UDP traffic

Datagrams matching port:5090 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

21 datagrams from 7 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 19 Redis 2

Latest SIP datagram, to 5090/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK5bd9938f To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=cbab2368 Call-ID: 72633d0facc7f525 CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5063> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

Destination ports

5090/udp SIP21

Networks

AS23470 ReliableSite.Net LLC from 3 sources7
AS49870 Alsycon B.V. from 1 source6
AS12876 Scaleway SAS from 1 source4
AS51852 Private Layer INC from 1 source3
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	6	2026-10-09 14:08
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	5	2026-10-09 04:18
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	4	2026-10-10 22:19
179.43.134.194	AS51852 Private Layer INC	CH	SIP	3	2026-10-06 14:05
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-10 04:05
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-08 12:32
89.163.146.51	AS24961 WIIT AG	DE	Redis	1	2026-10-05 17:40

Latest datagrams

2026-10-10 22:19:1151.158.205.153to 5090/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKe7f25337 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=666d9a51 Call-ID: e94a5bb3730cbac2 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK5bd9938f To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=cbab2368 Call-ID: 72633d0facc7f525 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK19722ff0 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=1f6b37af Call-ID: 3b2044576cc5af2e CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK4875b1d4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=16ddafb7 Call-ID: f9454b44456dea00 CSeq: 1 INVITE Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5090/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343685 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343685;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-09 14:08:10160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305952 Via: SIP/2.0/UDP 160.119.76.127:10064;branch=z9hG4bK-2144305952;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.
2026-10-09 07:49:52160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305875 Via: SIP/2.0/UDP 160.119.76.127:10039;branch=z9hG4bK-2144305875;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.
2026-10-09 04:18:53172.110.223.200to 5090/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5331;branch=z9hG4bK-1357953679;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133653201353633383
Payload bytes withheld: they contain the sensor's address.
2026-10-08 21:47:58172.110.223.200to 5090/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:7172;branch=z9hG4bK-2010041150;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133653201313735353
Payload bytes withheld: they contain the sensor's address.
2026-10-08 20:50:07172.110.223.200to 5090/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5799;branch=z9hG4bK-1117505175;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133653201353335353
Payload bytes withheld: they contain the sensor's address.
2026-10-08 14:56:08160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2073823419 Via: SIP/2.0/UDP 160.119.76.127:10035;branch=z9hG4bK-2073823419;rport Call-ID: c207
Payload bytes withheld: they contain the sensor's address.
2026-10-08 12:32:45172.110.223.188to 5090/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5065;branch=z9hG4bK-345751559;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133653201373432323
Payload bytes withheld: they contain the sensor's address.
2026-10-07 16:36:06172.110.223.200to 5090/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:6573;branch=z9hG4bK-1897049994;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133653201363030373
Payload bytes withheld: they contain the sensor's address.
2026-10-07 15:48:06172.110.223.200to 5090/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5188;branch=z9hG4bK-2844057187;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133653201343232363
Payload bytes withheld: they contain the sensor's address.
2026-10-06 22:49:42160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2073823450 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-2073823450;rport Call-ID: c207
Payload bytes withheld: they contain the sensor's address.