UDP traffic

Datagrams matching port:5069 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

14 datagrams from 6 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 13 Redis 1

Latest SIP datagram, to 5069/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830201 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830201;rport Call-ID: c1002830201 CSeq: 1002830201 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Destination ports

5069/udp SIP14

Networks

AS23470 ReliableSite.Net LLC from 4 sources10
AS53667 FranTech Solutions from 1 source3
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	4	2026-10-10 07:12
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-08 21:49
199.195.250.193	AS53667 FranTech Solutions	US	SIP	3	2026-10-09 09:56
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-10 06:29
193.111.198.244	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:28

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5069/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830201 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830201;rport Call-ID: c1002830201
Payload bytes withheld: they contain the sensor's address.
2026-10-10 18:23:01172.110.223.192to 5069/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826935 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826935;rport Call-ID: c1002826935
Payload bytes withheld: they contain the sensor's address.
2026-10-10 07:12:44172.110.223.200to 5069/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:14105;branch=z9hG4bK-2343153781;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363640133343834
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:29:04172.110.223.179to 5069/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5069 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2493216029 Via: SIP/2.0/UDP 172.110.223.179:10006;branch=z9hG4bK-2493216029;rport Call-ID: c24
Payload bytes withheld: they contain the sensor's address.
2026-10-09 09:56:49199.195.250.193to 5069/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=49eb6f664 Via: SIP/2.0/UDP 199.195.250.193:53571;branch=z9hG4bK-d87543-310053152-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 08:47:48199.195.250.193to 5069/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=30f295e8e Via: SIP/2.0/UDP 199.195.250.193:53705;branch=z9hG4bK-d87543-889351052-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 04:50:25199.195.250.193to 5069/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=7459a7ee0 Via: SIP/2.0/UDP 199.195.250.193:61840;branch=z9hG4bK-d87543-201535558-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-08 21:49:30172.110.223.159to 5069/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:33643;branch=z9hG4bK-4135854625;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-08 13:29:08172.110.223.159to 5069/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:35090;branch=z9hG4bK-42021407;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6
Payload bytes withheld: they contain the sensor's address.
2026-10-08 01:03:20172.110.223.159to 5069/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:41744;branch=z9hG4bK-2480025281;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-07 00:11:43172.110.223.200to 5069/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:7833;branch=z9hG4bK-1186331546;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133636401323533393
Payload bytes withheld: they contain the sensor's address.
2026-10-06 14:32:55172.110.223.200to 5069/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6438;branch=z9hG4bK-3649717362;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133636401313338353
Payload bytes withheld: they contain the sensor's address.
2026-10-06 12:53:44172.110.223.200to 5069/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5118;branch=z9hG4bK-4224789265;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133636401333738373
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:28:24193.111.198.244to 5069/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bKc6b211b6 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=1da7d815 Call-ID: d07ac496da39212 CSeq: 1 INFO Contact: <
Payload bytes withheld: they contain the sensor's address.