UDP traffic

Datagrams matching asn:51852 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

52 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 52

Latest SIP datagram, to 5060/udp

INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28305;branch=z9hG4bK-524287-1---4086aa0c94b56842 From: <sip:13977481030@0.0.0.0>;tag=25c0b9c7 To: <sip:003908351673002@<HONEYPOT>:5060> Call-ID: rZ1seo4XrlqaUpDjLKU0gV.. CSeq: 15 INVITE Contact: <sip:1397

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP41
5062/udp SIP4
5080/udp SIP4
5090/udp SIP3

Networks

AS51852 Private Layer INC from 3 sources52

Countries

CH Switzerland52

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
179.43.167.3	AS51852 Private Layer INC	CH	SIP	33	2026-10-11 04:32
179.43.134.194	AS51852 Private Layer INC	CH	SIP	11	2026-10-09 17:00
31.7.60.66	AS51852 Private Layer INC	CH	SIP	8	2026-10-10 06:25

Latest datagrams

2026-10-11 04:32:33179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28305;branch=z9hG4bK-524287-1---4086aa0c94b56842 From: <sip:13977481030@0.0.0.0>;tag=25c0b9c7 To: <sip:0039
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:22:59179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28305;branch=z9hG4bK-524287-1---b7f324a56a230346 From: <sip:13493984677@0.0.0.0>;tag=6e03dcd3 To: <sip:0039
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:35:33179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:25139;branch=z9hG4bK-524287-1---43458a4794e02248 From: <sip:16155618900@0.0.0.0>;tag=6844eb76 To: <sip:90
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:21:29179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:25139;branch=z9hG4bK-524287-1---3879db8cfe12c71f From: <sip:13977481030@0.0.0.0>;tag=916dd40e To: <sip:90
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:11:46179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:25139;branch=z9hG4bK-524287-1---aab1e51317f99abf From: <sip:13493984677@0.0.0.0>;tag=22a6701f To: <sip:90
Payload bytes withheld: they contain the sensor's address.
2026-10-10 12:10:47179.43.167.3to 5060/udpSIPCH
INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:33776;branch=z9hG4bK-524287-1---2dc372d1cdcec041 From: <sip:13977481030@0.0.0.0>;tag=6d789f2c To: <sip:011
Payload bytes withheld: they contain the sensor's address.
2026-10-10 11:00:56179.43.167.3to 5060/udpSIPCH
INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:33776;branch=z9hG4bK-524287-1---bf2ddb00b9580cc8 From: <sip:13493984677@0.0.0.0>;tag=412ce8de To: <sip:011
Payload bytes withheld: they contain the sensor's address.
2026-10-10 09:13:14179.43.167.3to 5060/udpSIPCH
INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:24525;branch=z9hG4bK-524287-1---864e7cfcfec238a8 From: <sip:16155618900@0.0.0.0>;tag=d6122d86 To: <sip:+3908
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:25:0131.7.60.66to 5080/udpSIPCH
INVITE sip:811529060975@<HONEYPOT>:5080 SIP/2.0 Via: SIP/2.0/UDP 31.7.60.66:9580;rport=9580;branch=z9hG4bK0qwzD2giCq8r0 Contact: <sip:190006170083@31.7.60.66:9580> From: "190006170083"<sip:19000617
Payload bytes withheld: they contain the sensor's address.
2026-10-10 03:58:11179.43.167.3to 5060/udpSIPCH
INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:24525;branch=z9hG4bK-524287-1---d4c993b2f844ebc3 From: <sip:13977481030@0.0.0.0>;tag=6bfc0cd4 To: <sip:+3908
Payload bytes withheld: they contain the sensor's address.
2026-10-10 02:47:51179.43.167.3to 5060/udpSIPCH
INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:24525;branch=z9hG4bK-524287-1---971621f8b335221b From: <sip:13493984677@0.0.0.0>;tag=b9602f9c To: <sip:+3908
Payload bytes withheld: they contain the sensor's address.
2026-10-09 21:29:59179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 179.43.167.3:32194;branch=z9hG4bK-524287-1---932fd38cbbe6260d;rport Max-Forwards: 70 From: <sip:13977481030@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-09 20:19:44179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 179.43.167.3:32194;branch=z9hG4bK-524287-1---68793539afe79e8d;rport Max-Forwards: 70 From: <sip:13493984677@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-09 17:38:5631.7.60.66to 5080/udpSIPCH
INVITE sip:129805854637@<HONEYPOT>:5080 SIP/2.0 Via: SIP/2.0/UDP 31.7.60.66:9889;rport=9889;branch=z9hG4bK0JYzuHzywPlOo Contact: <sip:820014963145@31.7.60.66:9889> From: "820014963145"<sip:82001496
Payload bytes withheld: they contain the sensor's address.
2026-10-09 17:38:25179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 179.43.167.3:23555;branch=z9hG4bK-524287-1---789d59b098c5225a;rport Max-Forwards: 70 From: <sip:16147230292@<HONE
Payload bytes withheld: they contain the sensor's address.