{"ip":"179.43.167.3","total_events":180,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["180 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 192,966 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"192,966 bytes sent","bytes_sent":192966,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T04:55:32","last_seen":"2026-09-20T09:44:15","events_24h":0,"events_7d":0,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Rümlang","lat":47.4505,"lon":8.5255,"asn":51852,"org":"Private Layer INC"},"source_domain":"hostedby.privatelayer.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as51852","label":"Phase Layer Global Networks","category":"isp","url":"https://www.peeringdb.com/asn/51852"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":8,"protocols":[{"protocol":"udp","events":8}],"ports":[{"port":5060,"events":8}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T20:37:50","last_seen":"2026-10-06T16:56:19","recent":[{"timestamp":"2026-10-06T16:56:19","port":5060,"src_port":28023,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---c21ef9fd43737445\r\nFrom: <sip:x+13977481030@0.0.0.0>;tag=3133bd76\r\nTo: <sip:90113908351673002@<HONEYPOT>:5060>\r\nCall-ID: sLRTlROFScojmA6fSCncy3..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+13977481030@0.0.0.0:28023;transport=UDP>\r\nUser-Agent: Cisco CP-7941\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a32383032333b6272616e63683d7a39684734624b2d3532343238372d312d2d2d633231656639666434333733373434350d0a46726f6d3a203c7369703a782b313339373734383130333040302e302e302e303e3b7461673d33313333626437360d0a546f3a203c7369703a393031313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20734c52546c524f4653636f6a6d41366653436e6379332e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313339373734383130333040302e302e302e303a32383032333b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20436973636f2043502d373934310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"ceb145aa-4b75-4b8e-b282-a11bea21ffd0","bytes_in":1069,"source_verified":false,"enriched":{"digest":"2b0c061d5ac79328","label":"SIP","strings":["INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---c21ef9fd43737445","From: <sip:x+13977481030@0.0.0.0>;tag=3133bd76","To: <sip:90113908351673002@<HONEYPOT>:5060>","Call-ID: sLRTlROFScojmA6fSCncy3..","CSeq: 15 INVITE","Contact: <sip:x+13977481030@0.0.0.0:28023;transport=UDP>","User-Agent: Cisco CP-7941","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-06T15:46:11","port":5060,"src_port":28023,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---02e862582da79026\r\nFrom: <sip:x+13493984677@0.0.0.0>;tag=3ff17ba0\r\nTo: <sip:90113908351673002@<HONEYPOT>:5060>\r\nCall-ID: hpDnxiC8sJ8jF2NXxJaUlM..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+13493984677@0.0.0.0:28023;transport=UDP>\r\nUser-Agent: MicroSIP\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a32383032333b6272616e63683d7a39684734624b2d3532343238372d312d2d2d303265383632353832646137393032360d0a46726f6d3a203c7369703a782b313334393339383436373740302e302e302e303e3b7461673d33666631376261300d0a546f3a203c7369703a393031313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a206870446e78694338734a386a46324e58784a61556c4d2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313334393339383436373740302e302e302e303a32383032333b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204d6963726f5349500d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"5babfcd1-fb96-418b-b9d2-b452b8a224d2","bytes_in":1062,"source_verified":false,"enriched":{"digest":"920211b4a2d42c06","label":"SIP","strings":["INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---02e862582da79026","From: <sip:x+13493984677@0.0.0.0>;tag=3ff17ba0","To: <sip:90113908351673002@<HONEYPOT>:5060>","Call-ID: hpDnxiC8sJ8jF2NXxJaUlM..","CSeq: 15 INVITE","Contact: <sip:x+13493984677@0.0.0.0:28023;transport=UDP>","User-Agent: MicroSIP","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-06T13:58:09","port":5060,"src_port":31620,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---999e219e64021c2f\r\nFrom: <sip:x+16147230292@0.0.0.0>;tag=ac6a35ad\r\nTo: <sip:0113908351673002@<HONEYPOT>:5060>\r\nCall-ID: BWYBTsO7bqzL7yp8PrKvfz..