{"ip":"185.243.5.73","total_events":88,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["88 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 118,152 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"118,152 bytes sent","bytes_sent":118152,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-18T02:00:34","last_seen":"2026-08-17T21:39:59","events_24h":0,"events_7d":82,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":23470,"org":"ReliableSite.Net LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as23470","label":"ReliableSite.Net","category":"cdn","url":"https://www.peeringdb.com/asn/23470"},"cve_matches":[],"malware":[],"top_ports":[{"port":5071,"proto":"tcp","label":"","count":82},{"port":5061,"proto":"tcp","label":"SIPS","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_24695f2957a7","t13d751100_479067518aa3_24695f2957a7","t13d131100_3227a3a3f36e_d41ae481755e"],"tls_ja3":["09410c8b66cfcc5ff3cc833b860ee68e","128ef52818391816ed9b3ece21686a6f"],"ja4h":[]},"fingerprint_peers":{"t13d751100_479067518aa3_24695f2957a7":1,"t13d131100_3227a3a3f36e_d41ae481755e":1,"t13i311000_e8f1e7e78f70_24695f2957a7":521},"user_agents":[],"timeline":[{"date":"2026-08-16","count":19},{"date":"2026-08-17","count":63}],"recent_events":[{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-776ec7a63377;rport\r\nMax-Forwards: 70\r\nFrom: <sip:911@<HONEYPOT>:5071>;tag=3964e3a7\r\nTo: <sip:9011442038072073@<HONEYPOT>:5071>\r\nCall-ID: 400b372e1de1498c81d1c6a8fc06431f\r\nCSeq: 1 INVITE\r\nContact: <sip:911@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025551506@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025551506@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:9011442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:911@<HONEYPOT>:5071>\r\nHistory-Info: <sip:9011442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 911\r\nX-Session-ID: 400b372e1de1498c81d1c6a8fc06431f\r\nX-Correlation-ID: 400b372e1de1498c81d1c6a8fc06431f\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: 400b372e1de1498c81d1c6a8fc06431f\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025551506@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3737366563376136333337373b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a39313140<HONEYPOT>3a353037313e3b7461673d33393634653361370d0a546f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2034303062333732653164653134393863383164316336613866633036343331660d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a39313140<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353135303640<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353135303640<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a39313140<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203931310d0a582d53657373696f6e2d49443a2034303062333732653164653134393863383164316336613866633036343331660d0a582d436f7272656c6174696f6e2d49443a2034303062333732653164653134393863383164316336613866633036343331660d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2034303062333732653164653134393863383164316336613866633036343331660d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353135303640<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"bcae6932-756f-4987-8249-5cc63d83aefd","seq":1,"duration_ms":100,"bytes_in":1712,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"4c46cf4af6f4fc28","label":"SIP","strings":["INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-776ec7a63377;rport","Max-Forwards: 70","From: <sip:911@<HONEYPOT>:5071>;tag=3964e3a7","To: <sip:9011442038072073@<HONEYPOT>:5071>","Call-ID: 400b372e1de1498c81d1c6a8fc06431f","CSeq: 1 INVITE","Contact: <sip:911@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-d5d4facfdb3d;rport\r\nMax-Forwards: 70\r\nFrom: <sip:999@<HONEYPOT>:5071>;tag=32787aa0\r\nTo: <sip:9011442038072073@<HONEYPOT>:5071>\r\nCall-ID: 90425a0682074ceaa260ce48e5ad876f\r\nCSeq: 1 INVITE\r\nContact: <sip:999@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025554161@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025554161@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:9011442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:999@<HONEYPOT>:5071>\r\nHistory-Info: <sip:9011442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 999\r\nX-Session-ID: 90425a0682074ceaa260ce48e5ad876f\r\nX-Correlation-ID: 90425a0682074ceaa260ce48e5ad876f\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: 