{"ip":"172.110.223.17","total_events":251,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["251 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 3,413,970 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look.","Held a session open for 250s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"3,413,970 bytes sent, longest session 250s","bytes_sent":3413970,"session_seconds":250,"persistent":true}},"first_seen":"2026-09-16T16:04:57","last_seen":"2026-09-19T07:05:20","events_24h":0,"events_7d":251,"geo":{"country_code":"PH","country_name":"Philippines","region":"","city":"","lat":14.5955,"lon":120.9721,"asn":47154,"org":"Husam A. H. Hijazi"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":251}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-16","count":112},{"date":"2026-09-19","count":139}],"recent_events":[{"timestamp":"2026-09-19T07:05:20","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9812392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:6192;branch=z9hG4bK-524287-1---f217eb4f625cf365;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:6192;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:9812392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=ab78b33b\r\nCall-ID: vPRvCizbv5pmqU68Ir8RzQ..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402083 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20154 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3938313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a363139323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d663231376562346636323563663336353b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a363139323b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3938313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d61623738623333620d0a43616c6c2d49443a207650527643697a627635706d71553638497238527a512e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303833203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313534205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"c0d2290a-9d9c-45ce-bfa7-0eac5bc7196b","seq":28,"duration_ms":250150,"bytes_in":25783,"bytes_out":392,"enriched":{"digest":"344eb024df5371d1","label":"SIP","strings":["INVITE sip:9812392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:6192;branch=z9hG4bK-524287-1---f217eb4f625cf365;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:6192;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:9812392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=ab78b33b","Call-ID: vPRvCizbv5pmqU68Ir8RzQ..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:18","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9812392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:5939;branch=z9hG4bK-524287-1---a060181fac513f0a;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:5939;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:9812392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=5952155e\r\nCall-ID: 7WPz-dbRZcW39-y-m150AQ..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402081 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20154 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3938313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a353933393b6272616e63683d7a39684734624b2d3532343238372d312d2d2d613036303138316661633531336630613b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a353933393b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3938313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d35393532313535650d0a43616c6c2d49443a203757507a2d6462525a635733392d792d6d31353041512e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303831203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313534205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"181c3829-9001-42d5-bc79-bff5504ae63c","seq":28,"duration_ms":250149,"bytes_in":25783,"bytes_out":392,"enriched":{"digest":"eb52780c63172f75","label":"SIP","strings":["INVITE sip:9812392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:5939;branch=z9hG4bK-524287-1---a060181fac513f0a;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:5939;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:9812392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=5952155e","Call-ID: 7WPz-dbRZcW39-y-m150AQ..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:18","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9812392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---9b701c73b9597924;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:9812392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=fd4b0c31\r\nCall-ID: PLO4RnK6FsaT0-YIVWjBzw..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402081 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20154 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3938313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d396237303163373362393539373932343b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3938313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d66643462306333310d0a43616c6c2d49443a20504c4f34526e4b3646736154302d594956576a427a772e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303831203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313534205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"8c7b8bca-dc11-41c6-a4ef-18eeca9b699c","seq":28,"duration_ms":250150,"bytes_in":25783,"bytes_out":392,"enriched":{"digest":"01da9d2fb710751d","label":"SIP","strings":["INVITE sip:9812392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---9b701c73b9597924;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:9812392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=fd4b0c31","Call-ID: PLO4RnK6FsaT0-YIVWjBzw..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:18","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9812392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---1575205b6b447a28;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:9812392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=4b70c864\r\nCall-ID: ldAkRpVSygpbRxFhd79zdw..