UDP traffic

Datagrams matching port:5090 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

29 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 26 Redis 3

Latest SIP datagram, to 5090/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:29642;branch=z9hG4bK-1081033620;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313365320133393033343737373631 User-Agent: VOIP Call-ID: 267345400511020507226600

Payload bytes withheld: they contain the sensor's address.

Destination ports

5090/udp SIP29

Networks

AS12876 Scaleway SAS from 1 source8
AS23470 ReliableSite.Net LLC from 4 sources8
AS49870 Alsycon B.V. from 1 source6
AS208686 Nordic Servers AS from 1 source3
AS51852 Private Layer INC from 1 source3
AS24961 WIIT AG from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	8	2026-10-11 15:25
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	6	2026-10-09 14:08
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	5	2026-10-09 04:18
179.43.134.194	AS51852 Private Layer INC	CH	SIP	3	2026-10-06 14:05
151.240.121.146	AS208686 Nordic Servers AS	NO	SIP	3	2026-10-11 14:32
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-11 23:12
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-10 04:05
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	1	2026-10-08 12:32
89.163.146.51	AS24961 WIIT AG	DE	Redis	1	2026-10-05 17:40

Latest datagrams

2026-10-11 23:12:12172.110.223.159to 5090/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.159:29642;branch=z9hG4bK-1081033620;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag
Payload bytes withheld: they contain the sensor's address.
2026-10-11 15:25:0651.158.205.153to 5090/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKb5cd8bf4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=2b7c6de3 Call-ID: 48407390e23f7014 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-11 15:25:0651.158.205.153to 5090/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKfa5708e3 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a519fe32 Call-ID: 1d29076e987d8df8 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-11 15:25:0651.158.205.153to 5090/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK103d7ecc To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=d6f93731 Call-ID: 19a654e6bd76014e CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-11 15:25:0651.158.205.153to 5090/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKc250c8d To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=9b47c5d4 Call-ID: bc96d585cbc1291f CSeq: 1 INVITE Contac
Payload bytes withheld: they contain the sensor's address.
2026-10-11 14:32:09151.240.121.146to 5090/udpSIPNO
MESSAGE sip:201021112424@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 151.240.121.146:5090;branch=z9hG4bK.KelB8EsLh;rport From: <sip:1000@<HONEYPOT>>;tag=MELocG97Qm4i To: sip:201021112424@<HONEYPOT> CSeq:
Payload bytes withheld: they contain the sensor's address.
2026-10-11 14:32:08151.240.121.146to 5090/udpSIPNO
MESSAGE sip:201021112424@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 151.240.121.146:5090;branch=z9hG4bK.Ucqbsq5wD;rport From: <sip:1002@<HONEYPOT>>;tag=YCHNoYc0Y2JC To: sip:201021112424@<HONEYPOT> CSeq:
Payload bytes withheld: they contain the sensor's address.
2026-10-11 14:32:07151.240.121.146to 5090/udpSIPNO
MESSAGE sip:201021112424@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 151.240.121.146:5090;branch=z9hG4bK.ruK0nrOr0;rport From: <sip:1001@<HONEYPOT>>;tag=1RNXk03J37Qt To: sip:201021112424@<HONEYPOT> CSeq:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKe7f25337 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=666d9a51 Call-ID: e94a5bb3730cbac2 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK5bd9938f To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=cbab2368 Call-ID: 72633d0facc7f525 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
REGISTER sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK19722ff0 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=1f6b37af Call-ID: 3b2044576cc5af2e CSeq: 1 REGISTER Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK4875b1d4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=16ddafb7 Call-ID: f9454b44456dea00 CSeq: 1 INVITE Conta
Payload bytes withheld: they contain the sensor's address.
2026-10-10 04:05:19172.110.223.179to 5090/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2590343685 Via: SIP/2.0/UDP 172.110.223.179:10060;branch=z9hG4bK-2590343685;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-09 14:08:10160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305952 Via: SIP/2.0/UDP 160.119.76.127:10064;branch=z9hG4bK-2144305952;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.
2026-10-09 07:49:52160.119.76.127to 5090/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5090 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2144305875 Via: SIP/2.0/UDP 160.119.76.127:10039;branch=z9hG4bK-2144305875;rport Call-ID: c214
Payload bytes withheld: they contain the sensor's address.