UDP traffic

Datagrams matching port:5064 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

14 datagrams from 7 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 13 Redis 1

Latest SIP datagram, to 5064/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830172 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830172;rport Call-ID: c1002830172 CSeq: 1002830172 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Destination ports

5064/udp SIP14

Networks

AS23470 ReliableSite.Net LLC from 4 sources9
AS53667 FranTech Solutions from 2 sources4
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-08 21:49
199.195.250.193	AS53667 FranTech Solutions	US	SIP	3	2026-10-09 08:22
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 06:29
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-07 00:11
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
193.111.198.244	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:28
198.98.57.120	AS53667 FranTech Solutions	US	SIP	1	2026-10-06 10:36

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5064/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830172 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830172;rport Call-ID: c1002830172
Payload bytes withheld: they contain the sensor's address.
2026-10-10 18:23:01172.110.223.192to 5064/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826909 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826909;rport Call-ID: c1002826909
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:29:04172.110.223.179to 5064/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5064 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2493216012 Via: SIP/2.0/UDP 172.110.223.179:10006;branch=z9hG4bK-2493216012;rport Call-ID: c24
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5064/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5064 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343574 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343574;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-09 08:22:09199.195.250.193to 5064/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=303e8cd91 Via: SIP/2.0/UDP 199.195.250.193:49168;branch=z9hG4bK-d87543-402204865-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 03:30:56199.195.250.193to 5064/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=bd953d7ec Via: SIP/2.0/UDP 199.195.250.193:64043;branch=z9hG4bK-d87543-122486415-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 00:21:02199.195.250.193to 5064/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=c73c11e7b Via: SIP/2.0/UDP 199.195.250.193:61138;branch=z9hG4bK-d87543-301243131-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 21:49:30172.110.223.159to 5064/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:33643;branch=z9hG4bK-3855741773;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-08 13:29:08172.110.223.159to 5064/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:35090;branch=z9hG4bK-1066132197;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-08 01:03:20172.110.223.159to 5064/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:41744;branch=z9hG4bK-3596441606;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-07 00:11:43172.110.223.200to 5064/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:7833;branch=z9hG4bK-147465994;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653331336338013136353535
Payload bytes withheld: they contain the sensor's address.
2026-10-06 12:53:44172.110.223.200to 5064/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5118;branch=z9hG4bK-3659145668;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633801313836303
Payload bytes withheld: they contain the sensor's address.
2026-10-06 10:36:01198.98.57.120to 5064/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10019854054@<HONEYPOT>> From: <sip:10019854054@<HONEYPOT>>;tag=67c900090 Via: SIP/2.0/UDP 198.98.57.120:61368;branch=z9hG4bK-d87543-189205515-1--d87543;rpor
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:28:24193.111.198.244to 5064/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK3794f7fe To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=2b1be191 Call-ID: b6de9368efb0509f CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.