UDP traffic

Datagrams matching port:50000 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2

Latest SIP datagram, to 50000/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1512239646;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353001333535373233353735 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Co

Payload bytes withheld: they contain the sensor's address.

Unrecognised

3 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 3

Latest Unrecognised datagram, to 50000/udp

DB2GETADDR·SQL08010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 38  |DB2GETADDR.SQL08|
00000010  30 31 30 00                                       |010.|

Destination ports

50000/udp5

Networks

AS16276 OVH SAS from 1 source2
AS396982 Google LLC from 2 sources2
AS8075 Microsoft Corporation from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.161.57.3	AS16276 OVH SAS	CA	SIP	2	2026-10-10 14:23
147.185.132.40	AS396982 Google LLC	US	Unrecognised	1	2026-10-10 15:48
20.51.209.165	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-10 10:53
205.210.31.104	AS396982 Google LLC	US	Unrecognised	1	2026-10-10 14:00

Latest datagrams

2026-10-10 15:48:23147.185.132.40to 50000/udpUnrecognisedUS

DB2GETADDR·SQL08010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 38  |DB2GETADDR.SQL08|
00000010  30 31 30 00                                       |010.|

2026-10-10 14:23:2851.161.57.3to 50000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1512239646;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353001333535373233
Payload bytes withheld: they contain the sensor's address.

2026-10-10 14:00:59205.210.31.104to 50000/udpUnrecognisedUS

DB2GETADDR·SQL08010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 38  |DB2GETADDR.SQL08|
00000010  30 31 30 00                                       |010.|

2026-10-10 10:53:4520.51.209.165to 50000/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_50000
Payload bytes withheld: they contain the sensor's address.
2026-10-10 09:44:2551.161.57.3to 50000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:6235;branch=z9hG4bK-4276770963;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346333353001333931393531
Payload bytes withheld: they contain the sensor's address.