UDP traffic

Datagrams matching port:1023 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

5 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 3 Redis 2

Latest SIP datagram, to 1023/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK5d8ec1d4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a0112957 Call-ID: f3740f29058f53b3 CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5060> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

Unrecognised

4 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 1023/udp

payload bytes

00000000  00                                                |.|

Destination ports

1023/udp9

Networks

AS12876 Scaleway SAS from 1 source4
AS202425 IP Volume inc from 1 source4
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	4	2026-10-10 22:19
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	4	2026-10-08 20:53
193.111.198.244	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:28

Latest datagrams

2026-10-10 22:19:0851.158.201.249to 1023/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKc81cbb81 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=c8be42b6 Call-ID: ddfaeaa5247665ca CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1023/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK5d8ec1d4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a0112957 Call-ID: f3740f29058f53b3 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1023/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKec43d8f8 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=fee06149 Call-ID: 1f8303ad9fbbbec5 CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1023/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKbaee34ac To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=f50943c5 Call-ID: d8f9fd23e0bad3cb CSeq: 1 INVITE Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-08 20:53:59185.242.226.166to 1023/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-08 19:51:41185.242.226.166to 1023/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-08 18:38:20185.242.226.166to 1023/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-08 18:21:05185.242.226.166to 1023/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-05 16:28:24193.111.198.244to 1023/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK6f707306 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a7129260 Call-ID: d6ddc7fbeb4a3b70 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.