UDP traffic

Datagrams matching port:4050 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2

Latest SIP datagram, to 4050/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6573;branch=z9hG4bK-3453832159;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932306664320131333737353236313233 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1

Payload bytes withheld: they contain the sensor's address.

Unrecognised

2 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 2

Latest Unrecognised datagram, to 4050/udp

discover;013;

payload bytes

00000000  64 69 73 63 6f 76 65 72  3b 30 31 33 3b           |discover;013;|

Destination ports

4050/udp SIP4

Networks

AS23470 ReliableSite.Net LLC from 1 source2
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 2 sources2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-07 16:36
165.154.120.89	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	TH	Unrecognised	1	2026-10-07 01:57
152.32.141.199	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	NG	Unrecognised	1	2026-10-07 23:50

Latest datagrams

2026-10-07 23:50:41152.32.141.199to 4050/udpUnrecognisedNG
discover;013;
payload bytes
```
00000000  64 69 73 63 6f 76 65 72  3b 30 31 33 3b           |discover;013;|
```
2026-10-07 16:36:06172.110.223.200to 4050/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6573;branch=z9hG4bK-3453832159;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323066643201313337373
Payload bytes withheld: they contain the sensor's address.
2026-10-07 15:48:06172.110.223.200to 4050/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5188;branch=z9hG4bK-3402930162;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393066643201313432333
Payload bytes withheld: they contain the sensor's address.
2026-10-07 01:57:18165.154.120.89to 4050/udpUnrecognisedTH
discover;013;
payload bytes
```
00000000  64 69 73 63 6f 76 65 72  3b 30 31 33 3b           |discover;013;|
```