UDP traffic

Datagrams matching port:5006 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2

Latest SIP datagram, to 5006/udp

INVITE sip:10000@<HONEYPOT>:5006 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3926972959 Via: SIP/2.0/UDP 172.110.223.179:10010;branch=z9hG4bK-3926972959;rport Call-ID: c3926972959 CSeq: 3926972959 INVITE Contact: <sip:10000@172.110.223.179:10010> Max-Forwards: 70 Use

Payload bytes withheld: they contain the sensor's address.

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 5006/udp

W· ·

payload bytes

00000000  57 00 00 00 00 11 11 07  00 00 ff ff 03 00 00 fe  |W...............|
00000010  03 00 00 14 00 1c 08 0a  08 00 00 00 00 00 00 00  |................|
00000020  04 01 01 01 00 00 00 00  01                       |.........|

Destination ports

5006/udp SIP3

Networks

AS23470 ReliableSite.Net LLC from 1 source2
AS10439 CariNet, Inc. from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 12:39
66.240.236.119	AS10439 CariNet, Inc.	US	Unrecognised	1	2026-10-11 01:20

Latest datagrams

2026-10-11 01:20:3466.240.236.119to 5006/udpUnrecognisedUS

W· ·

payload bytes

00000000  57 00 00 00 00 11 11 07  00 00 ff ff 03 00 00 fe  |W...............|
00000010  03 00 00 14 00 1c 08 0a  08 00 00 00 00 00 00 00  |................|
00000020  04 01 01 01 00 00 00 00  01                       |.........|

2026-10-10 12:39:31172.110.223.179to 5006/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5006 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3926972959 Via: SIP/2.0/UDP 172.110.223.179:10010;branch=z9hG4bK-3926972959;rport Call-ID: c39
Payload bytes withheld: they contain the sensor's address.
2026-10-10 08:49:27172.110.223.179to 5006/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5006 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3039755162 Via: SIP/2.0/UDP 172.110.223.179:10062;branch=z9hG4bK-3039755162;rport Call-ID: c30
Payload bytes withheld: they contain the sensor's address.