UDP traffic

Datagrams matching port:5071 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

14 datagrams from 5 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 13 Redis 1

Latest SIP datagram, to 5071/udp

REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830214 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830214;rport Call-ID: c1002830214 CSeq: 1002830214 REGISTER Contact: <sip:10000@172.110.223.192:10016> Max-Forwards: 70 Expires: 3

Payload bytes withheld: they contain the sensor's address.

Destination ports

5071/udp SIP14

Networks

AS23470 ReliableSite.Net LLC from 4 sources13
AS24961 WIIT AG from 1 source1

Countries

HK Hong Kong13
DE Germany1

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	5	2026-10-09 18:57
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	4	2026-10-10 07:12
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 06:29
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-10 23:43
193.111.198.241	AS24961 WIIT AG	DE	Redis	1	2026-10-05 16:27

Latest datagrams

2026-10-10 23:43:01172.110.223.192to 5071/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002830214 Via: SIP/2.0/UDP 172.110.223.192:10016;branch=z9hG4bK-1002830214;rport Call-ID: c1002830214
Payload bytes withheld: they contain the sensor's address.
2026-10-10 18:23:01172.110.223.192to 5071/udpSIPHK
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1002826948 Via: SIP/2.0/UDP 172.110.223.192:10048;branch=z9hG4bK-1002826948;rport Call-ID: c1002826948
Payload bytes withheld: they contain the sensor's address.
2026-10-10 07:12:44172.110.223.200to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:14105;branch=z9hG4bK-2304899896;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363660131333635
Payload bytes withheld: they contain the sensor's address.
2026-10-10 06:29:04172.110.223.179to 5071/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5071 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2493216041 Via: SIP/2.0/UDP 172.110.223.179:10006;branch=z9hG4bK-2493216041;rport Call-ID: c24
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5071/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5071 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343599 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343599;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-09 18:57:58172.110.223.188to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5068;branch=z9hG4bK-849794496;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336366013131313730
Payload bytes withheld: they contain the sensor's address.
2026-10-09 15:36:28172.110.223.188to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5068;branch=z9hG4bK-3850062912;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133636601343230343
Payload bytes withheld: they contain the sensor's address.
2026-10-09 13:07:05172.110.223.188to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-413147217;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=303561666237383431336366013238303338
Payload bytes withheld: they contain the sensor's address.
2026-10-09 10:40:21172.110.223.188to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-1120174899;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133636601333935303
Payload bytes withheld: they contain the sensor's address.
2026-10-08 12:32:45172.110.223.188to 5071/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5065;branch=z9hG4bK-2802523680;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363660132393334
Payload bytes withheld: they contain the sensor's address.
2026-10-07 00:11:43172.110.223.200to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:7833;branch=z9hG4bK-2352789346;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133636601343131323
Payload bytes withheld: they contain the sensor's address.
2026-10-06 14:32:55172.110.223.200to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6438;branch=z9hG4bK-1157521942;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133636601313534313
Payload bytes withheld: they contain the sensor's address.
2026-10-06 12:53:44172.110.223.200to 5071/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5118;branch=z9hG4bK-2412407044;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133636601313038373
Payload bytes withheld: they contain the sensor's address.
2026-10-05 16:27:46193.111.198.241to 5071/udpRedisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5061;branch=z9hG4bK1abf1b5f To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=bb7552a9 Call-ID: cd093de9a2e72359 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.