90425a0682074ceaa260ce48e5ad876f\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025554161@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d6435643466616366646233643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a39393940<HONEYPOT>3a353037313e3b7461673d33323738376161300d0a546f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2039303432356130363832303734636561613236306365343865356164383736660d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a39393940<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353431363140<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353431363140<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a39393940<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203939390d0a582d53657373696f6e2d49443a2039303432356130363832303734636561613236306365343865356164383736660d0a582d436f7272656c6174696f6e2d49443a2039303432356130363832303734636561613236306365343865356164383736660d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2039303432356130363832303734636561613236306365343865356164383736660d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353431363140<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"b079943f-9c59-4e36-87c4-96fba812f39e","seq":1,"duration_ms":100,"bytes_in":1712,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"88907568f0356177","label":"SIP","strings":["INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-d5d4facfdb3d;rport","Max-Forwards: 70","From: <sip:999@<HONEYPOT>:5071>;tag=32787aa0","To: <sip:9011442038072073@<HONEYPOT>:5071>","Call-ID: 90425a0682074ceaa260ce48e5ad876f","CSeq: 1 INVITE","Contact: <sip:999@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:918183091136@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-754087eda4a4;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+442071838750@<HONEYPOT>:5071>;tag=b82873dd\r\nTo: <sip:918183091136@<HONEYPOT>:5071>\r\nCall-ID: fb4b74910d1a47a39fa9ef0ad7147fb4\r\nCSeq: 1 INVITE\r\nContact: <sip:+442071838750@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+442071838750@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+442071838750@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:918183091136@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:+442071838750@<HONEYPOT>:5071>\r\nHistory-Info: <sip:918183091136@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: +442071838750\r\nX-Session-ID: fb4b74910d1a47a39fa9ef0ad7147fb4\r\nX-Correlation-ID: fb4b74910d1a47a39fa9ef0ad7147fb4\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: fb4b74910d1a47a39fa9ef0ad7147fb4\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+442071838750@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39313831383330393131333640<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3735343038376564613461343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e3b7461673d62383238373364640d0a546f3a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2066623462373439313064316134376133396661396566306164373134376662340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a202b3434323037313833383735300d0a582d53657373696f6e2d49443a2066623462373439313064316134376133396661396566306164373134376662340d0a582d436f7272656c6174696f6e2d49443a2066623462373439313064316134376133396661396566306164373134376662340d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2066623462373439313064316134376133396661396566306164373134376662340d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"0969ee70-e81a-4484-b5bf-5541e59975e9","seq":1,"duration_ms":100,"bytes_in":1739,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"44553fe84c7233cf","label":"SIP","strings":["INVITE sip:918183091136@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-754087eda4a4;rport","Max-Forwards: 70","From: <sip:+442071838750@<HONEYPOT>:5071>;tag=b82873dd","To: <sip:918183091136@<HONEYPOT>:5071>","Call-ID: fb4b74910d1a47a39fa9ef0ad7147fb4","CSeq: 1 INVITE","Contact: <sip:+442071838750@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-7182cae2f061;rport\r\nMax-Forwards: 70\r\nFrom: <sip:911@<HONEYPOT>:5071>;tag=79346fca\r\nTo: <sip:442038072073@<HONEYPOT>:5071>\r\nCall-ID: e3f1888c8975440d805a4125ae85d957\r\nCSeq: 1 INVITE\r\nContact: <sip:911@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025559493@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025559493@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:911@<HONEYPOT>:5071>\r\nHistory-Info: <sip:442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 911\r\nX-Session-ID: e3f1888c8975440d805a4125ae85d957\r\nX-Correlation-ID: e3f1888c8975440d805a4125ae85d957\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: e3f1888c8975440d805a4125ae85d957\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025559493@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a34343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3731383263616532663036313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a39313140<HONEYPOT>3a353037313e3b7461673d37393334366663610d0a546f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2065336631383838633839373534343064383035613431323561653835643935370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a39313140<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353934393340<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353934393340<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a39313140<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203931310d0a582d53657373696f6e2d49443a2065336631383838633839373534343064383035613431323561653835643935370d0a582d436f7272656c6174696f6e2d49443a2065336631383838633839373534343064383035613431323561653835643935370d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2065336631383838633839373534343064383035613431323561653835643935370d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353934393340<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"e03019c6-baea-46fe-a5b7-dcd574736df8","seq":1,"duration_ms":100,"bytes_in":1696,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"0bd1f16fef2eecb3","label":"SIP","strings":["INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-7182cae2f061;rport","Max-Forwards: 