UDP traffic

Datagrams matching port:5067 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

15 datagrams from 7 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 14 Redis 1

Latest SIP datagram, to 5067/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830191 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830191;rport Call-ID: c1002830191 CSeq: 1002830191 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Destination ports

5067/udp SIP15

Networks

AS23470 ReliableSite.Net LLC from 5 sources10
AS53667 FranTech Solutions from 1 source4
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
199.195.250.193	AS53667 FranTech Solutions	US	SIP	4	2026-10-09 00:48
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-08 21:49
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 06:29
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 07:12
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
89.163.239.201	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:27
185.243.5.10	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-10 06:57

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5067/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830191 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830191;rport Call-ID: c1002830191
Payload bytes withheld: they contain the sensor's address.
2026-10-10 18:23:01172.110.223.192to 5067/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826922 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826922;rport Call-ID: c1002826922
Payload bytes withheld: they contain the sensor's address.
2026-10-10 07:12:44172.110.223.200to 5067/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:14105;branch=z9hG4bK-2862375958;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363620131333336
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:57:13185.243.5.10to 5067/udpSIPHK
REGISTER sip:<HONEYPOT>:5067 SIP/2.0 To: <sip:1000@<HONEYPOT>> From: <sip:1000@<HONEYPOT>>;tag=e5f4a3385838370831777EBC Via: SIP/2.0/UDP 185.243.5.10:62893;branch=z9hG4bK-d87543-398712370831778-1--
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:29:04172.110.223.179to 5067/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5067 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2493216022 Via: SIP/2.0/UDP 172.110.223.179:10006;branch=z9hG4bK-2493216022;rport Call-ID: c24
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5067/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5067 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343585 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343585;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-09 00:48:18199.195.250.193to 5067/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=7b1ec2e76 Via: SIP/2.0/UDP 199.195.250.193:51130;branch=z9hG4bK-d87543-145250266-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 23:28:55199.195.250.193to 5067/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=e8f784fd8 Via: SIP/2.0/UDP 199.195.250.193:55692;branch=z9hG4bK-d87543-249002795-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 21:49:30172.110.223.159to 5067/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:33643;branch=z9hG4bK-1109665561;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-08 14:10:51199.195.250.193to 5067/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=1036f8429 Via: SIP/2.0/UDP 199.195.250.193:61618;branch=z9hG4bK-d87543-950234453-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 13:29:08172.110.223.159to 5067/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:35090;branch=z9hG4bK-4276779952;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-08 12:58:11199.195.250.193to 5067/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=540bf8173 Via: SIP/2.0/UDP 199.195.250.193:49388;branch=z9hG4bK-d87543-713859106-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 01:03:20172.110.223.159to 5067/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:41744;branch=z9hG4bK-823824960;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=
Payload bytes withheld: they contain the sensor's address.
2026-10-06 14:32:55172.110.223.200to 5067/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6438;branch=z9hG4bK-79292750;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363620138393731383
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:27:5889.163.239.201to 5067/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKdcbdd4cf To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=f9a47ca6 Call-ID: 5a084549a246ac57 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.