UDP traffic

Datagrams matching asn:8560 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

5 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 5

Latest SIP datagram, to 5080/udp

INVITE sip:10000@<HONEYPOT>:5080 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1464194708 Via: SIP/2.0/UDP 209.46.124.116:10047;branch=z9hG4bK-1464194708;rport Call-ID: c1464194708 CSeq: 1464194708 INVITE Contact: <sip:10000@209.46.124.116:10047> Max-Forwards: 70 User-

Payload bytes withheld: they contain the sensor's address.

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 4000/udp

x.~!P!E<@Q{·smF@|(!y0`4·?RTL·*D5(e·J*A·

payload bytes

00000000  78 2e 7e 21 50 21 45 3c  40 51 7b 18 19 73 6d 46  |x.~!P!E<@Q{..smF|
00000010  40 7c 28 21 79 30 60 34  1e 3f 52 54 4c 16 2a 44  |@|(!y0`4.?RTL.*D|
00000020  35 28 65 05 4a 2a 41 f0  1b                       |5(e.J*A..|

Destination ports

Networks

AS8560 IONOS SE from 3 sources6

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
209.46.124.116	AS8560 IONOS SE	US	SIP	3	2026-10-11 03:38
31.70.64.154	AS8560 IONOS SE	DE	SIP	2	2026-10-11 03:03
217.160.190.176	AS8560 IONOS SE	DE	Unrecognised	1	2026-10-11 03:55

Latest datagrams

2026-10-11 03:55:27217.160.190.176to 4000/udpUnrecognisedDE

x.~!P!E<@Q{·smF@|(!y0`4·?RTL·*D5(e·J*A·

payload bytes

00000000  78 2e 7e 21 50 21 45 3c  40 51 7b 18 19 73 6d 46  |x.~!P!E<@Q{..smF|
00000010  40 7c 28 21 79 30 60 34  1e 3f 52 54 4c 16 2a 44  |@|(!y0`4.?RTL.*D|
00000020  35 28 65 05 4a 2a 41 f0  1b                       |5(e.J*A..|

2026-10-11 03:38:54209.46.124.116to 5080/udpSIPUS
INVITE sip:10000@<HONEYPOT>:5080 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1464194708 Via: SIP/2.0/UDP 209.46.124.116:10047;branch=z9hG4bK-1464194708;rport Call-ID: c146
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:03:2531.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5069;branch=z9hG4bK-3517743053;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=633
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:57:1431.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5064;branch=z9hG4bK-2506594099;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=303
Payload bytes withheld: they contain the sensor's address.
2026-10-10 11:21:29209.46.124.116to 5080/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1464194708 Via: SIP/2.0/UDP 209.46.124.116:10037;branch=z9hG4bK-1464194708;rport Call-ID: c1464194708
Payload bytes withheld: they contain the sensor's address.
2026-10-10 10:17:01209.46.124.116to 5080/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t349959141 Via: SIP/2.0/UDP 209.46.124.116:10020;branch=z9hG4bK-349959141;rport Call-ID: c349959141 CSe
Payload bytes withheld: they contain the sensor's address.