UDP traffic
Datagrams matching port:1026 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Traffic by type
Other services
5 datagrams from 2 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 1026/udp
OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK2941fab6
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=81bd14c3
Call-ID: 65514327f7842a62
CSeq: 1 OPTIONS
Contact: <sip:a@127.0.0.1:5060>
Content-Length: 0
Payload bytes withheld: they contain the sensor's address.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|
| 51.158.201.249 | AS12876 Scaleway SAS | NL | SIP | 4 | 2026-10-10 22:19 |
| 89.163.239.201 | AS24961 WIIT AG | DE | Redis | 1 | 2026-10-05 16:27 |
Latest datagrams
2026-10-10 22:19:0851.158.201.249to 1026/udpRedisNL INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKd8c0bebf
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=488d7002
Call-ID: f9b9db6c54c8df41
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1026/udpSIPNL OPTIONS sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK2941fab6
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=81bd14c3
Call-ID: 65514327f7842a62
CSeq: 1 OPTIONS
Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1026/udpSIPNL REGISTER sip:<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK260b9ad6
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=653df863
Call-ID: 8c1f50fa4d373e2a
CSeq: 1 REGISTER
Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:0851.158.201.249to 1026/udpSIPNL INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKca330865
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=4003d735
Call-ID: 7dea8f252723fb53
CSeq: 1 INVITE
Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:27:5889.163.239.201to 1026/udpRedisDE INFO sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKeb36d931
To: <sip:100@1.1.1.1>
From: <sip:100@1.1.1.1>;tag=93f6d8c3
Call-ID: b0897372e354569c
CSeq: 1 INFO
Contact:
Payload bytes withheld: they contain the sensor's address.