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+16147230292@0.0.0.0:31620;transport=UDP>\r\nUser-Agent: PJSIP\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3031313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a33313632303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d393939653231396536343032316332660d0a46726f6d3a203c7369703a782b313631343732333032393240302e302e302e303e3b7461673d61633661333561640d0a546f3a203c7369703a3031313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a204257594254734f3762717a4c3779703850724b76667a2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313631343732333032393240302e302e302e303a33313632303b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20504a5349500d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"4356d85d-c31a-4434-afd0-52689bae774e","bytes_in":1059,"source_verified":false,"enriched":{"digest":"a93dc155b42e2949","label":"SIP","strings":["INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---999e219e64021c2f","From: <sip:x+16147230292@0.0.0.0>;tag=ac6a35ad","To: <sip:0113908351673002@<HONEYPOT>:5060>","Call-ID: BWYBTsO7bqzL7yp8PrKvfz..","CSeq: 15 INVITE","Contact: <sip:x+16147230292@0.0.0.0:31620;transport=UDP>","User-Agent: PJSIP","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-06T07:33:40","port":5060,"src_port":31620,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---28c38fd9e6c4b21f\r\nFrom: <sip:x+13493984677@0.0.0.0>;tag=4b3a893d\r\nTo: <sip:0113908351673002@<HONEYPOT>:5060>\r\nCall-ID: As52oNCX5TIMhQXEMg4yDZ..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+13493984677@0.0.0.0:31620;transport=UDP>\r\nUser-Agent: Cisco-CP7861-3PCC/12.0.2\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3031313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a33313632303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d323863333866643965366334623231660d0a46726f6d3a203c7369703a782b313334393339383436373740302e302e302e303e3b7461673d34623361383933640d0a546f3a203c7369703a3031313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20417335326f4e43583554494d685158454d673479445a2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313334393339383436373740302e302e302e303a33313632303b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20436973636f2d4350373836312d335043432f31322e302e320d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"26adf7b6-bdf4-40c7-9c06-050fee1335d4","bytes_in":1076,"source_verified":false,"enriched":{"digest":"f91c5c51538cd455","label":"SIP","strings":["INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---28c38fd9e6c4b21f","From: <sip:x+13493984677@0.0.0.0>;tag=4b3a893d","To: <sip:0113908351673002@<HONEYPOT>:5060>","Call-ID: As52oNCX5TIMhQXEMg4yDZ..","CSeq: 15 INVITE","Contact: <sip:x+13493984677@0.0.0.0:31620;transport=UDP>","User-Agent: Cisco-CP7861-3PCC/12.0.2","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-06T05:45:03","port":5060,"src_port":31681,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---ae9b6b62c5fba465\r\nFrom: <sip:x+16147230292@0.0.0.0>;tag=4224d476\r\nTo: <sip:+3908351673002@<HONEYPOT>:5060>\r\nCall-ID: DDF5hNs24hevrFni7LVSJK..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+16147230292@0.0.0.0:31681;transport=UDP>\r\nUser-Agent: FusionPBX\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a33313638313b6272616e63683d7a39684734624b2d3532343238372d312d2d2d616539623662363263356662613436350d0a46726f6d3a203c7369703a782b313631343732333032393240302e302e302e303e3b7461673d34323234643437360d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a2044444635684e73323468657672466e69374c56534a4b2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313631343732333032393240302e302e302e303a33313638313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20467573696f6e5042580d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"04745f02-80a9-4191-ad2b-6ddf899329bc","bytes_in":1059,"source_verified":false,"enriched":{"digest":"ff7faddf1b582931","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---ae9b6b62c5fba465","From: <sip:x+16147230292@0.0.0.0>;tag=4224d476","To: <sip:+3908351673002@<HONEYPOT>:5060>","Call-ID: DDF5hNs24hevrFni7LVSJK..","CSeq: 15 INVITE","Contact: <sip:x+16147230292@0.0.0.0:31681;transport=UDP>","User-Agent: FusionPBX","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-06T00:28:08","port":5060,"src_port":31681,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---ba390fdaef5365a0\r\nFrom: <sip:x+13977481030@0.0.0.0>;tag=31870793\r\nTo: <sip:+3908351673002@<HONEYPOT>:5060>\r\nCall-ID: aqVKtQKsZ2xMqkAut24Men..