UDP traffic

Datagrams matching port:5070 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

26 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 24 Redis 2

Latest SIP datagram, to 5070/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830208 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830208;rport Call-ID: c1002830208 CSeq: 1002830208 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Destination ports

5070/udp SIP26

Networks

AS23470 ReliableSite.Net LLC from 4 sources14
AS12876 Scaleway SAS from 2 sources6
AS49870 Alsycon B.V. from 1 source4
AS8560 IONOS SE from 1 source1
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	6	2026-10-09 04:18
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	4	2026-10-10 22:19
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	4	2026-10-10 03:34
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	4	2026-10-09 18:57
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 06:29
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
212.83.186.8	AS12876 Scaleway SAS	FR	SIP	2	2026-10-06 17:52
31.70.77.230	AS8560 IONOS SE	DE	SIP	1	2026-10-06 11:28
89.163.146.51	AS24961 WIIT AG	DE	Redis	1	2026-10-05 17:40

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5070/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830208 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830208;rport Call-ID: c1002830208
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKa9d526ee To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=7d54f723 Call-ID: 156e57905a701642 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3b470ea1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=4ede08fc Call-ID: fc4d11f4ea6df60d CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK9f6d58ba To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=d304ec8b Call-ID: b9c951afb1040bed CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK1faf5a5d To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=ae5f33a9 Call-ID: 32170d42f12ca792 CSeq: 1 INVITE Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 18:23:01172.110.223.192to 5070/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826939 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826939;rport Call-ID: c1002826939
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:29:04172.110.223.179to 5070/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2493216033 Via: SIP/2.0/UDP 172.110.223.179:10006;branch=z9hG4bK-2493216033;rport Call-ID: c24
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5070/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343597 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343597;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-10 03:34:45160.119.76.127to 5070/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t963251336 Via: SIP/2.0/UDP 160.119.76.127:10031;branch=z9hG4bK-963251336;rport Call-ID: c96325
Payload bytes withheld: they contain the sensor's address.
2026-10-10 00:21:34160.119.76.127to 5070/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3703223608 Via: SIP/2.0/UDP 160.119.76.127:10047;branch=z9hG4bK-3703223608;rport Call-ID: c370
Payload bytes withheld: they contain the sensor's address.
2026-10-09 18:57:58172.110.223.188to 5070/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5068;branch=z9hG4bK-2753842406;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133636501323030363
Payload bytes withheld: they contain the sensor's address.
2026-10-09 15:36:28172.110.223.188to 5070/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5068;branch=z9hG4bK-829528535;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336365013133383433
Payload bytes withheld: they contain the sensor's address.
2026-10-09 14:08:10160.119.76.127to 5070/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144306007 Via: SIP/2.0/UDP 160.119.76.127:10064;branch=z9hG4bK-2144306007;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.
2026-10-09 13:07:05172.110.223.188to 5070/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-1031264170;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133636501383035313
Payload bytes withheld: they contain the sensor's address.
2026-10-09 10:40:21172.110.223.188to 5070/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-1626731005;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133636501323835373
Payload bytes withheld: they contain the sensor's address.