70","From: <sip:911@<HONEYPOT>:5071>;tag=79346fca","To: <sip:442038072073@<HONEYPOT>:5071>","Call-ID: e3f1888c8975440d805a4125ae85d957","CSeq: 1 INVITE","Contact: <sip:911@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:918183091136@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-e7d84f976ffe;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+33123456789@<HONEYPOT>:5071>;tag=c23c83fd\r\nTo: <sip:918183091136@<HONEYPOT>:5071>\r\nCall-ID: 788e387ab27a44be8445f9818d1b20be\r\nCSeq: 1 INVITE\r\nContact: <sip:+33123456789@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+33123456789@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+33123456789@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:918183091136@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:+33123456789@<HONEYPOT>:5071>\r\nHistory-Info: <sip:918183091136@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: +33123456789\r\nX-Session-ID: 788e387ab27a44be8445f9818d1b20be\r\nX-Correlation-ID: 788e387ab27a44be8445f9818d1b20be\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: 788e387ab27a44be8445f9818d1b20be\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+33123456789@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a39313831383330393131333640<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d6537643834663937366666653b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313e3b7461673d63323363383366640d0a546f3a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2037383865333837616232376134346265383434356639383138643162323062650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a39313831383330393131333640<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a202b33333132333435363738390d0a582d53657373696f6e2d49443a2037383865333837616232376134346265383434356639383138643162323062650d0a582d436f7272656c6174696f6e2d49443a2037383865333837616232376134346265383434356639383138643162323062650d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2037383865333837616232376134346265383434356639383138643162323062650d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b333331323334353637383940<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"67df8484-f452-45e3-808b-872aedea94be","seq":1,"duration_ms":101,"bytes_in":1732,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"e7f9e81f24557a73","label":"SIP","strings":["INVITE sip:918183091136@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-e7d84f976ffe;rport","Max-Forwards: 70","From: <sip:+33123456789@<HONEYPOT>:5071>;tag=c23c83fd","To: <sip:918183091136@<HONEYPOT>:5071>","Call-ID: 788e387ab27a44be8445f9818d1b20be","CSeq: 1 INVITE","Contact: <sip:+33123456789@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:59","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:0018183091136@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-42fe63fb77f5;rport\r\nMax-Forwards: 70\r\nFrom: <sip:112@<HONEYPOT>:5071>;tag=143a88e3\r\nTo: <sip:0018183091136@<HONEYPOT>:5071>\r\nCall-ID: dc9010ff2c3a4a6881c1d8610cd7d9b7\r\nCSeq: 1 INVITE\r\nContact: <sip:112@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025551759@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025551759@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:0018183091136@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:112@<HONEYPOT>:5071>\r\nHistory-Info: <sip:0018183091136@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 112\r\nX-Session-ID: dc9010ff2c3a4a6881c1d8610cd7d9b7\r\nX-Correlation-ID: dc9010ff2c3a4a6881c1d8610cd7d9b7\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: