"value":"<HONEYPOT>:5062","count":40},{"value":"<HONEYPOT>:5082","count":40},{"value":"<HONEYPOT>:5079","count":40},{"value":"<HONEYPOT>:5086","count":40},{"value":"<HONEYPOT>:5063","count":40},{"value":"<HONEYPOT>:5087","count":40}],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}