UDP traffic

Datagrams matching port:5060 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.8K

Datagrams

254

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1,720 datagrams from 173 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1,708 Redis 12

Latest SIP datagram, to 5060/udp

INVITE sip:61420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 172.86.125.231:33910;branch=z9hG4bK-524287-1---1f918c9b989108b2;rport Max-Forwards: 70 From: <sip:17376490500@<HONEYPOT>>;tag=41afb7b1 To: <sip:61420163737@<HONEYPOT>:5060> Call-ID: DBnW26o831yiQ5gX9OXcbs.. CSeq: 1 I

Payload bytes withheld: they contain the sensor's address.

Unrecognised

97 datagrams from 81 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 97

Latest Unrecognised datagram, to 5060/udp

u.XUY·v:R{^j· y

payload bytes

00000000  75 2e 58 55 59 11 76 3a  52 7b 5e 6a 14 09 79     |u.XUY.v:R{^j..y|

Destination ports

5060/udp SIP1,817

Networks

AS23470 ReliableSite.Net LLC from 7 sources613
AS203273 NetCrafters OU from 1 source300
AS16276 OVH SAS from 10 sources273
AS32475 Internap Holding LLC from 2 sources56
AS12876 Scaleway SAS from 8 sources50
AS8075 Microsoft Corporation from 40 sources42
AS215925 Vpsvault.host Ltd from 2 sources40
AS51852 Private Layer INC from 3 sources40
AS14956 RouterHosting LLC from 7 sources37
AS49870 Alsycon B.V. from 5 sources34

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	509	2026-10-11 03:21
77.110.115.168	AS203273 NetCrafters OU	US	SIP	300	2026-10-11 03:28
135.148.29.54	AS16276 OVH SAS	US	SIP	111	2026-10-11 03:12
198.244.200.163	AS16276 OVH SAS	GB	SIP	70	2026-10-11 03:05
51.161.136.177	AS16276 OVH SAS	AU	SIP	56	2026-10-11 03:09
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	38	2026-10-10 22:26
179.43.167.3	AS51852 Private Layer INC	CH	SIP	32	2026-10-11 03:22
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	30	2026-10-11 02:45
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SIP	24	2026-10-10 20:33
108.178.17.26	AS32475 Internap Holding LLC	US	SIP	18	2026-10-10 04:26
16.5.0.234	AS401661 EMBNEX, LLC	BR	SIP	18	2026-10-10 07:10
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	SIP	16	2026-10-09 15:05
2.57.121.120	AS47890 Unmanaged Ltd	RO	SIP	15	2026-10-06 16:22
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	13	2026-10-10 22:30
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	12	2026-10-10 22:19
167.250.202.30	AS265226 UNICONNECT SERVICOS DE TELECOMUNICACOES	BR	SIP	12	2026-10-10 04:14
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	SIP	12	2026-10-09 11:46
144.172.64.68	AS14956 RouterHosting LLC	AU	SIP	11	2026-10-11 03:14
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	10	2026-10-10 16:48

Latest datagrams

2026-10-11 03:28:55172.86.125.231to 5060/udpSIPUS
INVITE sip:61420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 172.86.125.231:33910;branch=z9hG4bK-524287-1---1f918c9b989108b2;rport Max-Forwards: 70 From: <sip:17376490500@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:28:1877.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60285;branch=z9hG4bK1937115019 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1095873567 To: <sip:0048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:27:0077.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65049;branch=z9hG4bK901272499 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1264474260 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:25:3877.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52431;branch=z9hG4bK2078030923 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=400786037 To: <sip:+48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:24:1377.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51980;branch=z9hG4bK784180262 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=799950121 To: <sip:80048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:22:59179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28305;branch=z9hG4bK-524287-1---b7f324a56a230346 From: <sip:13493984677@0.0.0.0>;tag=6e03dcd3 To: <sip:0039
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:22:5277.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:55595;branch=z9hG4bK453747540 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=480504904 To: <sip:00148525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624245 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624245;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:3177.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65350;branch=z9hG4bK1391413057 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=2056177907 To: <sip:00948525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:20:1277.110.115.168to 5060/udpSIPUS
INVITE sip:981048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:57024;branch=z9hG4bK897449037 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=214818256 To: <sip:981048525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:18:4977.110.115.168to 5060/udpSIPUS
INVITE sip:81048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:64410;branch=z9hG4bK757650756 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=801853436 To: <sip:81048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:17:2877.110.115.168to 5060/udpSIPUS
INVITE sip:901148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51260;branch=z9hG4bK515185120 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=753098662 To: <sip:901148525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:16:0877.110.115.168to 5060/udpSIPUS
INVITE sip:01148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60479;branch=z9hG4bK751328460 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=1723691132 To: <sip:01148525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:14:4877.110.115.168to 5060/udpSIPUS
INVITE sip:048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53335;branch=z9hG4bK1005495850 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=1041379848 To: <sip:048525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:14:13144.172.64.68to 5060/udpSIPAU
INVITE sip:01261420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:29813;branch=z9hG4bK-524287-1---da105e9a14c99cb5;rport Max-Forwards: 70 From: <sip:19260344082@<HONEYP
Payload bytes withheld: they contain the sensor's address.