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+13977481030@0.0.0.0:31681;transport=UDP>\r\nUser-Agent: 3CXPhoneSystem 18.0.5.638\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a33313638313b6272616e63683d7a39684734624b2d3532343238372d312d2d2d626133393066646165663533363561300d0a46726f6d3a203c7369703a782b313339373734383130333040302e302e302e303e3b7461673d33313837303739330d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a206171564b74514b735a32784d716b41757432344d656e2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313339373734383130333040302e302e302e303a33313638313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a2033435850686f6e6553797374656d2031382e302e352e3633380d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"6e8d19ad-6106-4b9e-b7df-4837ebe30732","bytes_in":1075,"source_verified":false,"enriched":{"digest":"a3ad70489f894bad","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---ba390fdaef5365a0","From: <sip:x+13977481030@0.0.0.0>;tag=31870793","To: <sip:+3908351673002@<HONEYPOT>:5060>","Call-ID: aqVKtQKsZ2xMqkAut24Men..","CSeq: 15 INVITE","Contact: <sip:x+13977481030@0.0.0.0:31681;transport=UDP>","User-Agent: 3CXPhoneSystem 18.0.5.638","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-05T23:16:42","port":5060,"src_port":31681,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---67ab4c0b973d8a16\r\nFrom: <sip:x+13493984677@0.0.0.0>;tag=2fb72281\r\nTo: <sip:+3908351673002@<HONEYPOT>:5060>\r\nCall-ID: zFT4wkzAfcalwl4oIEFFxl..\r\nCSeq: 15 INVITE\r\nContact: <sip:x+13493984677@0.0.0.0:31681;transport=UDP>\r\nUser-Agent: Yealink SIP-T28P 2.70.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f55445020302e302e302e303a33313638313b6272616e63683d7a39684734624b2d3532343238372d312d2d2d363761623463306239373364386131360d0a46726f6d3a203c7369703a782b313334393339383436373740302e302e302e303e3b7461673d32666237323238310d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a207a465434776b7a416663616c776c346f49454646786c2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a782b313334393339383436373740302e302e302e303a33313638313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d5432385020322e37302e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","sni":"","session":"c8a1afbb-3f55-4e95-93c3-9d6d14729da4","bytes_in":1074,"source_verified":false,"enriched":{"digest":"f8f03168c5ab9ed0","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---67ab4c0b973d8a16","From: <sip:x+13493984677@0.0.0.0>;tag=2fb72281","To: <sip:+3908351673002@<HONEYPOT>:5060>","Call-ID: zFT4wkzAfcalwl4oIEFFxl..","CSeq: 15 INVITE","Contact: <sip:x+13493984677@0.0.0.0:31681;transport=UDP>","User-Agent: Yealink SIP-T28P 2.70.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0","2.70.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-05T20:37:50","port":5060,"src_port":22545,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:8103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 179.43.167.3:22545;branch=z9hG4bK-524287-1---5880356d83c0a82b;rport\r\nRemote-Party-ID: <sip:16493984677@<HONEYPOT>>;party=calling;screen=no;privacy=off\r\nFrom: <sip:16493984677@179.43.167.3:22545>;tag=e2d7711e\r\nTo: <sip:8103908351673002@<HONEYPOT>:5060>\r\nContact: <sip:16493984677@179.43.167.3:22545>\r\nCall-ID: k1W9ofK9GqHIDSlyifwYq3..\r\nCSeq: 111 INVITE\r\nUser-Agent: MicroSIP/3.20.2\r\nMax-Forwards: 70\r\nAllow: ACK,BYE,CANCEL,INFO,INVITE,OPTIONS,PRACK,REFER,UPDATE\r\nSupported: timer,resource-priority,norefersub,100rel,replaces\r\nContent-Type: application/sdp\r\nAllow-Events: presence, kpml\r\nSession-Expires: 1800;refresher=uac\r\nContent-Length: 819\r\n\r\nv=0\r\no=- 279118510 1 IN IP4 179.43.167.3\r\ns=SIP\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 40202 RTP/AVP 0 8 13 18 97 3 98 9 100 99 102 121 105 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:13 CN/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:97 iLBC/8000\r\na=rtpmap:3 GSM/8000\r\na=rtpmap:98 AMR/8000\r\na=rtpmap:9 G722/8000\r\na=rtpmap:100 SPEEX/8000\r\na=rtpmap:99 AMR-WB/16000\r\na=rtpmap:102 SPEEX/16000\r\na=rtpmap:121 G7221/16000\r\na=fmtp:121 bitrate=24000\r\na=rtpmap:105 opus/48000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\r\nm=video 43000 RTP/AVP 34 115 125 120\r\na=rtpmap:34 H263/90000\r\na=fmtp:34 CIF=2;QCIF=2\r\na=rtpmap:115 H263-1998/90000\r\na=fmtp:115 CIF=2;QCIF=2\r\na=rtpmap:125 H264/90000\r\na=fmtp:125 profile-level-id=42801E;packetization-mode=0\r\na=rtpmap:120 