dc9010ff2c3a4a6881c1d8610cd7d9b7\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025551759@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3030313831383330393131333640<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3432666536336662373766353b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a31313240<HONEYPOT>3a353037313e3b7461673d31343361383865330d0a546f3a203c7369703a3030313831383330393131333640<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2064633930313066663263336134613638383163316438363130636437643962370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a31313240<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353137353940<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353137353940<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a3030313831383330393131333640<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a31313240<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a3030313831383330393131333640<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203131320d0a582d53657373696f6e2d49443a2064633930313066663263336134613638383163316438363130636437643962370d0a582d436f7272656c6174696f6e2d49443a2064633930313066663263336134613638383163316438363130636437643962370d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2064633930313066663263336134613638383163316438363130636437643962370d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353137353940<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"45ec94d1-bc0b-41fc-abc1-fdfc98073789","seq":1,"duration_ms":136,"bytes_in":1700,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"a6fc64b158e07441","label":"SIP","strings":["INVITE sip:0018183091136@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-42fe63fb77f5;rport","Max-Forwards: 70","From: <sip:112@<HONEYPOT>:5071>;tag=143a88e3","To: <sip:0018183091136@<HONEYPOT>:5071>","Call-ID: dc9010ff2c3a4a6881c1d8610cd7d9b7","CSeq: 1 INVITE","Contact: <sip:112@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:58","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-8f950796e82e;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+12025550100@<HONEYPOT>:5071>;tag=2c669f5f\r\nTo: <sip:442038072073@<HONEYPOT>:5071>\r\nCall-ID: a611cafa370a451c95a724dd3c0da7e1\r\nCSeq: 1 INVITE\r\nContact: <sip:+12025550100@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025550100@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025550100@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:+12025550100@<HONEYPOT>:5071>\r\nHistory-Info: <sip:442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: +12025550100\r\nX-Session-ID: a611cafa370a451c95a724dd3c0da7e1\r\nX-Correlation-ID: a611cafa370a451c95a724dd3c0da7e1\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: a611cafa370a451c95a724dd3c0da7e1\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025550100@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a34343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3866393530373936653832653b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313e3b7461673d32633636396635660d0a546f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2061363131636166613337306134353163393561373234646433633064613765310d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a202b31323032353535303130300d0a582d53657373696f6e2d49443a2061363131636166613337306134353163393561373234646433633064613765310d0a582d436f7272656c6174696f6e2d49443a2061363131636166613337306134353163393561373234646433633064613765310d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2061363131636166613337306134353163393561373234646433633064613765310d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353031303040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"939801bf-bbb1-4ee9-a9a4-6c47a09b12c2","seq":1,"duration_ms":111,"bytes_in":1732,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"9b48253c8c60ae38","label":"SIP","strings":["INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-8f950796e82e;rport","Max-Forwards: 70","From: <sip:+12025550100@<HONEYPOT>:5071>;tag=2c669f5f","To: <sip:442038072073@<HONEYPOT>:5071>","Call-ID: a611cafa370a451c95a724dd3c0da7e1","CSeq: 1 INVITE","Contact: <sip:+12025550100@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:58","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-494977ff351f;rport\r\nMax-Forwards: 70\r\nFrom: <sip:112@<HONEYPOT>:5071>;tag=a5782d2c\r\nTo: <sip:442038072073@<HONEYPOT>:5071>\r\nCall-ID: 4e6cda05f58d45b58cc9303d39c1599e\r\nCSeq: 1 INVITE\r\nContact: <sip:112@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025559373@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025559373@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:112@<HONEYPOT>:5071>\r\nHistory-Info: <sip:442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 112\r\nX-Session-ID: 4e6cda05f58d45b58cc9303d39c1599e\r\nX-Correlation-ID: 4e6cda05f58d45b58cc9303d39c1599e\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: 