UDP traffic

Datagrams matching asn:49870 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

174

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

174 datagrams from 5 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 174

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 160.119.76.127:5064;branch=z9hG4bK-712336606;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340133383638353535313135 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP34
25060/udp SIP13
5061/udp SIP9
45060/udp SIP8
5062/udp SIP8
15060/udp SIP8
6070/udp SIP7
5075/udp SIP6
5059/udp SIP6
35060/udp SIP6
5090/udp SIP6
6062/udp SIP5

Networks

AS49870 Alsycon B.V. from 5 sources174

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	153	2026-10-10 22:30
89.190.156.22	AS49870 Alsycon B.V.	NL	SIP	10	2026-10-10 20:43
185.224.128.252	AS49870 Alsycon B.V.	NL	SIP	5	2026-10-09 15:40
77.83.240.70	AS49870 Alsycon B.V.	US	SIP	4	2026-10-10 11:29
194.50.16.198	AS49870 Alsycon B.V.	NL	SIP	2	2026-10-06 09:45

Latest datagrams

2026-10-10 22:30:12160.119.76.127to 5060/udpSIPSC
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 160.119.76.127:5064;branch=z9hG4bK-712336606;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336334013338363835
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:43:2689.190.156.22to 5060/udpSIPNL
INVITE sip:+48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:59821;branch=z9hG4bK736926965 Max-Forwards: 70 From: <sip:13216000000@<HONEYPOT>>;tag=370201256 To: <sip:+48422032120@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:41:4789.190.156.22to 5060/udpSIPNL
INVITE sip:0048422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:36132;branch=z9hG4bK1472202093 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=1509472068 To: <sip:0048422032120@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:40:1689.190.156.22to 5060/udpSIPNL
INVITE sip:48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:49348;branch=z9hG4bK815659435 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=508909418 To: <sip:48422032120@<HONEYPOT>
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:38:4589.190.156.22to 5060/udpSIPNL
INVITE sip:+48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:26509;branch=z9hG4bK96717725 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=204734057 To: <sip:+48422032120@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:37:0489.190.156.22to 5060/udpSIPNL
INVITE sip:0048422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:26279;branch=z9hG4bK237701045 Max-Forwards: 70 From: <sip:10052500@<HONEYPOT>>;tag=1115788591 To: <sip:0048422032120@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:35:3389.190.156.22to 5060/udpSIPNL
INVITE sip:48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:3513;branch=z9hG4bK1264468437 Max-Forwards: 70 From: <sip:10052500@<HONEYPOT>>;tag=1307067443 To: <sip:48422032120@<HONEYPO
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:34:2289.190.156.22to 5060/udpSIPNL
INVITE sip:0048124447777@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:50295;branch=z9hG4bK1630638645 Max-Forwards: 70 From: <sip:13216220427@<HONEYPOT>>;tag=1347697890 To: <sip:0048124447777@
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:34:0289.190.156.22to 5060/udpSIPNL
INVITE sip:+48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:45134;branch=z9hG4bK1474358695 Max-Forwards: 70 From: <sip:10052500@<HONEYPOT>>;tag=758646614 To: <sip:+48422032120@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:33:1089.190.156.22to 5060/udpSIPNL
INVITE sip:48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:29100;branch=z9hG4bK141946461 Max-Forwards: 70 From: <sip:10052500@<HONEYPOT>>;tag=415979658 To: <sip:48422032120@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:32:1989.190.156.22to 5060/udpSIPNL
INVITE sip:+48422032120@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 89.190.156.22:7950;branch=z9hG4bK956151917 Max-Forwards: 70 From: <sip:10052500@<HONEYPOT>>;tag=1142934870 To: <sip:+48422032120@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 5063/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5063 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257699 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257699;rport Call-ID: c312
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 5065/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5065 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257785 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257785;rport Call-ID: c312
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 35070/udpSIPSC
INVITE sip:10000@<HONEYPOT>:35070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121258098 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121258098;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 15010/udpSIPSC
INVITE sip:10000@<HONEYPOT>:15010 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257625 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257625;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.