VP8/90000\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a3831303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203137392e34332e3136372e333a32323534353b6272616e63683d7a39684734624b2d3532343238372d312d2d2d353838303335366438336330613832623b72706f72740d0a52656d6f74652d50617274792d49443a203c7369703a313634393339383436373740<HONEYPOT>3e3b70617274793d63616c6c696e673b73637265656e3d6e6f3b707269766163793d6f66660d0a46726f6d3a203c7369703a3136343933393834363737403137392e34332e3136372e333a32323534353e3b7461673d65326437373131650d0a546f3a203c7369703a3831303339303833353136373330303240<HONEYPOT>3a353036303e0d0a436f6e746163743a203c7369703a3136343933393834363737403137392e34332e3136372e333a32323534353e0d0a43616c6c2d49443a206b3157396f664b394771484944536c796966775971332e2e0d0a435365713a2031313120494e564954450d0a557365722d4167656e743a204d6963726f5349502f332e32302e320d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a2041434b2c4259452c43414e43454c2c494e464f2c494e564954452c4f5054494f4e532c505241434b2c52454645522c5550444154450d0a537570706f727465643a2074696d65722c7265736f757263652d7072696f726974792c6e6f72656665727375622c31303072656c2c7265706c616365730d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a436f6e74656e742d4c656e6774683a203831390d0a0d0a763d300d0a6f3d2d20323739313138353130203120494e20495034203137392e34332e3136372e330d0a733d5349500d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203430323032205254502f415650203020382031332031382039372033203938203920313030203939203130322031323120313035203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a393720694c42432f383030300d0a613d7274706d61703a332047534d2f383030300d0a613d7274706d61703a393820414d522f383030300d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130302053504545582f383030300d0a613d7274706d61703a393920414d522d57422f31363030300d0a613d7274706d61703a3130322053504545582f31363030300d0a613d7274706d61703a3132312047373232312f31363030300d0a613d666d74703a31323120626974726174653d32343030300d0a613d7274706d61703a313035206f7075732f34383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d73656e64726563760d0a6d3d766964656f203433303030205254502f4156502033342031313520313235203132300d0a613d7274706d61703a333420483236332f39303030300d0a613d666d74703a3334204349463d323b514349463d320d0a613d7274706d61703a31313520483236332d313939382f39303030300d0a613d666d74703a313135204349463d323b514349463d320d0a613d7274706d61703a31323520483236342f39303030300d0a613d666d74703a3132352070726f66696c652d6c6576656c2d69643d3432383031453b7061636b6574697a6174696f6e2d6d6f64653d300d0a613d7274706d61703a313230205650382f39303030300d0a613d73656e64726563760d0a","sni":"","session":"ee79e168-0823-4e9e-9659-9ec3598dd38f","bytes_in":1555,"source_verified":false,"enriched":{"digest":"2a0fa13bb61f43c3","label":"SIP","strings":["INVITE sip:8103908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 179.43.167.3:22545;branch=z9hG4bK-524287-1---5880356d83c0a82b;r…","Remote-Party-ID: <sip:16493984677@<HONEYPOT>>;party=calling;screen=no;privacy=of…","From: <sip:16493984677@179.43.167.3:22545>;tag=e2d7711e","To: <sip:8103908351673002@<HONEYPOT>:5060>","Contact: <sip:16493984677@179.43.167.3:22545>","Call-ID: k1W9ofK9GqHIDSlyifwYq3..","CSeq: 111 INVITE","User-Agent: MicroSIP/3.20.2","Max-Forwards: 70"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/UDP"]}}}]},"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":180}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":90},{"date":"2026-09-20","count":90}],"recent_events":[{"timestamp":"2026-09-20T09:44:15","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:9011+3908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:32872;branch=z9hG4bK-524287-1---c76e9255828e0801\r\nFrom: <sip:%40@<HONEYPOT>>;tag=92dfff90\r\nTo: <sip:9011+3908351673002@<HONEYPOT>:5060>\r\nCall-ID: kz236zfQMNa2LKtYUgC57g..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:32872>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031312b3339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a33323837323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d633736653932353538323865303830310d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d39326466666639300d0a546f3a203c7369703a393031312b3339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a206b7a3233367a66514d4e61324c4b74595567433537672e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a33323837323e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"3e9fe195-605f-422e-a695-dfbee97af640","seq":1,"duration_ms":97,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"7ed04dca139b3ef5","label":"SIP","strings":["INVITE sip:9011+3908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:32872;branch=z9hG4bK-524287-1---c76e9255828e0801","From: <sip:%40@<HONEYPOT>>;tag=92dfff90","To: <sip:9011+3908351673002@<HONEYPOT>:5060>","Call-ID: kz236zfQMNa2LKtYUgC57g..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:32872>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:41:22","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:901193908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:57620;branch=z9hG4bK-524287-1---9099f5a51ae3f228\r\nFrom: <sip:%40@<HONEYPOT>>;tag=06329212\r\nTo: <sip:901193908351673002@<HONEYPOT>:5060>\r\nCall-ID: TIFHtSiqh3AulnzMmZjpdE..