{"ip":"190.211.252.4","data_as_of":"2026-10-24T06:56:09+00:00","observed":true,"total_events":1069,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 loader / command-injection payload(s)","confidence":"high","network_type":"network service provider","why":["1 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 1,163,869 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,163,869 bytes sent","bytes_sent":1163869,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-04T04:41:34","last_seen":"2026-10-12T04:07:04","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3643,"lon":8.5437,"asn":51852,"org":"Private Layer INC"},"source_domain":"hostedby.privatelayer.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as51852","label":"Phase Layer Global Networks","category":"isp","url":"https://www.peeringdb.com/asn/51852"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2269,"protocols":[{"protocol":"udp","events":2269}],"ports":[{"port":5080,"events":10},{"port":25565,"events":7},{"port":506,"events":7},{"port":58983,"events":6},{"port":16179,"events":6},{"port":11431,"events":6},{"port":7680,"events":6},{"port":5162,"events":6},{"port":2019,"events":6},{"port":1000,"events":6}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-12T05:27:01","last_seen":"2026-10-21T20:45:10","recent":[{"timestamp":"2026-10-21T20:45:10","port":6362,"src_port":34173,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:34173;branch=z9hG4bK1acba60b2ade5325;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>18da9b019c69\r\nTo: <sip:+3908351673002@<HONEYPOT>:6362>\r\nCall-ID: 360ff29f02ba8233c67dbeab53ca63de\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:34173;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363336323b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a33343137333b6272616e63683d7a39684734624b316163626136306232616465353332353b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3138646139623031396336390d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363336323e0d0a43616c6c2d49443a2033363066663239663032626138323333633637646265616235336361363364650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a33343137333b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"f092ac3d-c404-4291-be90-642291864d4c","bytes_in":937,"source_verified":false,"enriched":{"digest":"00bd1a2753accb68","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:34173;branch=z9hG4bK1acba60b2ade5325;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>18da9b019c69","To: <sip:+3908351673002@<HONEYPOT>:6362>","Call-ID: 360ff29f02ba8233c67dbeab53ca63de","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:34173;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:44:57","port":6362,"src_port":5692,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:5692;branch=z9hG4bKadcdd57c00da26df;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>18dad84c00f6\r\nTo: <sip:+3908351673002@<HONEYPOT>:6362>\r\nCall-ID: 2c3cbe95e2524753088b08c5d5512f10\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:5692;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363336323b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a353639323b6272616e63683d7a39684734624b616463646435376330306461323664663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3138646164383463303066360d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363336323e0d0a43616c6c2d49443a2032633363626539356532353234373533303838623038633564353531326631300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a353639323b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"28c1f38b-cfbb-4f53-b015-5e84c0e6088f","bytes_in":927,"source_verified":false,"enriched":{"digest":"5da1fd4f618f63e4","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:5692;branch=z9hG4bKadcdd57c00da26df;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>18dad84c00f6","To: <sip:+3908351673002@<HONEYPOT>:6362>","Call-ID: 2c3cbe95e2524753088b08c5d5512f10","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:5692;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:43:20","port":6362,"src_port":4992,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:4992;branch=z9hG4bK6460d77be5a81e03;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>18dafe6cb33a\r\nTo: <sip:+3908351673002@<HONEYPOT>:6362>\r\nCall-ID: 0af5c8060616b98f3542612938424e4e\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:4992;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363336323b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a343939323b6272616e63683d7a39684734624b363436306437376265356138316530333b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3138646166653663623333610d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363336323e0d0a43616c6c2d49443a2030616635633830363036313662393866333534323631323933383432346534650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a343939323b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"01b06d21-1ce3-4d14-ac6e-8cb6dcc1beb6","bytes_in":916,"source_verified":false,"enriched":{"digest":"87e4cc61327ea05e","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6362;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:4992;branch=z9hG4bK6460d77be5a81e03;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>18dafe6cb33a","To: <sip:+3908351673002@<HONEYPOT>:6362>","Call-ID: 0af5c8060616b98f3542612938424e4e","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:4992;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:32:26","port":6463,"src_port":31294,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:31294;branch=z9hG4bK6b98bf9c4f1e0c5b;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>193fcd91e0f6\r\nTo: <sip:+3908351673002@<HONEYPOT>:6463>\r\nCall-ID: c0215b7008fc9f5c06d44b88bf4c5909\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:31294;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363436333b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a33313239343b6272616e63683d7a39684734624b366239386266396334663165306335623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3139336663643931653066360d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363436333e0d0a43616c6c2d49443a2063303231356237303038666339663563303664343462383862663463353930390d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a33313239343b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"34008d0e-fd4e-45f2-b582-7825e1c77b3b","bytes_in":929,"source_verified":false,"enriched":{"digest":"8fee1cabc340b385","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:31294;branch=z9hG4bK6b98bf9c4f1e0c5b;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>193fcd91e0f6","To: <sip:+3908351673002@<HONEYPOT>:6463>","Call-ID: c0215b7008fc9f5c06d44b88bf4c5909","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:31294;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:32:14","port":6463,"src_port":31294,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:31294;branch=z9hG4bK175332e5e77f48bf;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>193f6ccddfb1\r\nTo: <sip:+3908351673002@<HONEYPOT>:6463>\r\nCall-ID: 6a81eb51153df074f371a9bc43d35e94\r\nCSeq: 1 INVITE\r\nContact: <sip:15727172282@190.211.252.4:31294;transport=UDP>\r\nUser-Agent: sipcli/v1.8\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11006 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363436333b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a33313239343b6272616e63683d7a39684734624b313735333332653565373766343862663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323731373232383240<HONEYPOT>3e3b7461673d<HONEYPOT>3139336636636364646662310d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363436333e0d0a43616c6c2d49443a2036613831656235313135336466303734663337316139626334336433356539340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237313732323832403139302e3231312e3235322e343a33313239343b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20736970636c692f76312e380d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303036205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"78e39499-66d1-4dc3-85a2-154c4ef170d7","bytes_in":910,"source_verified":false,"enriched":{"digest":"f16e7184468f5aa8","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:31294;branch=z9hG4bK175332e5e77f48bf;rport","Max-Forwards: 