Researchers deployed a TFTP honeypot to analyze internet background radiation, capturing automated requests for specific Cisco and Polycom IP phone configuration files. The results help differentiate between widespread credential-harvesting bots and more targeted network reconnaissance originating from distinct IP sources.