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:57620>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a39303131393339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a35373632303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d393039396635613531616533663232380d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d30363332393231320d0a546f3a203c7369703a39303131393339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a205449464874536971683341756c6e7a4d6d5a6a7064452e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a35373632303e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"936db9db-6840-4cbb-b6c8-73ca459d90be","seq":1,"duration_ms":99,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"ebbe6bb3984fdb3b","label":"SIP","strings":["INVITE sip:901193908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:57620;branch=z9hG4bK-524287-1---9099f5a51ae3f228","From: <sip:%40@<HONEYPOT>>;tag=06329212","To: <sip:901193908351673002@<HONEYPOT>:5060>","Call-ID: TIFHtSiqh3AulnzMmZjpdE..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:57620>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:38:29","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90119003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:19052;branch=z9hG4bK-524287-1---b8969075c93ffe28\r\nFrom: <sip:%40@<HONEYPOT>>;tag=9991621e\r\nTo: <sip:90119003908351673002@<HONEYPOT>:5060>\r\nCall-ID: 896wTSqLxdo64iNZahh3pZ..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:19052>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031313930303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a31393035323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d623839363930373563393366666532380d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d39393931363231650d0a546f3a203c7369703a393031313930303339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20383936775453714c78646f3634694e5a61686833705a2e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a31393035323e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"8b57ade7-32dc-4489-aac2-27ccc90cff33","seq":1,"duration_ms":99,"bytes_in":1068,"bytes_out":12,"enriched":{"digest":"9d27b4f2e6c657d4","label":"SIP","strings":["INVITE sip:90119003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:19052;branch=z9hG4bK-524287-1---b8969075c93ffe28","From: <sip:%40@<HONEYPOT>>;tag=9991621e","To: <sip:90119003908351673002@<HONEYPOT>:5060>","Call-ID: 896wTSqLxdo64iNZahh3pZ..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:19052>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:35:35","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90090113908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:55856;branch=z9hG4bK-524287-1---91cbff468ec73539\r\nFrom: <sip:%40@<HONEYPOT>>;tag=469961d2\r\nTo: <sip:90090113908351673002@<HONEYPOT>:5060>\r\nCall-ID: wgD7sO7pPoIbvpAkenAXBV..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:55856>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393030393031313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a35353835363b6272616e63683d7a39684734624b2d3532343238372d312d2d2d393163626666343638656337333533390d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d34363939363164320d0a546f3a203c7369703a393030393031313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a2077674437734f3770506f49627670416b656e415842562e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a35353835363e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"8fdaaf0e-406e-40b1-a1b9-5fe57ed9565c","seq":1,"duration_ms":100,"bytes_in":1068,"bytes_out":12,"enriched":{"digest":"8f612b1d351e1c1e","label":"SIP","strings":["INVITE sip:90090113908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:55856;branch=z9hG4bK-524287-1---91cbff468ec73539","From: <sip:%40@<HONEYPOT>>;tag=469961d2","To: <sip:90090113908351673002@<HONEYPOT>:5060>","Call-ID: wgD7sO7pPoIbvpAkenAXBV..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:55856>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:32:42","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:80003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:45708;branch=z9hG4bK-524287-1---37be753c91dbf516\r\nFrom: <sip:%40@<HONEYPOT>>;tag=2fa32f42\r\nTo: <sip:80003908351673002@<HONEYPOT>:5060>\r\nCall-ID: 01tDLs8WcFAq9ZKUoRSYyJ..