70","From: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>193f6ccddfb1","To: <sip:+3908351673002@<HONEYPOT>:6463>","Call-ID: 6a81eb51153df074f371a9bc43d35e94","CSeq: 1 INVITE","Contact: <sip:15727172282@190.211.252.4:31294;transport=UDP>","User-Agent: sipcli/v1.8","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:30:47","port":6463,"src_port":53626,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:53626;branch=z9hG4bK4ee3a2caeb3c3784;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>193fe6c685c7\r\nTo: <sip:+3908351673002@<HONEYPOT>:6463>\r\nCall-ID: cf97b49e307bc4ab1de1f956f199dd7e\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:53626;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363436333b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a35333632363b6272616e63683d7a39684734624b346565336132636165623363333738343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3139336665366336383563370d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363436333e0d0a43616c6c2d49443a2063663937623439653330376263346162316465316639353666313939646437650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a35333632363b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"0bedced5-bf77-4d61-b9fc-6b962d5ab41d","bytes_in":918,"source_verified":false,"enriched":{"digest":"c45464332c606d62","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6463;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:53626;branch=z9hG4bK4ee3a2caeb3c3784;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>193fe6c685c7","To: <sip:+3908351673002@<HONEYPOT>:6463>","Call-ID: cf97b49e307bc4ab1de1f956f199dd7e","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:53626;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:20:13","port":6564,"src_port":4121,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6564;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:4121;branch=z9hG4bKb709da7c5231649d;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>19a4688efcf9\r\nTo: <sip:+3908351673002@<HONEYPOT>:6564>\r\nCall-ID: d7e5ffb4d6494712330fb6210cdc1c47\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:4121;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363536343b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a343132313b6272616e63683d7a39684734624b623730396461376335323331363439643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3139613436383865666366390d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363536343e0d0a43616c6c2d49443a2064376535666662346436343934373132333330666236323130636463316334370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a343132313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"ca52082b-090f-4522-97b9-4c59ab55baaf","bytes_in":935,"source_verified":false,"enriched":{"digest":"a54744ff63480916","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6564;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:4121;branch=z9hG4bKb709da7c5231649d;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>19a4688efcf9","To: <sip:+3908351673002@<HONEYPOT>:6564>","Call-ID: d7e5ffb4d6494712330fb6210cdc1c47","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:4121;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:18:20","port":6564,"src_port":41776,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6564;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:41776;branch=z9hG4bKadea65e0f1916f81;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>19a47212bf2a\r\nTo: <sip:+3908351673002@<HONEYPOT>:6564>\r\nCall-ID: 00d9f26831fefd9ba702f40d7f438aee\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:41776;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363536343b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a34313737363b6272616e63683d7a39684734624b616465613635653066313931366638313b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3139613437323132626632610d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363536343e0d0a43616c6c2d49443a2030306439663236383331666566643962613730326634306437663433386165650d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a34313737363b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"8311106f-4f8c-4c6e-a45b-aa46b7e2e301","bytes_in":918,"source_verified":false,"enriched":{"digest":"28324f9ac7e1cb06","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6564;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:41776;branch=z9hG4bKadea65e0f1916f81;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>19a47212bf2a","To: <sip:+3908351673002@<HONEYPOT>:6564>","Call-ID: 00d9f26831fefd9ba702f40d7f438aee","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:41776;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:07:21","port":6766,"src_port":52344,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:52344;branch=z9hG4bK9c1c4f5d7d9c91e3;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1a6e5aa1ee80\r\nTo: <sip:+3908351673002@<HONEYPOT>:6766>\r\nCall-ID: 5a9239c4e6344d771c97a5ae8d00c540\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:52344;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363736363b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a35323334343b6272616e63683d7a39684734624b396331633466356437643963393165333b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3161366535616131656538300d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363736363e0d0a43616c6c2d49443a2035613932333963346536333434643737316339376135616538643030633534300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a35323334343b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"e24a2603-3d77-4438-9023-b084f4d6e032","bytes_in":929,"source_verified":false,"enriched":{"digest":"d0b67d0a05c14ac9","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:52344;branch=z9hG4bK9c1c4f5d7d9c91e3;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1a6e5aa1ee80","To: <sip:+3908351673002@<HONEYPOT>:6766>","Call-ID: 5a9239c4e6344d771c97a5ae8d00c540","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:52344;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:07:09","port":6766,"src_port":52344,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:52344;branch=z9hG4bK6d43c4e292894ff8;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1a6ebe9659d0\r\nTo: <sip:+3908351673002@<HONEYPOT>:6766>\r\nCall-ID: 895b63873c20d3380a78b61fc1c1751c\r\nCSeq: 1 INVITE\r\nContact: <sip:15727172282@190.211.252.4:52344;transport=UDP>\r\nUser-Agent: sipcli/v1.8\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11006 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363736363b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a35323334343b6272616e63683d7a39684734624b366434336334653239323839346666383b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323731373232383240<HONEYPOT>3e3b7461673d<HONEYPOT>3161366562653936353964300d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363736363e0d0a43616c6c2d49443a2038393562363338373363323064333338306137386236316663316331373531630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237313732323832403139302e3231312e3235322e343a35323334343b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20736970636c692f76312e380d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303036205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"a57797dd-7deb-4700-a492-cc2030041f08","bytes_in":910,"source_verified":false,"enriched":{"digest":"b7fe5d4d4cacb86d","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:52344;branch=z9hG4bK6d43c4e292894ff8;rport","Max-Forwards: 