HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching port:5060 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.0K

Datagrams

259

Source addresses

78

Networks

24

Countries

1

Destination ports

Traffic by type

Other services

1,917 datagrams from 175 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1,905 Redis 12

Latest SIP datagram, to 5060/udp

INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:50058;branch=z9hG4bK2027449408 Max-Forwards: 70 From: <sip:3@<HONEYPOT>>;tag=463919779 To: <sip:80048525223031@<HONEYPOT>> Call-ID: 76594366-499248674-533846931 CSeq: 1 INVITE Contact: <sip:3@77.110.115.168:50058> C

Payload bytes withheld: they contain the sensor's address.

Unrecognised

100 datagrams from 84 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 100

Latest Unrecognised datagram, to 5060/udp

·.j2·wY·^·]7U iB·Fx?5·G;e·s3·Dv*Ra\aX6z6=Xn·eWTz·M9Rk· P·.EyY·Z5y2kti(LW:1·6

payload bytes
00000000  1b 2e 6a 32 0f 77 59 19  5e 07 5d 37 55 0d 69 42  |..j2.wY.^.]7U.iB|
00000010  14 46 78 3f 35 1e 47 3b  65 1f 73 33 0f 44 76 2a  |.Fx?5.G;e.s3.Dv*|
00000020  52 61 5c 61 58 36 7a 36  3d 58 6e 12 65 57 54 7a  |Ra\aX6z6=Xn.eWTz|
00000030  1d 4d 39 52 6b 00 0d 50  1f 01 03 2e 45 79 59 18  |.M9Rk..P....EyY.|
00000040  5a 35 79 32 6b 74 69 28  4c 57 3a 31 1a 36        |Z5y2kti(LW:1.6|

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
172.110.223.179AS23470 ReliableSite.Net LLCHKSIP5122026-10-11 07:04
77.110.115.168AS203273 NetCrafters OUUSSIP4712026-10-11 07:12
135.148.29.54AS16276 OVH SASUSSIP1132026-10-11 04:31
198.244.200.163AS16276 OVH SASGBSIP712026-10-11 06:24
51.161.136.177AS16276 OVH SASAUSIP572026-10-11 05:17
185.243.5.243AS23470 ReliableSite.Net LLCHKSIP532026-10-05 22:22
162.217.103.70AS32475 Internap Holding LLCUSSIP402026-10-11 05:52
179.43.167.3AS51852 Private Layer INCCHSIP332026-10-11 04:32
172.110.223.200AS23470 ReliableSite.Net LLCHKSIP312026-10-11 03:48
45.198.224.251AS215925 Vpsvault.host LtdUSSIP242026-10-10 20:33
16.5.0.234AS401661 EMBNEX, LLCBRSIP212026-10-11 07:10
108.178.17.26AS32475 Internap Holding LLCUSSIP192026-10-11 03:59
45.205.1.231AS215925 Vpsvault.host LtdBRSIP162026-10-09 15:05
2.57.121.120AS47890 Unmanaged LtdROSIP152026-10-06 16:22
160.119.76.127AS49870 Alsycon B.V.SCSIP142026-10-11 07:00
167.250.202.30AS265226 UNICONNECT SERVICOS DE TELECOMUNICACOES BRSIP132026-10-11 06:17
31.70.64.154AS8560 IONOS SEDESIP122026-10-11 07:04
151.243.11.230AS209630 LLC Vash Kredit BankAESIP122026-10-09 11:46
144.172.64.68AS14956 RouterHosting LLCAUSIP122026-10-11 05:38
51.158.205.153AS12876 Scaleway SASNLSIP122026-10-10 22:19

Latest datagrams