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:45708>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a383030303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a34353730383b6272616e63683d7a39684734624b2d3532343238372d312d2d2d333762653735336339316462663531360d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d32666133326634320d0a546f3a203c7369703a383030303339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20303174444c73385763464171395a4b556f525359794a2e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a34353730383e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"23b3d775-8580-4498-b06a-8c6da90cc320","seq":1,"duration_ms":100,"bytes_in":1062,"bytes_out":12,"enriched":{"digest":"487f89afc6c17104","label":"SIP","strings":["INVITE sip:80003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:45708;branch=z9hG4bK-524287-1---37be753c91dbf516","From: <sip:%40@<HONEYPOT>>;tag=2fa32f42","To: <sip:80003908351673002@<HONEYPOT>:5060>","Call-ID: 01tDLs8WcFAq9ZKUoRSYyJ..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:45708>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:29:49","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:900003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:13962;branch=z9hG4bK-524287-1---6079631c4e7b59f1\r\nFrom: <sip:%40@<HONEYPOT>>;tag=c579a813\r\nTo: <sip:900003908351673002@<HONEYPOT>:5060>\r\nCall-ID: hD3nVJGkdHJPDAHNnI5afv..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:13962>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a39303030303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a31333936323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d363037393633316334653762353966310d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d63353739613831330d0a546f3a203c7369703a39303030303339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a206844336e564a476b64484a504441484e6e49356166762e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a31333936323e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"50607bce-07c1-47e3-9b6c-93114a8e4a46","seq":1,"duration_ms":99,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"180a3045688ae98b","label":"SIP","strings":["INVITE sip:900003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:13962;branch=z9hG4bK-524287-1---6079631c4e7b59f1","From: <sip:%40@<HONEYPOT>>;tag=c579a813","To: <sip:900003908351673002@<HONEYPOT>:5060>","Call-ID: hD3nVJGkdHJPDAHNnI5afv..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:13962>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:26:56","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:21088;branch=z9hG4bK-524287-1---2407a994c86218fe\r\nFrom: <sip:%40@<HONEYPOT>>;tag=c49a7701\r\nTo: <sip:90003908351673002@<HONEYPOT>:5060>\r\nCall-ID: VlvEaqQjpxgSauxXsGWfA0..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:21088>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393030303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a32313038383b6272616e63683d7a39684734624b2d3532343238372d312d2d2d323430376139393463383632313866650d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d63343961373730310d0a546f3a203c7369703a393030303339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20566c76456171516a70786753617578587347576641302e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a32313038383e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"558301d0-1ca7-434b-828b-240e6df37638","seq":1,"duration_ms":99,"bytes_in":1062,"bytes_out":12,"enriched":{"digest":"907c54132813a596","label":"SIP","strings":["INVITE sip:90003908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:21088;branch=z9hG4bK-524287-1---2407a994c86218fe","From: <sip:%40@<HONEYPOT>>;tag=c49a7701","To: <sip:90003908351673002@<HONEYPOT>:5060>","Call-ID: VlvEaqQjpxgSauxXsGWfA0..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:21088>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:24:03","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:000213908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:18240;branch=z9hG4bK-524287-1---2b25983ee7adf86c\r\nFrom: <sip:%40@<HONEYPOT>>;tag=946e5897\r\nTo: <sip:000213908351673002@<HONEYPOT>:5060>\r\nCall-ID: tmUnB6Osyj2RQb55dIXYcZ..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:18240>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a30303032313339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a31383234303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d326232353938336565376164663836630d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d39343665353839370d0a546f3a203c7369703a30303032313339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20746d556e42364f73796a32525162353564495859635a2e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a31383234303e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"ea775b13-6e6d-491d-83ea-2f6674f1a919","seq":1,"duration_ms":99,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"30a1dce801d61318","label":"SIP","strings":["INVITE sip:000213908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:18240;branch=z9hG4bK-524287-1---2b25983ee7adf86c","From: <sip:%40@<HONEYPOT>>;tag=946e5897","To: <sip:000213908351673002@<HONEYPOT>:5060>","Call-ID: tmUnB6Osyj2RQb55dIXYcZ..