70","From: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1a6ebe9659d0","To: <sip:+3908351673002@<HONEYPOT>:6766>","Call-ID: 895b63873c20d3380a78b61fc1c1751c","CSeq: 1 INVITE","Contact: <sip:15727172282@190.211.252.4:52344;transport=UDP>","User-Agent: sipcli/v1.8","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T20:05:45","port":6766,"src_port":13401,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:13401;branch=z9hG4bK5f4c3cbe9176f90c;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1a6eb91fa098\r\nTo: <sip:+3908351673002@<HONEYPOT>:6766>\r\nCall-ID: 1c16e429b73b31c5fd4f308d739de49f\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:13401;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363736363b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a31333430313b6272616e63683d7a39684734624b356634633363626539313736663930633b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3161366562393166613039380d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363736363e0d0a43616c6c2d49443a2031633136653432396237336233316335666434663330386437333964653439660d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a31333430313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"b2f9d720-d000-4e4b-aaa9-bfab97d1008e","bytes_in":918,"source_verified":false,"enriched":{"digest":"db32f4cace4bc050","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6766;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:13401;branch=z9hG4bK5f4c3cbe9176f90c;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1a6eb91fa098","To: <sip:+3908351673002@<HONEYPOT>:6766>","Call-ID: 1c16e429b73b31c5fd4f308d739de49f","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:13401;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:55:17","port":6867,"src_port":25241,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6867;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:25241;branch=z9hG4bKdc1d599dd578c0ad;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1ad347eb07f9\r\nTo: <sip:+3908351673002@<HONEYPOT>:6867>\r\nCall-ID: d1aff156cae4f066f6f4a3d50678ce2f\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:25241;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363836373b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32353234313b6272616e63683d7a39684734624b646331643539396464353738633061643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3161643334376562303766390d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363836373e0d0a43616c6c2d49443a2064316166663135366361653466303636663666346133643530363738636532660d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a32353234313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"d70bc277-ee4a-48c5-961f-67319b79174d","bytes_in":937,"source_verified":false,"enriched":{"digest":"3721165755ed973b","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6867;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:25241;branch=z9hG4bKdc1d599dd578c0ad;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1ad347eb07f9","To: <sip:+3908351673002@<HONEYPOT>:6867>","Call-ID: d1aff156cae4f066f6f4a3d50678ce2f","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:25241;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:55:05","port":6867,"src_port":21499,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6867;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:21499;branch=z9hG4bK8a7f74c8e65b974d;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1ad35c5875cf\r\nTo: <sip:+3908351673002@<HONEYPOT>:6867>\r\nCall-ID: 0b2b8a81d716b1256a69d90ec315140c\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:21499;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363836373b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32313439393b6272616e63683d7a39684734624b386137663734633865363562393734643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3161643335633538373563660d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363836373e0d0a43616c6c2d49443a2030623262386138316437313662313235366136396439306563333135313430630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a32313439393b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"1a2659ad-ff70-4939-bc93-aca2bd939293","bytes_in":929,"source_verified":false,"enriched":{"digest":"39b1f22fc96d90ae","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6867;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:21499;branch=z9hG4bK8a7f74c8e65b974d;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1ad35c5875cf","To: <sip:+3908351673002@<HONEYPOT>:6867>","Call-ID: 0b2b8a81d716b1256a69d90ec315140c","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:21499;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:42:51","port":6968,"src_port":33007,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:33007;branch=z9hG4bK21f1b555bdc23c63;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1b3827793bdc\r\nTo: <sip:+3908351673002@<HONEYPOT>:6968>\r\nCall-ID: 34617a4161152c2b6eb2eb2fddc4e077\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:33007;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363936383b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a33333030373b6272616e63683d7a39684734624b323166316235353562646332336336333b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3162333832373739336264630d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363936383e0d0a43616c6c2d49443a2033343631376134313631313532633262366562326562326664646334653037370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a33333030373b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"8661b46a-492b-458c-9fb3-d40eacae3206","bytes_in":937,"source_verified":false,"enriched":{"digest":"fee536447e6f7d26","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:33007;branch=z9hG4bK21f1b555bdc23c63;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1b3827793bdc","To: <sip:+3908351673002@<HONEYPOT>:6968>","Call-ID: 34617a4161152c2b6eb2eb2fddc4e077","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:33007;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:42:34","port":6968,"src_port":54090,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:54090;branch=z9hG4bK2a0a7e4257960dc6;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1b38490c0fea\r\nTo: <sip:+3908351673002@<HONEYPOT>:6968>\r\nCall-ID: 72d8bfb7674ba0f1fa2eda709c4455d2\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:54090;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363936383b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a35343039303b6272616e63683d7a39684734624b326130613765343235373936306463363b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3162333834393063306665610d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363936383e0d0a43616c6c2d49443a2037326438626662373637346261306631666132656461373039633434353564320d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a35343039303b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"5b5594ea-23a3-41b4-b1a4-a9a4d487a31e","bytes_in":929,"source_verified":false,"enriched":{"digest":"00c47bfc523ca472","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:54090;branch=z9hG4bK2a0a7e4257960dc6;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1b38490c0fea","To: <sip:+3908351673002@<HONEYPOT>:6968>","Call-ID: 72d8bfb7674ba0f1fa2eda709c4455d2","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:54090;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:42:21","port":6968,"src_port":54090,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:54090;branch=z9hG4bK2f3de26b6b07797f;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1b3814071e14\r\nTo: <sip:+3908351673002@<HONEYPOT>:6968>\r\nCall-ID: d7a0de93f7b6dfaff815b1317f866804\r\nCSeq: 1 INVITE\r\nContact: <sip:15727172282@190.211.252.4:54090;transport=UDP>\r\nUser-Agent: sipcli/v1.8\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11006 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363936383b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a35343039303b6272616e63683d7a39684734624b326633646532366236623037373937663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323731373232383240<HONEYPOT>3e3b7461673d<HONEYPOT>3162333831343037316531340d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363936383e0d0a43616c6c2d49443a2064376130646539336637623664666166663831356231333137663836363830340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237313732323832403139302e3231312e3235322e343a35343039303b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20736970636c692f76312e380d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303036205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"2d947e3d-1659-494c-9db6-fd290a1851ce","bytes_in":910,"source_verified":false,"enriched":{"digest":"3e6548eddae2c332","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:54090;branch=z9hG4bK2f3de26b6b07797f;rport","Max-Forwards: 70","From: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1b3814071e14","To: <sip:+3908351673002@<HONEYPOT>:6968>","Call-ID: d7a0de93f7b6dfaff815b1317f866804","CSeq: 1 INVITE","Contact: <sip:15727172282@190.211.252.4:54090;transport=UDP>","User-Agent: sipcli/v1.8","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:40:59","port":6968,"src_port":2815,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:2815;branch=z9hG4bK9c9ac304a172784b;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1b3820dbd3d8\r\nTo: <sip:+3908351673002@<HONEYPOT>:6968>\r\nCall-ID: 2911036d14a740eba8519a080185fba9\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:2815;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363936383b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a323831353b6272616e63683d7a39684734624b396339616333303461313732373834623b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3162333832306462643364380d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363936383e0d0a43616c6c2d49443a2032393131303336643134613734306562613835313961303830313835666261390d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a323831353b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"81c9238b-37bb-4f74-8346-5d029209331a","bytes_in":916,"source_verified":false,"enriched":{"digest":"7383712b61edd6ab","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6968;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:2815;branch=z9hG4bK9c9ac304a172784b;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1b3820dbd3d8","To: <sip:+3908351673002@<HONEYPOT>:6968>","Call-ID: 2911036d14a740eba8519a080185fba9","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:2815;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:30:24","port":7069,"src_port":49354,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:7069;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:49354;branch=z9hG4bK3db5655a87df62dd;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1b9d744787cb\r\nTo: <sip:+3908351673002@<HONEYPOT>:7069>\r\nCall-ID: 4a9d3cb1a412df60ff783827ffaa5e7b\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:49354;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a373036393b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a34393335343b6272616e63683d7a39684734624b336462353635356138376466363264643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3162396437343437383763620d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a373036393e0d0a43616c6c2d49443a2034613964336362316134313264663630666637383338323766666161356537620d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a34393335343b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"493d0470-d048-432b-951c-8a935233cd64","bytes_in":937,"source_verified":false,"enriched":{"digest":"c602e31280e20270","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:7069;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:49354;branch=z9hG4bK3db5655a87df62dd;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1b9d744787cb","To: <sip:+3908351673002@<HONEYPOT>:7069>","Call-ID: 4a9d3cb1a412df60ff783827ffaa5e7b","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:49354;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:28:30","port":7069,"src_port":61846,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:7069;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:61846;branch=z9hG4bKd95bf45dbbffa36f;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1b9dd676e94b\r\nTo: <sip:+3908351673002@<HONEYPOT>:7069>\r\nCall-ID: f3d96ea193e8beaa9e273341d0742cd2\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:61846;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a373036393b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a36313834363b6272616e63683d7a39684734624b643935626634356462626666613336663b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3162396464363736653934620d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a373036393e0d0a43616c6c2d49443a2066336439366561313933653862656161396532373333343164303734326364320d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a36313834363b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"99d51dda-6471-4132-8f86-aba2cc134cea","bytes_in":918,"source_verified":false,"enriched":{"digest":"7ecb9ea52bc8f9e3","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:7069;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:61846;branch=z9hG4bKd95bf45dbbffa36f;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1b9dd676e94b","To: <sip:+3908351673002@<HONEYPOT>:7069>","Call-ID: f3d96ea193e8beaa9e273341d0742cd2","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:61846;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:17:54","port":6869,"src_port":24931,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:24931;branch=z9hG4bKa1da17232c9a6aaa;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1ad5e1fbb640\r\nTo: <sip:+3908351673002@<HONEYPOT>:6869>\r\nCall-ID: c4be71ce8be2c185db209eebbcde1640\r\nCSeq: 1 INVITE\r\nContact: <sip:15825953881@190.211.252.4:24931;transport=UDP>\r\nUser-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11075 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363836393b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32343933313b6272616e63683d7a39684734624b613164613137323332633961366161613b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313538323539353338383140<HONEYPOT>3e3b7461673d<HONEYPOT>3161643565316662623634300d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363836393e0d0a43616c6c2d49443a2063346265373163653862653263313835646232303965656262636465313634300d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135383235393533383831403139302e3231312e3235322e343a32343933313b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20506f6c79636f6d5656582f352e392e372e3334383020506f6c79636f6d5553422f302e302e310d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303735205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"099e63dd-b155-47d7-ac6b-28c6407a35c5","bytes_in":937,"source_verified":false,"enriched":{"digest":"1e610c0b47f68bba","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:24931;branch=z9hG4bKa1da17232c9a6aaa;rport","Max-Forwards: 70","From: <sip:15825953881@<HONEYPOT>>;tag=<HONEYPOT>1ad5e1fbb640","To: <sip:+3908351673002@<HONEYPOT>:6869>","Call-ID: c4be71ce8be2c185db209eebbcde1640","CSeq: 1 INVITE","Contact: <sip:15825953881@190.211.252.4:24931;transport=UDP>","User-Agent: PolycomVVX/5.9.7.3480 PolycomUSB/0.0.1","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:17:25","port":6869,"src_port":29289,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:29289;branch=z9hG4bK0c217baaea358d68;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1ad523fe0bad\r\nTo: <sip:+3908351673002@<HONEYPOT>:6869>\r\nCall-ID: 