UDP traffic

Datagrams matching asn:23470 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

1.1K

Datagrams

Source addresses

Networks

Countries

106

Destination ports

Traffic by type

Other services

1,137 datagrams from 10 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1,136 TARGUSDATASPEED 1

Latest SIP datagram, to 65477/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-193749612;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533666663350132343232343935393835 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP614
5059/udp SIP92
15060/udp SIP21
65060/udp SIP15
55060/udp SIP15
45060/udp SIP15
35060/udp SIP15
25060/udp SIP15
5070/udp SIP14
5071/udp SIP13
5072/udp SIP12
5068/udp SIP12

Networks

AS23470 ReliableSite.Net LLC from 10 sources1,137

Countries

HK Hong Kong1,134
US United States3

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	771	2026-10-11 03:21
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	125	2026-10-11 03:48
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	67	2026-10-11 04:01
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	60	2026-10-08 21:49
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
172.110.223.207	AS23470 ReliableSite.Net LLC	HK	SIP	9	2026-10-10 02:22
104.243.40.207	AS23470 ReliableSite.Net LLC	US	SIP	3	2026-10-05 17:40
185.243.5.10	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-10 06:57
185.243.5.164	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-08 20:03

Latest datagrams

2026-10-11 04:01:32172.110.223.188to 65477/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-193749612;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666335013234323234
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:48:51172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5156;branch=z9hG4bK-601762153;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653331336334013430313239
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:37:15172.110.223.188to 65477/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-2480972100;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633501333635313
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 65060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:65060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624303 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624303;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 55060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:55060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624295 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624295;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5059/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5059 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624252 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624252;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 45060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:45060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624288 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624288;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624245 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624245;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 35060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:35060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624278 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624278;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 25060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:25060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624270 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624270;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 15060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:15060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624261 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624261;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:45:44172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5080;branch=z9hG4bK-337688147;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336334013832363935
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:37:11172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5253;branch=z9hG4bK-3282375035;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401313433363
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:32:04172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-290398993;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666334013430303035
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:15:45172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5072;branch=z9hG4bK-1733294988;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163396666633401323439343
Payload bytes withheld: they contain the sensor's address.