UDP traffic
Datagrams matching port:1021 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Traffic by type
Other services
5 datagrams from 2 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 1021/udp
OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bKb046ac59
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=f841741
Call-ID: 993446c6956d5f27
CSeq: 1 OPTIONS
Contact: <sip:a@127.0.0.1:5061>
Content-Length: 0
Payload bytes withheld: they contain the sensor's address.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|
| 51.158.204.210 | AS12876 Scaleway SAS | NL | SIP | 4 | 2026-10-10 22:19 |
| 89.163.239.201 | AS24961 WIIT AG | DE | Redis | 1 | 2026-10-05 16:27 |
Latest datagrams
2026-10-10 22:19:0951.158.204.210to 1021/udpRedisNL INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK3d8b65f3
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=b0676ff8
Call-ID: 82927e7965418c2b
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1021/udpSIPNL OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bKb046ac59
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=f841741
Call-ID: 993446c6956d5f27
CSeq: 1 OPTIONS
Cont
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1021/udpSIPNL REGISTER sip:<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bKfe1c9531
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=ccd5c05b
Call-ID: d42ac83c428ef2f
CSeq: 1 REGISTER
Contac
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0951.158.204.210to 1021/udpSIPNL INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK78bb39e1
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=ca1c17d2
Call-ID: 14ccbc734e011d1b
CSeq: 1 INVITE
Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:27:5889.163.239.201to 1021/udpRedisDE INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3fad2bcf
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=97516258
Call-ID: 4082afbd4a3eb9bc
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.