11c6091067b0c1386ab55812fd477084\r\nCSeq: 1 INVITE\r\nContact: <sip:15727172282@190.211.252.4:29289;transport=UDP>\r\nUser-Agent: sipcli/v1.8\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 11006 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363836393b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32393238393b6272616e63683d7a39684734624b306332313762616165613335386436383b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323731373232383240<HONEYPOT>3e3b7461673d<HONEYPOT>3161643532336665306261640d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363836393e0d0a43616c6c2d49443a2031316336303931303637623063313338366162353538313266643437373038340d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237313732323832403139302e3231312e3235322e343a32393238393b7472616e73706f72743d5544503e0d0a557365722d4167656e743a20736970636c692f76312e380d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203131303036205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"51af32c7-5a1d-499e-80f3-fe734f705576","bytes_in":910,"source_verified":false,"enriched":{"digest":"66a1ea6d06b2f25e","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:29289;branch=z9hG4bK0c217baaea358d68;rport","Max-Forwards: 70","From: <sip:15727172282@<HONEYPOT>>;tag=<HONEYPOT>1ad523fe0bad","To: <sip:+3908351673002@<HONEYPOT>:6869>","Call-ID: 11c6091067b0c1386ab55812fd477084","CSeq: 1 INVITE","Contact: <sip:15727172282@190.211.252.4:29289;transport=UDP>","User-Agent: sipcli/v1.8","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:16:01","port":6869,"src_port":15616,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:15616;branch=z9hG4bKd19528770d60e6ad;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1ad555cadfc4\r\nTo: <sip:+3908351673002@<HONEYPOT>:6869>\r\nCall-ID: 9fba60bb7f2393df69120bfc4ec4c397\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:15616;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363836393b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a31353631363b6272616e63683d7a39684734624b643139353238373730643630653661643b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3161643535356361646663340d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363836393e0d0a43616c6c2d49443a2039666261363062623766323339336466363931323062666334656334633339370d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a31353631363b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"eb84bc5e-be62-4f6a-98e2-945e42dcb086","bytes_in":918,"source_verified":false,"enriched":{"digest":"455c113091b1c9bc","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6869;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:15616;branch=z9hG4bKd19528770d60e6ad;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>1ad555cadfc4","To: <sip:+3908351673002@<HONEYPOT>:6869>","Call-ID: 9fba60bb7f2393df69120bfc4ec4c397","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:15616;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T19:05:10","port":6768,"src_port":37597,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6768;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:37597;branch=z9hG4bK755141037b883ab4;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1a7044b8dd62\r\nTo: <sip:+3908351673002@<HONEYPOT>:6768>\r\nCall-ID: 71d6506480c45c90a80f9a6603807cfb\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:37597;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363736383b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a33373539373b6272616e63683d7a39684734624b373535313431303337623838336162343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3161373034346238646436320d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363736383e0d0a43616c6c2d49443a2037316436353036343830633435633930613830663961363630333830376366620d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a33373539373b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"bf42384e-fe95-4114-9a70-8a38c8af442e","bytes_in":929,"source_verified":false,"enriched":{"digest":"0d46566ff45b8ad5","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6768;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:37597;branch=z9hG4bK755141037b883ab4;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>1a7044b8dd62","To: <sip:+3908351673002@<HONEYPOT>:6768>","Call-ID: 71d6506480c45c90a80f9a6603807cfb","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:37597;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T18:50:58","port":6566,"src_port":25385,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6566;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:25385;branch=z9hG4bK76a6150de1fcc194;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>19a682aca7b3\r\nTo: <sip:+3908351673002@<HONEYPOT>:6566>\r\nCall-ID: 0494fc86127ac92fd9c133e1eea9debc\r\nCSeq: 1 INVITE\r\nContact: <sip:15744073934@190.211.252.4:25385;transport=UDP>\r\nUser-Agent: CSipSimple git-6abcdef\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10992 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363536363b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32353338353b6272616e63683d7a39684734624b373661363135306465316663633139343b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537343430373339333440<HONEYPOT>3e3b7461673d<HONEYPOT>3139613638326163613762330d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363536363e0d0a43616c6c2d49443a2030343934666338363132376163393266643963313333653165656139646562630d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373434303733393334403139302e3231312e3235322e343a32353338353b7472616e73706f72743d5544503e0d0a557365722d4167656e743a204353697053696d706c65206769742d366162636465660d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393932205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"1599c227-399c-40d8-9919-494cd85d35bb","bytes_in":918,"source_verified":false,"enriched":{"digest":"f77804e323401934","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6566;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:25385;branch=z9hG4bK76a6150de1fcc194;rport","Max-Forwards: 70","From: <sip:15744073934@<HONEYPOT>>;tag=<HONEYPOT>19a682aca7b3","To: <sip:+3908351673002@<HONEYPOT>:6566>","Call-ID: 0494fc86127ac92fd9c133e1eea9debc","CSeq: 1 INVITE","Contact: <sip:15744073934@190.211.252.4:25385;transport=UDP>","User-Agent: CSipSimple git-6abcdef","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-21T18:40:07","port":6465,"src_port":29697,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"INVITE sip:+3908351673002@<HONEYPOT>:6465;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 190.211.252.4:29697;branch=z9hG4bK56265fb1a8172a78;rport\r\nMax-Forwards: 70\r\nFrom: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>194154f941f2\r\nTo: <sip:+3908351673002@<HONEYPOT>:6465>\r\nCall-ID: 9881eb8be9c61e0657fff36f8b3e5d2a\r\nCSeq: 1 INVITE\r\nContact: <sip:15727557867@190.211.252.4:29697;transport=UDP>\r\nUser-Agent: Yealink SIP-T46S 66.83.0.65\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nContent-Type: application/sdp\r\nContent-Length: 237\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 190.211.252.4\r\ns=TUFAN Call\r\nc=IN IP4 190.211.252.4\r\nt=0 0\r\nm=audio 10991 