UDP traffic

Datagrams matching port:5061 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

24 datagrams from 12 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 20 DTLS 3 Redis 1

Latest SIP datagram, to 5061/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830153 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830153;rport Call-ID: c1002830153 CSeq: 1002830153 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Unrecognised

4 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 5061/udp

payload bytes

00000000  00                                                |.|

Destination ports

5061/udp SIP28

Networks

AS49870 Alsycon B.V. from 1 source9
AS398324 Censys, Inc. from 4 sources5
AS23470 ReliableSite.Net LLC from 2 sources5
AS202425 IP Volume inc from 1 source4
AS24961 WIIT AG from 1 source1
AS398722 Censys, Inc. from 1 source1
AS4134 Chinanet from 1 source1
AS14618 Amazon.com, Inc. from 1 source1
AS45102 Alibaba (US) Technology Co., Ltd. from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	9	2026-10-10 03:34
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	4	2026-10-09 21:29
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-08 21:49
66.132.186.248	AS398324 Censys, Inc.	US	SIP	2	2026-10-09 14:26
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
199.45.154.191	AS398722 Censys, Inc.	US	SIP	1	2026-10-05 14:35
193.111.198.241	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:27
124.31.106.10	AS4134 Chinanet	CN	SIP	1	2026-10-10 19:01
66.132.186.210	AS398324 Censys, Inc.	US	DTLS	1	2026-10-08 23:38
100.29.192.31	AS14618 Amazon.com, Inc.	US	SIP	1	2026-10-08 06:22
66.132.159.32	AS398324 Censys, Inc.	US	DTLS	1	2026-10-10 06:00
66.132.186.211	AS398324 Censys, Inc.	US	DTLS	1	2026-10-09 22:26
47.84.101.219	AS45102 Alibaba (US) Technology Co., Ltd.	SG	SIP	1	2026-10-06 07:47

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5061/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830153 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830153;rport Call-ID: c1002830153
Payload bytes withheld: they contain the sensor's address.

2026-10-10 19:01:41124.31.106.10to 5061/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 18:23:01172.110.223.192to 5061/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826896 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826896;rport Call-ID: c1002826896
Payload bytes withheld: they contain the sensor's address.

2026-10-10 06:00:3766.132.159.32to 5061/udpDTLSUS

·q·e·e·e ·ǈ· ·)ot·=·~·~·E·)xC/p·+·/· ·/· · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 05 00 71 01 00 00  |............q...|
00000010  65 00 00 00 00 00 00 00  65 fe fd 65 0a 15 cc c7  |e.......e..e....|
00000020  c7 88 b7 17 ab 0a f2 29  6f 74 12 c5 18 d8 3d d0  |.......)ot....=.|
00000030  7e cc 7e a5 45 1b 29 78  43 2f 70 00 00 00 0c c0  |~.~.E.)xC/p.....|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 2f 00  |....+./......./.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 ff 01 00 01 00  00 0a 00 08 00 06 00 1d  |................|
00000070  00 17 00 18 00 0b 00 02  01 00 00 17 00 00        |..............|

2026-10-10 03:34:45160.119.76.127to 5061/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5061 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t963251231 Via: SIP/2.0/UDP 160.119.76.127:10031;branch=z9hG4bK-963251231;rport Call-ID: c96325
Payload bytes withheld: they contain the sensor's address.

2026-10-09 22:26:5866.132.186.211to 5061/udpDTLSUS

·q·e·e·e ·ǈ· ·)ot·=·~·~·E·)xC/p·+·/· ·/· · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 05 00 71 01 00 00  |............q...|
00000010  65 00 00 00 00 00 00 00  65 fe fd 65 0a 15 cc c7  |e.......e..e....|
00000020  c7 88 b7 17 ab 0a f2 29  6f 74 12 c5 18 d8 3d d0  |.......)ot....=.|
00000030  7e cc 7e a5 45 1b 29 78  43 2f 70 00 00 00 0c c0  |~.~.E.)xC/p.....|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 2f 00  |....+./......./.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 ff 01 00 01 00  00 0a 00 08 00 06 00 1d  |................|
00000070  00 17 00 18 00 0b 00 02  01 00 00 17 00 00        |..............|