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402081 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20154 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3938313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d313537353230356236623434376132383b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3938313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d34623730633836340d0a43616c6c2d49443a206c64416b5270565379677062527846686437397a64772e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303831203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313534205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"bc15a613-a070-4f4d-94f2-b5098889c0c6","seq":27,"duration_ms":250151,"bytes_in":25783,"bytes_out":378,"enriched":{"digest":"1fab6c6c5d71ccb3","label":"SIP","strings":["INVITE sip:9812392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---1575205b6b447a28;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:9812392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=4b70c864","Call-ID: ldAkRpVSygpbRxFhd79zdw..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:18","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9812392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---5d6a503a5c06db6a;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:9812392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=8c43866b\r\nCall-ID: mLtJgPWuqpySTT4TBnRR7A..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402081 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20154 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3938313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d356436613530336135633036646236613b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3938313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d38633433383636620d0a43616c6c2d49443a206d4c744a675057757170795354543454426e525237412e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303831203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313534205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"c3034af2-1313-4410-b948-ed0cd169ae37","seq":28,"duration_ms":250151,"bytes_in":25783,"bytes_out":392,"enriched":{"digest":"efe6d52e325041e8","label":"SIP","strings":["INVITE sip:9812392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---5d6a503a5c06db6a;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:9812392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=8c43866b","Call-ID: mLtJgPWuqpySTT4TBnRR7A..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:10","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:0012392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:6192;branch=z9hG4bK-524287-1---9e072c1cdc740213;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:6192;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:0012392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=d60f024d\r\nCall-ID: BYHdhICJ80G8LZ9C4wG8kA..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402073 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20148 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3030313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a363139323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d396530373263316364633734303231333b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a363139323b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3030313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d64363066303234640d0a43616c6c2d49443a20425948646849434a383047384c5a3943347747386b412e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303733203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313438205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"c0d2290a-9d9c-45ce-bfa7-0eac5bc7196b","seq":27,"duration_ms":240148,"bytes_in":24864,"bytes_out":378,"enriched":{"digest":"09b423a99efd0ed4","label":"SIP","strings":["INVITE sip:0012392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:6192;branch=z9hG4bK-524287-1---9e072c1cdc740213;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:6192;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:0012392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=d60f024d","Call-ID: BYHdhICJ80G8LZ9C4wG8kA..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:08","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:0012392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:5939;branch=z9hG4bK-524287-1---5e59936bc53e5967;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:5939;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:0012392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=900f9321\r\nCall-ID: LIIvucGMPYbNGwBzBrc3Iw..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402071 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20148 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3030313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a353933393b6272616e63683d7a39684734624b2d3532343238372d312d2d2d356535393933366263353365353936373b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a353933393b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3030313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d39303066393332310d0a43616c6c2d49443a204c4949767563474d5059624e4777427a4272633349772e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303731203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313438205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"181c3829-9001-42d5-bc79-bff5504ae63c","seq":27,"duration_ms":240147,"bytes_in":24864,"bytes_out":378,"enriched":{"digest":"93b8edea86cc6d53","label":"SIP","strings":["INVITE sip:0012392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:5939;branch=z9hG4bK-524287-1---5e59936bc53e5967;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:5939;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:0012392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=900f9321","Call-ID: LIIvucGMPYbNGwBzBrc3Iw..