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=ptime:20\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a2b3339303833353136373330303240<HONEYPOT>3a363436353b7472616e73706f72743d554450205349502f322e300d0a5669613a205349502f322e302f554450203139302e3231312e3235322e343a32393639373b6272616e63683d7a39684734624b353632363566623161383137326137383b72706f72740d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a313537323735353738363740<HONEYPOT>3e3b7461673d<HONEYPOT>3139343135346639343166320d0a546f3a203c7369703a2b3339303833353136373330303240<HONEYPOT>3a363436353e0d0a43616c6c2d49443a2039383831656238626539633631653036353766666633366638623365356432610d0a435365713a203120494e564954450d0a436f6e746163743a203c7369703a3135373237353537383637403139302e3231312e3235322e343a32393639373b7472616e73706f72743d5544503e0d0a557365722d4167656e743a205965616c696e6b205349502d543436532036362e38332e302e36350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203233370d0a0d0a763d300d0a6f3d2d2033373437203337343720494e20495034203139302e3231312e3235322e340d0a733d545546414e2043616c6c0d0a633d494e20495034203139302e3231312e3235322e340d0a743d3020300d0a6d3d617564696f203130393931205254502f41565020302038203130310d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7074696d653a32300d0a613d73656e64726563760d0a","sni":"","session":"d0fce66f-2c98-471a-a346-a0ad00f740be","bytes_in":929,"source_verified":false,"enriched":{"digest":"157c7ea541b41f67","label":"SIP","strings":["INVITE sip:+3908351673002@<HONEYPOT>:6465;transport=UDP SIP/2.0","Via: SIP/2.0/UDP 190.211.252.4:29697;branch=z9hG4bK56265fb1a8172a78;rport","Max-Forwards: 70","From: <sip:15727557867@<HONEYPOT>>;tag=<HONEYPOT>194154f941f2","To: <sip:+3908351673002@<HONEYPOT>:6465>","Call-ID: 9881eb8be9c61e0657fff36f8b3e5d2a","CSeq: 1 INVITE","Contact: <sip:15727557867@190.211.252.4:29697;transport=UDP>","User-Agent: Yealink SIP-T46S 66.83.0.65","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE"],"iocs":{"ips":["190.211.252.4","66.83.0.65"],"paths":["/2.0/UDP"]}}}]},"interaction":{"window_days":90,"sessions":722,"first_seen":"2026-10-14T16:35:03","last_seen":"2026-10-21T20:10:09","verdicts":[{"verdict":"scan","sessions":722}],"personas":[{"persona":"sip@Asterisk PBX 18.10.0","sessions":722}],"services":[{"protocol":"sip","port":8082,"sessions":685},{"protocol":"sip","port":5060,"sessions":36},{"protocol":"sip","port":500,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"f157e63138bab0bbfb0074a50b62babf688e2f456ca7e54af8c772b7b4994371","name":"f9b1vVgFYotTNGAt68aqp9..","size":431,"mime_type":"text/plain","kind":"sip-sdp","times":36,"first_seen":"2026-10-15T22:08:58","last_seen":"2026-10-15T22:34:28","virustotal":null},{"sha256":"9d0f4bc874eb3a9ec2232a904cd2b44a0f11d91e26f16172ced6ccacc9a4832c","name":"38f65f7e5b3c11bb844728452d67f3ad","size":237,"mime_type":"text/plain","kind":"sip-sdp","times":1,"first_seen":"2026-10-16T10:47:30","last_seen":"2026-10-16T10:47:30","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":722}]},"top_ports":[{"port":5061,"proto":"tcp","label":"SIPS","count":182},{"port":5063,"proto":"tcp","label":"","count":181},{"port":5060,"proto":"tcp","label":"SIP","count":179},{"port":5064,"proto":"tcp","label":"","count":178},{"port":5062,"proto":"tcp","label":"","count":176},{"port":5065,"proto":"tcp","label":"","count":173}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"16030100e4010000e00303c088252280a28a7582db8f74dec06b46744e7736eaa71840061e3bd4a37ec8912085921b5be3e20ddd77f14f09815bd4aa91d7a8dbfd14ab9dfb3448729a36939c001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d0020c00de257a2833346642f144b4cee2ad76449ac4db87a5b1d2d6efcd3","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":756},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-04","count":277},{"date":"2026-10-05","count":282},{"date":"2026-10-06","count":82},{"date":"2026-10-07","count":76},{"date":"2026-10-08","count":83},{"date":"2026-10-09","count":80},{"date":"2026-10-10","count":90},{"date":"2026-10-11","count":86},{"date":"2026-10-12","count":13}],"recent_events":[{"timestamp":"2026-10-12T04:07:04","port":5063,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90103908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:7984;branch=z9hG4bK-524287-1---f94f680edcc9770d\r\nFrom: <sip:33972407291@0.0.0.0>;tag=66aee9bb\r\nTo: <sip:90103908351673002@<HONEYPOT>:5063>\r\nCall-ID: pX5UvRVefuddBTgaoWNIR8..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972407291@0.0.0.0:7984;transport=TCP>\r\nUser-Agent: Cisco-CP7961G/8.5.3\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031303339303833353136373330303240<HONEYPOT>3a353036333b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a373938343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d663934663638306564636339373730640d0a46726f6d3a203c7369703a333339373234303732393140302e302e302e303e3b7461673d36366165653962620d0a546f3a203c7369703a393031303339303833353136373330303240<HONEYPOT>3a353036333e0d0a43616c6c2d49443a20705835557652566566756464425467616f574e4952382e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373234303732393140302e302e302e303a373938343b7472616e73706f72743d5443503e0d0a557365722d4167656e743a20436973636f2d435037393631472f382e352e330d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"e73045e5-ad93-4c03-8a1f-ad9a2228bde8","seq":1,"duration_ms":100,"bytes_in":1069,"bytes_out":13,"enriched":{"digest":"10d544483e01bb74","label":"SIP","strings":["INVITE sip:90103908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:7984;branch=z9hG4bK-524287-1---f94f680edcc9770d","From: <sip:33972407291@0.0.0.0>;tag=66aee9bb","To: <sip:90103908351673002@<HONEYPOT>:5063>","Call-ID: pX5UvRVefuddBTgaoWNIR8..","CSeq: 15 INVITE","Contact: <sip:33972407291@0.0.0.0:7984;transport=TCP>","User-Agent: Cisco-CP7961G/8.5.3","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T03:40:34","port":5063,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90103908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:30908;branch=z9hG4bK-524287-1---1fe4db74805cf694\r\nFrom: <sip:33973315853@0.0.0.0>;tag=64d1e12a\r\nTo: <sip:90103908351673002@<HONEYPOT>:5063>\r\nCall-ID: aO2UL9FogyKFSTyB6RpKaP..\r\nCSeq: 15 INVITE\r\nContact: <sip:33973315853@0.0.0.0:30908;transport=TCP>\r\nUser-Agent: Zoiper v2.10.12.2 for Windows\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031303339303833353136373330303240<HONEYPOT>3a353036333b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a33303930383b6272616e63683d7a39684734624b2d3532343238372d312d2d2d316665346462373438303563663639340d0a46726f6d3a203c7369703a333339373333313538353340302e302e302e303e3b7461673d36346431653132610d0a546f3a203c7369703a393031303339303833353136373330303240<HONEYPOT>3a353036333e0d0a43616c6c2d49443a20614f32554c39466f67794b46535479423652704b61502e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373333313538353340302e302e302e303a33303930383b7472616e73706f72743d5443503e0d0a557365722d4167656e743a205a6f697065722076322e31302e31322e3220666f722057696e646f77730d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"f292ae31-c3af-4a0e-9037-cc2214feb93b","seq":1,"duration_ms":100,"bytes_in":1079,"bytes_out":13,"enriched":{"digest":"88c126e6875cfdbc","label":"SIP","strings":["INVITE sip:90103908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:30908;branch=z9hG4bK-524287-1---1fe4db74805cf694","From: <sip:33973315853@0.0.0.0>;tag=64d1e12a","To: <sip:90103908351673002@<HONEYPOT>:5063>","Call-ID: aO2UL9FogyKFSTyB6RpKaP..","CSeq: 15 INVITE","Contact: <sip:33973315853@0.0.0.0:30908;transport=TCP>","User-Agent: Zoiper v2.10.12.2 for Windows","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0","2.10.12.2"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T03:08:13","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90103908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:31548;branch=z9hG4bK-524287-1---280576dab654b938\r\nFrom: <sip:33972379385@0.0.0.0>;tag=0873b941\r\nTo: <sip:90103908351673002@<HONEYPOT>:5060>\r\nCall-ID: cgEkJgId3MCjw4SM8nFemq..