2026-10-09 21:29:18185.242.226.68to 5061/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-09 20:27:16185.242.226.68to 5061/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-09 19:11:44185.242.226.68to 5061/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-09 18:54:51185.242.226.68to 5061/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-09 14:26:0166.132.186.248to 5061/udpSIPUS

OPTIONS sip:censysinspect@censys.io SIP/2.0 To: <sip:test.echo@sip5060.net> From: Censys <sip:censysinspect@censys.io> CSeq: 1 OPTIONS Call-ID: a84b4c76e66710 Max-Forwards: 70 Via: SIP/2.0/UDP 1

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 63 65 6e 73  |OPTIONS sip:cens|
00000010  79 73 69 6e 73 70 65 63  74 40 63 65 6e 73 79 73  |ysinspect@censys|
00000020  2e 69 6f 20 53 49 50 2f  32 2e 30 0d 0a 54 6f 3a  |.io SIP/2.0..To:|
00000030  20 3c 73 69 70 3a 74 65  73 74 2e 65 63 68 6f 40  | <sip:test.echo@|
00000040  73 69 70 35 30 36 30 2e  6e 65 74 3e 0d 0a 46 72  |sip5060.net>..Fr|
00000050  6f 6d 3a 20 43 65 6e 73  79 73 20 3c 73 69 70 3a  |om: Censys <sip:|
00000060  63 65 6e 73 79 73 69 6e  73 70 65 63 74 40 63 65  |censysinspect@ce|
00000070  6e 73 79 73 2e 69 6f 3e  0d 0a 43 53 65 71 3a 20  |nsys.io>..CSeq: |
00000080  31 20 4f 50 54 49 4f 4e  53 0d 0a 43 61 6c 6c 2d  |1 OPTIONS..Call-|
00000090  49 44 3a 20 61 38 34 62  34 63 37 36 65 36 36 37  |ID: a84b4c76e667|
000000a0  31 30 0d 0a 4d 61 78 2d  46 6f 72 77 61 72 64 73  |10..Max-Forwards|
000000b0  3a 20 37 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |: 70..Via: SIP/2|
000000c0  2e 30 2f 55 44 50 20 31  32 37 2e 30 2e 30 2e 31  |.0/UDP 127.0.0.1|
000000d0  0d 0a 41 63 63 65 70 74  3a 20 61 70 70 6c 69 63  |..Accept: applic|
000000e0  61 74 69 6f 6e 2f 73 64  70 0d 0a 43 6f 6e 74 65  |ation/sdp..Conte|
000000f0  6e 74 2d 4c 65 6e 67 74  68 3a 20 30 0d 0a 0d 0a  |nt-Length: 0....|

2026-10-09 14:08:10160.119.76.127to 5061/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5061 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305902 Via: SIP/2.0/UDP 160.119.76.127:10064;branch=z9hG4bK-2144305902;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.
2026-10-09 07:49:52160.119.76.127to 5061/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5061 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305846 Via: SIP/2.0/UDP 160.119.76.127:10039;branch=z9hG4bK-2144305846;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.

2026-10-08 23:38:1766.132.186.210to 5061/udpDTLSUS

·q·e·e·e ·ǈ· ·)ot·=·~·~·E·)xC/p·+·/· ·/· · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 05 00 71 01 00 00  |............q...|
00000010  65 00 00 00 00 00 00 00  65 fe fd 65 0a 15 cc c7  |e.......e..e....|
00000020  c7 88 b7 17 ab 0a f2 29  6f 74 12 c5 18 d8 3d d0  |.......)ot....=.|
00000030  7e cc 7e a5 45 1b 29 78  43 2f 70 00 00 00 0c c0  |~.~.E.)xC/p.....|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 2f 00  |....+./......./.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 ff 01 00 01 00  00 0a 00 08 00 06 00 1d  |................|
00000070  00 17 00 18 00 0b 00 02  01 00 00 17 00 00        |..............|

2026-10-08 21:49:30172.110.223.159to 5061/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:33643;branch=z9hG4bK-692122307;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=
Payload bytes withheld: they contain the sensor's address.