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:08","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:0012392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---974621046b534837;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:0012392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=4846f633\r\nCall-ID: F6OEflnjQ5eO_LlNTcC8_A..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402071 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20148 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3030313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d393734363231303436623533343833373b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3030313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d34383436663633330d0a43616c6c2d49443a2046364f45666c6e6a5135654f5f4c6c4e546343385f412e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303731203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313438205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"8c7b8bca-dc11-41c6-a4ef-18eeca9b699c","seq":27,"duration_ms":240147,"bytes_in":24864,"bytes_out":378,"enriched":{"digest":"8abda8061d45b109","label":"SIP","strings":["INVITE sip:0012392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---974621046b534837;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:0012392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=4846f633","Call-ID: F6OEflnjQ5eO_LlNTcC8_A..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:08","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:0012392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---22034f0901475d2c;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:0012392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=dd577b3a\r\nCall-ID: ONSFPO3uM-JjiSSN6B8hDQ..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402071 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20148 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3030313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d323230333466303930313437356432633b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3030313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d64643537376233610d0a43616c6c2d49443a204f4e5346504f33754d2d4a6a6953534e3642386844512e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303731203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313438205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"bc15a613-a070-4f4d-94f2-b5098889c0c6","seq":26,"duration_ms":240148,"bytes_in":24864,"bytes_out":364,"enriched":{"digest":"6597bc63d1af98db","label":"SIP","strings":["INVITE sip:0012392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---22034f0901475d2c;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:0012392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=dd577b3a","Call-ID: ONSFPO3uM-JjiSSN6B8hDQ..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-19T07:05:08","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:0012392686115@<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---bd16df2de6236f32;rport\r\nMax-Forwards: 70\r\nContact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:CF1E8C14-E545-05F6-0AA1-0CEB8D5D8AB3>\"\r\nTo: <sip:0012392686115@<HONEYPOT>>\r\nFrom: \"2026\"<sip:2026@<HONEYPOT>>;tag=e51c986d\r\nCall-ID: GBM5w06yN5o7qch1YcMTsQ..\r\nCSeq: 1 INVITE\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO\r\nContent-Type: application/sdp\r\nSupported: replaces\r\nUser-Agent: USAcisco2027\r\nAllow-Events: hold, talk, conference\r\nContent-Length: 277\r\n\r\nv=0\r\no=- 549402071 1 IN IP4 172.110.223.17\r\ns=portsip.com\r\nc=IN IP4 172.110.223.17\r\nt=0 0\r\nm=audio 20148 RTP/AVP 0 8 18 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3030313233393236383631313540<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f544350203137322e3131302e3232332e31373a373337343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d626431366466326465363233366633323b72706f72740d0a4d61782d466f7277617264733a2037300d0a436f6e746163743a203c7369703a32303236403137322e3131302e3232332e31373a373337343b7472616e73706f72743d7463703e3b2b7369702e696e7374616e63653d223c75726e3a757569643a43463145384331342d453534352d303546362d304141312d3043454238443544384142333e220d0a546f3a203c7369703a3030313233393236383631313540<HONEYPOT>3e0d0a46726f6d3a202232303236223c7369703a3230323640<HONEYPOT>3e3b7461673d65353163393836640d0a43616c6c2d49443a2047424d35773036794e356f377163683159634d5473512e2e0d0a435365713a203120494e564954450d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c2052454749535445522c205355425343524942452c20494e464f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a537570706f727465643a207265706c616365730d0a557365722d4167656e743a20555341636973636f323032370d0a416c6c6f772d4576656e74733a20686f6c642c2074616c6b2c20636f6e666572656e63650d0a436f6e74656e742d4c656e6774683a203237370d0a0d0a763d300d0a6f3d2d20353439343032303731203120494e20495034203137322e3131302e3232332e31370d0a733d706f72747369702e636f6d0d0a633d494e20495034203137322e3131302e3232332e31370d0a743d3020300d0a6d3d617564696f203230313438205254502f41565020302038203138203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"c3034af2-1313-4410-b948-ed0cd169ae37","seq":27,"duration_ms":240148,"bytes_in":24864,"bytes_out":378,"enriched":{"digest":"cbef668cb02c9d0d","label":"SIP","strings":["INVITE sip:0012392686115@<HONEYPOT> SIP/2.0","Via: SIP/2.0/TCP 172.110.223.17:7374;branch=z9hG4bK-524287-1---bd16df2de6236f32;…","Max-Forwards: 70","Contact: <sip:2026@172.110.223.17:7374;transport=tcp>;+sip.instance=\"<urn:uuid:C…","To: <sip:0012392686115@<HONEYPOT>>","From: \"2026\"<sip:2026@<HONEYPOT>>;tag=e51c986d","Call-ID: GBM5w06yN5o7qch1YcMTsQ..","CSeq: 1 INVITE","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBS…","Content-Type: application/sdp"],"iocs":{"ips":["172.110.223.17"],"domains":["sip.instance"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-23T15:10:58.792383+00:00"}