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972379385@0.0.0.0:31548;transport=TCP>\r\nUser-Agent: Asterisk PBX\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031303339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a33313534383b6272616e63683d7a39684734624b2d3532343238372d312d2d2d323830353736646162363534623933380d0a46726f6d3a203c7369703a333339373233373933383540302e302e302e303e3b7461673d30383733623934310d0a546f3a203c7369703a393031303339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a206367456b4a674964334d436a7734534d386e46656d712e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373233373933383540302e302e302e303a33313534383b7472616e73706f72743d5443503e0d0a557365722d4167656e743a20417374657269736b205042580d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"05b3d80b-ee7a-48ef-9af0-65a3b3bfb6b7","seq":1,"duration_ms":100,"bytes_in":1062,"bytes_out":13,"enriched":{"digest":"058deccf840a18bc","label":"SIP","strings":["INVITE sip:90103908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:31548;branch=z9hG4bK-524287-1---280576dab654b938","From: <sip:33972379385@0.0.0.0>;tag=0873b941","To: <sip:90103908351673002@<HONEYPOT>:5060>","Call-ID: cgEkJgId3MCjw4SM8nFemq..","CSeq: 15 INVITE","Contact: <sip:33972379385@0.0.0.0:31548;transport=TCP>","User-Agent: Asterisk PBX","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T02:46:20","port":5061,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90103908351673002@<HONEYPOT>:5061;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:35444;branch=z9hG4bK-524287-1---42314919cd9ea394\r\nFrom: <sip:33972200957@0.0.0.0>;tag=fd95dae9\r\nTo: <sip:90103908351673002@<HONEYPOT>:5061>\r\nCall-ID: 96EqXed2aLJH3Zy0RuiD5e..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972200957@0.0.0.0:35444;transport=TCP>\r\nUser-Agent: Yate/6.0.0\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031303339303833353136373330303240<HONEYPOT>3a353036313b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a33353434343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d343233313439313963643965613339340d0a46726f6d3a203c7369703a333339373232303039353740302e302e302e303e3b7461673d66643935646165390d0a546f3a203c7369703a393031303339303833353136373330303240<HONEYPOT>3a353036313e0d0a43616c6c2d49443a203936457158656432614c4a48335a79305275694435652e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373232303039353740302e302e302e303a33353434343b7472616e73706f72743d5443503e0d0a557365722d4167656e743a20596174652f362e302e300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"77681950-d15c-411e-90cb-d875f8279c0b","seq":1,"duration_ms":100,"bytes_in":1064,"bytes_out":13,"enriched":{"digest":"f84084b3c869a87b","label":"SIP","strings":["INVITE sip:90103908351673002@<HONEYPOT>:5061;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:35444;branch=z9hG4bK-524287-1---42314919cd9ea394","From: <sip:33972200957@0.0.0.0>;tag=fd95dae9","To: <sip:90103908351673002@<HONEYPOT>:5061>","Call-ID: 96EqXed2aLJH3Zy0RuiD5e..","CSeq: 15 INVITE","Contact: <sip:33972200957@0.0.0.0:35444;transport=TCP>","User-Agent: Yate/6.0.0","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T02:30:53","port":5064,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90103908351673002@<HONEYPOT>:5064;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:9402;branch=z9hG4bK-524287-1---87bca55ec107cbf0\r\nFrom: <sip:33972496379@0.0.0.0>;tag=c1879f8a\r\nTo: <sip:90103908351673002@<HONEYPOT>:5064>\r\nCall-ID: R75BcClPflXFq4ucd5yOCH..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972496379@0.0.0.0:9402;transport=TCP>\r\nUser-Agent: Yealink CP960\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031303339303833353136373330303240<HONEYPOT>3a353036343b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a393430323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d383762636135356563313037636266300d0a46726f6d3a203c7369703a333339373234393633373940302e302e302e303e3b7461673d63313837396638610d0a546f3a203c7369703a393031303339303833353136373330303240<HONEYPOT>3a353036343e0d0a43616c6c2d49443a205237354263436c50666c5846713475636435794f43482e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373234393633373940302e302e302e303a393430323b7472616e73706f72743d5443503e0d0a557365722d4167656e743a205965616c696e6b2043503936300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"7b6d6a6f-a07b-4887-a7ce-b7e98517e6d8","seq":1,"duration_ms":100,"bytes_in":1063,"bytes_out":13,"enriched":{"digest":"4411620bbb0c1128","label":"SIP","strings":["INVITE sip:90103908351673002@<HONEYPOT>:5064;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:9402;branch=z9hG4bK-524287-1---87bca55ec107cbf0","From: <sip:33972496379@0.0.0.0>;tag=c1879f8a","To: <sip:90103908351673002@<HONEYPOT>:5064>","Call-ID: R75BcClPflXFq4ucd5yOCH..","CSeq: 15 INVITE","Contact: <sip:33972496379@0.0.0.0:9402;transport=TCP>","User-Agent: Yealink CP960","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T02:13:22","port":5064,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90123908351673002@<HONEYPOT>:5064;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:44058;branch=z9hG4bK-524287-1---f3ee5c2b1d8f492c\r\nFrom: <sip:33972637164@0.0.0.0>;tag=be9bcb57\r\nTo: <sip:90123908351673002@<HONEYPOT>:5064>\r\nCall-ID: atSpDlyFt8O1VqlVzoFJMT..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972637164@0.0.0.0:44058;transport=TCP>\r\nUser-Agent: Yealink SIP-T57W\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031323339303833353136373330303240<HONEYPOT>3a353036343b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a34343035383b6272616e63683d7a39684734624b2d3532343238372d312d2d2d663365653563326231643866343932630d0a46726f6d3a203c7369703a333339373236333731363440302e302e302e303e3b7461673d62653962636235370d0a546f3a203c7369703a393031323339303833353136373330303240<HONEYPOT>3a353036343e0d0a43616c6c2d49443a2061745370446c794674384f3156716c567a6f464a4d542e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373236333731363440302e302e302e303a34343035383b7472616e73706f72743d5443503e0d0a557365722d4167656e743a205965616c696e6b205349502d543537570d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"fe39ad3c-10df-4cca-a3c0-03943f2422a0","seq":1,"duration_ms":100,"bytes_in":1070,"bytes_out":13,"enriched":{"digest":"17a806653fb69102","label":"SIP","strings":["INVITE sip:90123908351673002@<HONEYPOT>:5064;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:44058;branch=z9hG4bK-524287-1---f3ee5c2b1d8f492c","From: <sip:33972637164@0.0.0.0>;tag=be9bcb57","To: <sip:90123908351673002@<HONEYPOT>:5064>","Call-ID: atSpDlyFt8O1VqlVzoFJMT..","CSeq: 15 INVITE","Contact: <sip:33972637164@0.0.0.0:44058;transport=TCP>","User-Agent: Yealink SIP-T57W","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T02:07:51","port":5060,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90123908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:47622;branch=z9hG4bK-524287-1---a492a729efdfa80c\r\nFrom: <sip:33972235537@0.0.0.0>;tag=a355cb90\r\nTo: <sip:90123908351673002@<HONEYPOT>:5060>\r\nCall-ID: fEHwnUNdT1lIdqutketXEh..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972235537@0.0.0.0:47622;transport=TCP>\r\nUser-Agent: RingCentral\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031323339303833353136373330303240<HONEYPOT>3a353036303b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a34373632323b6272616e63683d7a39684734624b2d3532343238372d312d2d2d613439326137323965666466613830630d0a46726f6d3a203c7369703a333339373232333535333740302e302e302e303e3b7461673d61333535636239300d0a546f3a203c7369703a393031323339303833353136373330303240<HONEYPOT>3a353036303e0d0a43616c6c2d49443a20664548776e554e6454316c49647175746b65745845682e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373232333535333740302e302e302e303a34373632323b7472616e73706f72743d5443503e0d0a557365722d4167656e743a2052696e6743656e7472616c0d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"9cd341cd-f927-4f09-98ec-1353d3305191","seq":1,"duration_ms":100,"bytes_in":1065,"bytes_out":13,"enriched":{"digest":"9ba6640fb5b1e041","label":"SIP","strings":["INVITE sip:90123908351673002@<HONEYPOT>:5060;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:47622;branch=z9hG4bK-524287-1---a492a729efdfa80c","From: <sip:33972235537@0.0.0.0>;tag=a355cb90","To: <sip:90123908351673002@<HONEYPOT>:5060>","Call-ID: fEHwnUNdT1lIdqutketXEh..","CSeq: 15 INVITE","Contact: <sip:33972235537@0.0.0.0:47622;transport=TCP>","User-Agent: RingCentral","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T01:43:14","port":5062,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90123908351673002@<HONEYPOT>:5062;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:51810;branch=z9hG4bK-524287-1---00e6fca2629859fb\r\nFrom: <sip:33973275464@0.0.0.0>;tag=4e802f4e\r\nTo: <sip:90123908351673002@<HONEYPOT>:5062>\r\nCall-ID: wZCbfdhOGHAgVBhb4AT7lM..