Here's what I see on mine when something like that happens:
2016-12-21 23:15:08.885445 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/3407@10.100.1.2:5060 [abcc54a5-e4b9-405e-a1a5-90036b05356a]
2016-12-21 23:15:08.885445 [DEBUG] switch_core_state_machine.c:584 (sofia/internal/3407@10.100.1.2:5060) Running State Change CS_NEW (Cur 1 Tot 74)
2016-12-21 23:15:08.885445 [DEBUG] sofia.c:9746 sofia/internal/3407@10.100.1.2:5060 receiving invite from 158.69.243.194:5071 version: 1.6.13 git e755b43 2016-11-29 15:46:39Z 64bit
2016-12-21 23:15:08.885445 [DEBUG] sofia.c:9913 IP 158.69.243.194 Rejected by acl "domains". Falling back to Digest auth.
{"html5":"htmlmixed","css":"css","javascript":"javascript","php":"php","python":"python","ruby":"ruby","lua":"text\/x-lua","bash":"text\/x-sh","go":"go","c":"text\/x-csrc","cpp":"text\/x-c++src","diff":"diff","latex":"stex","sql":"sql","xml":"xml","apl":"apl","asterisk":"asterisk","c_loadrunner":"text\/x-csrc","c_mac":"text\/x-csrc","coffeescript":"text\/x-coffeescript","csharp":"text\/x-csharp","d":"d","ecmascript":"javascript","erlang":"erlang","groovy":"text\/x-groovy","haskell":"text\/x-haskell","haxe":"text\/x-haxe","html4strict":"htmlmixed","java":"text\/x-java","java5":"text\/x-java","jquery":"javascript","mirc":"mirc","mysql":"sql","ocaml":"text\/x-ocaml","pascal":"text\/x-pascal","perl":"perl","perl6":"perl","plsql":"sql","properties":"text\/x-properties","q":"text\/x-q","scala":"scala","scheme":"text\/x-scheme","tcl":"text\/x-tcl","vb":"text\/x-vb","verilog":"text\/x-verilog","yaml":"text\/x-yaml","z80":"text\/x-z80"}