4e6cda05f58d45b58cc9303d39c1599e\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025559373@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a34343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3439343937376666333531663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a31313240<HONEYPOT>3a353037313e3b7461673d61353738326432630d0a546f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2034653663646130356635386434356235386363393330336433396331353939650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a31313240<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353933373340<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353933373340<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a31313240<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a34343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203131320d0a582d53657373696f6e2d49443a2034653663646130356635386434356235386363393330336433396331353939650d0a582d436f7272656c6174696f6e2d49443a2034653663646130356635386434356235386363393330336433396331353939650d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2034653663646130356635386434356235386363393330336433396331353939650d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353933373340<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"906b9143-112e-4472-bd53-703569f20117","seq":1,"duration_ms":100,"bytes_in":1696,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"528ce9b02a14fd29","label":"SIP","strings":["INVITE sip:442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-494977ff351f;rport","Max-Forwards: 70","From: <sip:112@<HONEYPOT>:5071>;tag=a5782d2c","To: <sip:442038072073@<HONEYPOT>:5071>","Call-ID: 4e6cda05f58d45b58cc9303d39c1599e","CSeq: 1 INVITE","Contact: <sip:112@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:58","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:18183091136@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-338e81c380b9;rport\r\nMax-Forwards: 70\r\nFrom: <sip:+442071838750@<HONEYPOT>:5071>;tag=a2c2b0f7\r\nTo: <sip:18183091136@<HONEYPOT>:5071>\r\nCall-ID: f180c4ee56ba44ff9e174c701f913386\r\nCSeq: 1 INVITE\r\nContact: <sip:+442071838750@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+442071838750@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+442071838750@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:18183091136@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:+442071838750@<HONEYPOT>:5071>\r\nHistory-Info: <sip:18183091136@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: +442071838750\r\nX-Session-ID: f180c4ee56ba44ff9e174c701f913386\r\nX-Correlation-ID: f180c4ee56ba44ff9e174c701f913386\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: f180c4ee56ba44ff9e174c701f913386\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+442071838750@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a313831383330393131333640<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3333386538316333383062393b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e3b7461673d61326332623066370d0a546f3a203c7369703a313831383330393131333640<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2066313830633465653536626134346666396531373463373031663931333338360d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a313831383330393131333640<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a313831383330393131333640<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a202b3434323037313833383735300d0a582d53657373696f6e2d49443a2066313830633465653536626134346666396531373463373031663931333338360d0a582d436f7272656c6174696f6e2d49443a2066313830633465653536626134346666396531373463373031663931333338360d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2066313830633465653536626134346666396531373463373031663931333338360d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b34343230373138333837353040<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"315c8fc9-8869-4389-8726-3561717b7885","seq":1,"duration_ms":100,"bytes_in":1735,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"3a9fff2af2e90eba","label":"SIP","strings":["INVITE sip:18183091136@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-338e81c380b9;rport","Max-Forwards: 70","From: <sip:+442071838750@<HONEYPOT>:5071>;tag=a2c2b0f7","To: <sip:18183091136@<HONEYPOT>:5071>","Call-ID: f180c4ee56ba44ff9e174c701f913386","CSeq: 1 INVITE","Contact: <sip:+442071838750@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}},{"timestamp":"2026-08-17T21:39:58","port":5071,"proto":"tcp","app_proto":"tls","app_protocol":"sip","host":"","headers":"","body":"","sni":"<HONEYPOT>:5071","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0\r\nVia: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-737ac800686e;rport\r\nMax-Forwards: 70\r\nFrom: <sip:100@<HONEYPOT>:5071>;tag=52c76a3a\r\nTo: <sip:9011442038072073@<HONEYPOT>:5071>\r\nCall-ID: efc4e4d6711d4cd4b5c0e2563665641e\r\nCSeq: 1 INVITE\r\nContact: <sip:100@<HONEYPOT>:5071>\r\nUser-Agent: Cisco\r\nSupported: replaces, timer, path\r\nAllow: INVITE, ACK, CANCEL, BYE, REFER, OPTIONS, NOTIFY\r\nDiversion: <sip:911@<HONEYPOT>:5071>;reason=unconditional\r\nP-Charge-Info: <sip:premium@<HONEYPOT>:5071>\r\nP-Asserted-Identity: <sip:+12025559236@<HONEYPOT>:5071;user=phone>\r\nRemote-Party-ID: <sip:+12025559236@<HONEYPOT>:5071>;party=calling;screen=yes;privacy=off\r\nPrivacy: none\r\nP-Called-Party-ID: <sip:9011442038072073@<HONEYPOT>:5071>\r\nSession-Expires: 1800;refresher=uac\r\nMin-SE: 90\r\nX-Forwarded-For: 127.0.0.1, 10.0.0.1, 192.168.1.1\r\nX-Cisco-BB: true\r\nX-PBX-Info: internal\r\nX-Client-IP: 127.0.0.1\r\nX-Original-IP: 10.0.0.1\r\nX-Device-IP: 192.168.0.1\r\nX-Auth-User: admin\r\nX-Authenticated-User: true\r\nX-Preferred-Identity: <sip:100@<HONEYPOT>:5071>\r\nHistory-Info: <sip:9011442038072073@<HONEYPOT>:5071>;index=1\r\nRecord-Route: <sip:<HONEYPOT>:5071;lr>\r\nX-From-User: 100\r\nX-Session-ID: efc4e4d6711d4cd4b5c0e2563665641e\r\nX-Correlation-ID: efc4e4d6711d4cd4b5c0e2563665641e\r\nX-Requested-With: SIP\r\nX-Forwarded-Proto: TLS\r\nX-Network-Info: internal\r\nX-Source-IP: 10.10.0.1\r\nX-Attestation: A\r\nX-Call-ID: efc4e4d6711d4cd4b5c0e2563665641e\r\nX-Originating-IP: 10.20.30.1\r\nX-Trunk-Info: primary\r\nX-Policy: bypass\r\nX-SBC-Function: passthrough\r\nP-Preferred-Identity: <sip:+12025559236@<HONEYPOT>:5071;user=phone>\r\nContent-Length: 0\r\n\r\n","payload_hex":"494e56495445207369703a3930313134343230333830373230373340<HONEYPOT>3a35303731205349502f322e300d0a5669613a205349502f322e302f544c532d4d4120<HONEYPOT>3a353037313b6272616e63683d7a39684734624b2d3733376163383030363836653b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a31303040<HONEYPOT>3a353037313e3b7461673d35326337366133610d0a546f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a43616c6c2d49443a2065666334653464363731316434636434623563306532353633363635363431650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a31303040<HONEYPOT>3a353037313e0d0a557365722d4167656e743a20436973636f0d0a537570706f727465643a207265706c616365732c2074696d65722c20706174680d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204259452c2052454645522c204f5054494f4e532c204e4f544946590d0a446976657273696f6e3a203c7369703a39313140<HONEYPOT>3a353037313e3b726561736f6e3d756e636f6e646974696f6e616c0d0a502d4368617267652d496e666f3a203c7369703a7072656d69756d40<HONEYPOT>3a353037313e0d0a502d41737365727465642d4964656e746974793a203c7369703a2b313230323535353932333640<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a52656d6f74652d50617274792d49443a203c7369703a2b313230323535353932333640<HONEYPOT>3a353037313e3b70617274793d63616c6c696e673b73637265656e3d7965733b707269766163793d6f66660d0a507269766163793a206e6f6e650d0a502d43616c6c65642d50617274792d49443a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e0d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a4d696e2d53453a2039300d0a582d466f727761726465642d466f723a203132372e302e302e312c2031302e302e302e312c203139322e3136382e312e310d0a582d436973636f2d42423a20747275650d0a582d5042582d496e666f3a20696e7465726e616c0d0a582d436c69656e742d49503a203132372e302e302e310d0a582d4f726967696e616c2d49503a2031302e302e302e310d0a582d4465766963652d49503a203139322e3136382e302e310d0a582d417574682d557365723a2061646d696e0d0a582d41757468656e746963617465642d557365723a20747275650d0a582d5072656665727265642d4964656e746974793a203c7369703a31303040<HONEYPOT>3a353037313e0d0a486973746f72792d496e666f3a203c7369703a3930313134343230333830373230373340<HONEYPOT>3a353037313e3b696e6465783d310d0a5265636f72642d526f7574653a203c7369703a<HONEYPOT>3a353037313b6c723e0d0a582d46726f6d2d557365723a203130300d0a582d53657373696f6e2d49443a2065666334653464363731316434636434623563306532353633363635363431650d0a582d436f7272656c6174696f6e2d49443a2065666334653464363731316434636434623563306532353633363635363431650d0a582d5265717565737465642d576974683a205349500d0a582d466f727761726465642d50726f746f3a20544c530d0a582d4e6574776f726b2d496e666f3a20696e7465726e616c0d0a582d536f757263652d49503a2031302e31302e302e310d0a582d4174746573746174696f6e3a20410d0a582d43616c6c2d49443a2065666334653464363731316434636434623563306532353633363635363431650d0a582d4f726967696e6174696e672d49503a2031302e32302e33302e310d0a582d5472756e6b2d496e666f3a207072696d6172790d0a582d506f6c6963793a206279706173730d0a582d5342432d46756e6374696f6e3a20706173737468726f7567680d0a502d5072656665727265642d4964656e746974793a203c7369703a2b313230323535353932333640<HONEYPOT>3a353037313b757365723d70686f6e653e0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"09410c8b66cfcc5ff3cc833b860ee68e","session":"e08e54c9-bc26-4b8b-956e-698fe409f605","seq":1,"duration_ms":100,"bytes_in":1712,"bytes_out":12,"client_cert":{"subject":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","issuer":"CN=titan-client,O=Titan Omni,L=San Jose,ST=California,C=US","not_before":"2026-07-23T18:15:06Z","not_after":"2027-07-23T18:15:06Z"},"enriched":{"digest":"c3a6f2f8c043402f","label":"SIP","strings":["INVITE sip:9011442038072073@<HONEYPOT>:5071 SIP/2.0","Via: SIP/2.0/TLS-MA <HONEYPOT>:5071;branch=z9hG4bK-737ac800686e;rport","Max-Forwards: 70","From: <sip:100@<HONEYPOT>:5071>;tag=52c76a3a","To: <sip:9011442038072073@<HONEYPOT>:5071>","Call-ID: efc4e4d6711d4cd4b5c0e2563665641e","CSeq: 1 INVITE","Contact: <sip:100@<HONEYPOT>:5071>","User-Agent: Cisco","Supported: replaces, timer, path"],"iocs":{"paths":["/2.0/TLS-MA"]}}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[{"value":"<HONEYPOT>:5071","count":72}],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-20T18:20:22.892708+00:00"}