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:18240>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:21:10","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:000153908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:38246;branch=z9hG4bK-524287-1---fab7ee072753bb5a\r\nFrom: <sip:%40@<HONEYPOT>>;tag=75d0a1c0\r\nTo: <sip:000153908351673002@<HONEYPOT>:5060>\r\nCall-ID: YzSc7e4H3NJiERiApzhcmm..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:38246>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a30303031353339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a33383234363b6272616e63683d7a39684734624b2d3532343238372d312d2d2d666162376565303732373533626235610d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d37356430613163300d0a546f3a203c7369703a30303031353339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20597a536337653448334e4a6945526941707a68636d6d2e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a33383234363e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"dc0ff0a0-2faa-4445-9fbe-e1693a96be2b","seq":1,"duration_ms":99,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"838a7cdf90e9c28d","label":"SIP","strings":["INVITE sip:000153908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:38246;branch=z9hG4bK-524287-1---fab7ee072753bb5a","From: <sip:%40@<HONEYPOT>>;tag=75d0a1c0","To: <sip:000153908351673002@<HONEYPOT>:5060>","Call-ID: YzSc7e4H3NJiERiApzhcmm..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:38246>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-20T09:18:17","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:+90123908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 179.43.167.3:21440;branch=z9hG4bK-524287-1---839c898140ee8aa8\r\nFrom: <sip:%40@<HONEYPOT>>;tag=1626908d\r\nTo: <sip:+90123908351673002@<HONEYPOT>:5060>\r\nCall-ID: EECVplqTik3r5vpD0qwlIY..\r\nCSeq: 1 INVITE\r\nContact: <sip:%40@179.43.167.3:21440>\r\nUser-Agent: TUFAN-PCT-1438\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSAGE, UPDATE, INFO\r\nSupported: replaces, norefersub, timer, 100rel\r\nP-Asserted-Identity: <sip:16612171041@<HONEYPOT>>\r\nContent-Type: application/sdp\r\nMax-Forwards: 70\r\nContent-Length: 429\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 179.43.167.3\r\ns=TUFAN Call\r\nc=IN IP4 179.43.167.3\r\nt=0 0\r\nm=audio 10990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b393031323339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f544350203137392e34332e3136372e333a32313434303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d383339633839383134306565386161380d0a46726f6d3a203c7369703a25343040<HONEYPOT>3e3b7461673d31363236393038640d0a546f3a203c7369703a2b393031323339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a2045454356706c7154696b3372357670443071776c49592e2e0d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a253430403137392e34332e3136372e333a32313434303e0d0a557365722d4167656e743a20545546414e2d5043542d313433380d0a416c6c6f773a20494e564954452c2041434b2c204259452c2043414e43454c2c204f5054494f4e532c20505241434b2c205355425343524942452c204e4f544946592c2052454645522c204d4553534147452c205550444154452c20494e464f0d0a537570706f727465643a207265706c616365732c206e6f72656665727375622c2074696d65722c2031303072656c0d0a502d41737365727465642d4964656e746974793a203c7369703a313636313231373130343140<HONEYPOT>3e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d4c656e6774683a203432390d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203137392e34332e3136372e330d0a733d545546414e2043616c6c0d0a633d494e20495034203137392e34332e3136372e330d0a743d3020300d0a6d3d617564696f203130393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"81b4fccd-4a3a-44ab-bdfd-f3b8bfd26606","seq":1,"duration_ms":100,"bytes_in":1064,"bytes_out":12,"enriched":{"digest":"995da1211f29626f","label":"SIP","strings":["INVITE sip:+90123908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 179.43.167.3:21440;branch=z9hG4bK-524287-1---839c898140ee8aa8","From: <sip:%40@<HONEYPOT>>;tag=1626908d","To: <sip:+90123908351673002@<HONEYPOT>:5060>","Call-ID: EECVplqTik3r5vpD0qwlIY..","CSeq: 1 INVITE","Contact: <sip:%40@179.43.167.3:21440>","User-Agent: TUFAN-PCT-1438","Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, PRACK, SUBSCRIBE, NOTIFY, REFER, MESSA…","Supported: replaces, norefersub, timer, 100rel"],"iocs":{"ips":["179.43.167.3"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-10-06T23:39:58.823738+00:00"}