UDP traffic
Datagrams matching port:1020 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
Traffic by type
Other services
5 datagrams from 2 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 1020/udp
OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK3928a1dd
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=5cf527de
Call-ID: 8f32b61c63be73ba
CSeq: 1 OPTIONS
Contact: <sip:a@127.0.0.1:5061>
Content-Length: 0
Payload bytes withheld: they contain the sensor's address.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|
| 51.158.204.210 | AS12876 Scaleway SAS | NL | SIP | 4 | 2026-10-10 22:19 |
| 89.163.146.51 | AS24961 WIIT AG | DE | Redis | 1 | 2026-10-05 17:40 |
Latest datagrams
2026-10-10 22:19:0951.158.204.210to 1020/udpRedisNL INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK709f7085
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=33facf24
Call-ID: e85395538dd67629
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1020/udpSIPNL OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK3928a1dd
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=5cf527de
Call-ID: 8f32b61c63be73ba
CSeq: 1 OPTIONS
Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1020/udpSIPNL REGISTER sip:<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK17ede7a5
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=361b752a
Call-ID: 5f00859983dcfa11
CSeq: 1 REGISTER
Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1020/udpSIPNL INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK72d407d2
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=85701b5d
Call-ID: 397c98da828f4940
CSeq: 1 INVITE
Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-05 17:40:4189.163.146.51to 1020/udpRedisDE INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK458a5fb7
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=31f046c8
Call-ID: 43b8da7f51f95f49
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.