\r\nCSeq: 15 INVITE\r\nContact: <sip:33973275464@0.0.0.0:51810;transport=TCP>\r\nUser-Agent: snomD715\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031323339303833353136373330303240<HONEYPOT>3a353036323b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a35313831303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d303065366663613236323938353966620d0a46726f6d3a203c7369703a333339373332373534363440302e302e302e303e3b7461673d34653830326634650d0a546f3a203c7369703a393031323339303833353136373330303240<HONEYPOT>3a353036323e0d0a43616c6c2d49443a20775a43626664684f4748416756426862344154376c4d2e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373332373534363440302e302e302e303a35313831303b7472616e73706f72743d5443503e0d0a557365722d4167656e743a20736e6f6d443731350d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"d874cbd4-6fcf-440d-b6a7-d0eb015e1605","seq":1,"duration_ms":100,"bytes_in":1060,"bytes_out":13,"enriched":{"digest":"53eaa422fe048cf5","label":"SIP","strings":["INVITE sip:90123908351673002@<HONEYPOT>:5062;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:51810;branch=z9hG4bK-524287-1---00e6fca2629859fb","From: <sip:33973275464@0.0.0.0>;tag=4e802f4e","To: <sip:90123908351673002@<HONEYPOT>:5062>","Call-ID: wZCbfdhOGHAgVBhb4AT7lM..","CSeq: 15 INVITE","Contact: <sip:33973275464@0.0.0.0:51810;transport=TCP>","User-Agent: snomD715","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T01:38:16","port":5063,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90123908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:59534;branch=z9hG4bK-524287-1---193ca1403b22a9fb\r\nFrom: <sip:33972915152@0.0.0.0>;tag=8b12b395\r\nTo: <sip:90123908351673002@<HONEYPOT>:5063>\r\nCall-ID: 8slRslMNeQCwuW9YTrsfxv..\r\nCSeq: 15 INVITE\r\nContact: <sip:33972915152@0.0.0.0:59534;transport=TCP>\r\nUser-Agent: Grandstream WP820 1.0.3.42\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031323339303833353136373330303240<HONEYPOT>3a353036333b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a35393533343b6272616e63683d7a39684734624b2d3532343238372d312d2d2d313933636131343033623232613966620d0a46726f6d3a203c7369703a333339373239313531353240302e302e302e303e3b7461673d38623132623339350d0a546f3a203c7369703a393031323339303833353136373330303240<HONEYPOT>3a353036333e0d0a43616c6c2d49443a2038736c52736c4d4e65514377755739595472736678762e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373239313531353240302e302e302e303a35393533343b7472616e73706f72743d5443503e0d0a557365722d4167656e743a204772616e6473747265616d20575038323020312e302e332e34320d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"9aa9e590-adcd-48b6-b86c-5aeaed101abb","seq":1,"duration_ms":100,"bytes_in":1080,"bytes_out":13,"enriched":{"digest":"0060b9768d8bac81","label":"SIP","strings":["INVITE sip:90123908351673002@<HONEYPOT>:5063;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:59534;branch=z9hG4bK-524287-1---193ca1403b22a9fb","From: <sip:33972915152@0.0.0.0>;tag=8b12b395","To: <sip:90123908351673002@<HONEYPOT>:5063>","Call-ID: 8slRslMNeQCwuW9YTrsfxv..","CSeq: 15 INVITE","Contact: <sip:33972915152@0.0.0.0:59534;transport=TCP>","User-Agent: Grandstream WP820 1.0.3.42","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0","1.0.3.42"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-10-12T01:04:07","port":5065,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"INVITE sip:90123908351673002@<HONEYPOT>:5065;transport=TCP SIP/2.0\r\nVia: SIP/2.0/TCP 0.0.0.0:30750;branch=z9hG4bK-524287-1---e844d94cf5f82515\r\nFrom: <sip:33973264300@0.0.0.0>;tag=c04243ab\r\nTo: <sip:90123908351673002@<HONEYPOT>:5065>\r\nCall-ID: zP4XF1qktEZlqneI9Ikt83..\r\nCSeq: 15 INVITE\r\nContact: <sip:33973264300@0.0.0.0:30750;transport=TCP>\r\nUser-Agent: Panasonic_KX-HDV230/01.060\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE\r\nSupported: replaces, timer, 100rel, norefersub\r\nSession-Expires: 1800;refresher=uac\r\nAllow-Events: presence, kpml, talk\r\nMax-Forwards: 70\r\nContent-Type: application/sdp\r\nContent-Length: 415\r\n\r\nv=0\r\no=- 3747 3747 IN IP4 0.0.0.0\r\ns=x Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 50990 RTP/AVP 0 8 18 9 101 13 126 97\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:18 G729/8000\r\na=fmtp:18 annexb=no\r\na=rtpmap:9 G722/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=rtpmap:13 CN/8000\r\na=rtpmap:126 telephone-event/16000\r\na=fmtp:126 0-16\r\na=rtpmap:97 iLBC/8000\r\na=ptime:20\r\na=maxptime:150\r\na=sendrecv\r\n","payload_hex":"494e56495445207369703a393031323339303833353136373330303240<HONEYPOT>3a353036353b7472616e73706f72743d544350205349502f322e300d0a5669613a205349502f322e302f54435020302e302e302e303a33303735303b6272616e63683d7a39684734624b2d3532343238372d312d2d2d653834346439346366356638323531350d0a46726f6d3a203c7369703a333339373332363433303040302e302e302e303e3b7461673d63303432343361620d0a546f3a203c7369703a393031323339303833353136373330303240<HONEYPOT>3a353036353e0d0a43616c6c2d49443a207a5034584631716b74455a6c716e654939496b7438332e2e0d0a435365713a20313520494e564954450d0a436f6e746163743a203c7369703a333339373332363433303040302e302e302e303a33303735303b7472616e73706f72743d5443503e0d0a557365722d4167656e743a2050616e61736f6e69635f4b582d4844563233302f30312e3036300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c205355425343524942452c204e4f544946592c20494e464f2c205550444154450d0a537570706f727465643a207265706c616365732c2074696d65722c2031303072656c2c206e6f72656665727375620d0a53657373696f6e2d457870697265733a20313830303b7265667265736865723d7561630d0a416c6c6f772d4576656e74733a2070726573656e63652c206b706d6c2c2074616c6b0d0a4d61782d466f7277617264733a2037300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a203431350d0a0d0a763d300d0a6f3d2d2033373437203337343720494e2049503420302e302e302e300d0a733d782043616c6c0d0a633d494e2049503420302e302e302e300d0a743d3020300d0a6d3d617564696f203530393930205254502f41565020302038203138203920313031203133203132362039370d0a613d7274706d61703a302050434d552f383030300d0a613d7274706d61703a382050434d412f383030300d0a613d7274706d61703a313820473732392f383030300d0a613d666d74703a313820616e6e6578623d6e6f0d0a613d7274706d61703a3920473732322f383030300d0a613d7274706d61703a3130312074656c6570686f6e652d6576656e742f383030300d0a613d666d74703a31303120302d31360d0a613d7274706d61703a313320434e2f383030300d0a613d7274706d61703a3132362074656c6570686f6e652d6576656e742f31363030300d0a613d666d74703a31323620302d31360d0a613d7274706d61703a393720694c42432f383030300d0a613d7074696d653a32300d0a613d6d61787074696d653a3135300d0a613d73656e64726563760d0a","method":"","user_agent":"","ja3":"","session":"27e17e4e-9ac2-4aa7-bbeb-bceed6563a02","seq":1,"duration_ms":100,"bytes_in":1076,"bytes_out":13,"enriched":{"digest":"6496b338ff8a016c","label":"SIP","strings":["INVITE sip:90123908351673002@<HONEYPOT>:5065;transport=TCP SIP/2.0","Via: SIP/2.0/TCP 0.0.0.0:30750;branch=z9hG4bK-524287-1---e844d94cf5f82515","From: <sip:33973264300@0.0.0.0>;tag=c04243ab","To: <sip:90123908351673002@<HONEYPOT>:5065>","Call-ID: zP4XF1qktEZlqneI9Ikt83..","CSeq: 15 INVITE","Contact: <sip:33973264300@0.0.0.0:30750;transport=TCP>","User-Agent: Panasonic_KX-HDV230/01.060","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, UPDATE","Supported: replaces, timer, 100rel, norefersub"],"iocs":{"ips":["0.0.0.0"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":6,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}