UDP traffic

Datagrams matching port:1025 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

6 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 3 Redis 2 SOCKS5 1

Latest SIP datagram, to 1025/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKeded8b44 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=96980152 Call-ID: 6b8a15d8ead8b220 CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5060> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

Destination ports

1025/udp SIP6

Networks

AS12876 Scaleway SAS from 1 source4
AS24961 WIIT AG from 1 source1
AS45102 Alibaba (US) Technology Co., Ltd. from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	4	2026-10-10 22:19
47.89.251.254	AS45102 Alibaba (US) Technology Co., Ltd.	US	SOCKS5	1	2026-10-08 15:27
193.111.198.241	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:27

Latest datagrams

2026-10-10 22:19:0851.158.201.249to 1025/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKaf90df3d To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=2e9991c3 Call-ID: a269eee672e0be01 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1025/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKeded8b44 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=96980152 Call-ID: 6b8a15d8ead8b220 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1025/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK95f22f9b To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=65a94d04 Call-ID: 22eef2f2c43f25d0 CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1025/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKa74ce2a3 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=5822b3a6 Call-ID: 6185991981adde9e CSeq: 1 INVITE Conta
Payload bytes withheld: they contain the sensor's address.

2026-10-08 15:27:3547.89.251.254to 1025/udpSOCKS5US

·H·#Eg·#Eg·ܺ·vT2·#Eg·

payload bytes

00000000  05 00 0b 03 10 00 00 00  48 00 00 00 01 00 00 00  |........H.......|
00000010  b8 10 b8 10 00 00 00 00  01 00 00 00 00 00 01 00  |................|
00000020  01 23 45 67 89 ab cd ef  01 23 45 67 89 ab cd ef  |.#Eg.....#Eg....|
00000030  e7 03 00 00 fe dc ba 98  76 54 32 10 01 23 45 67  |........vT2..#Eg|
00000040  89 ab cd ef e7 03 00 00                           |........|

2026-10-05 16:27:46193.111.198.241to 1025/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bKdd5d9960 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=8c097a52 Call-ID: 540d211de5ea5952 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.