UDP traffic
Datagrams matching port:6060 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
17
Datagrams
11
Source addresses
7
Networks
8
Countries
1
Destination ports
Traffic by type
Other services
17 datagrams from 11 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 6060/udp
payload bytes
00000000 52 45 47 49 53 54 45 52 20 73 69 70 3a 00 5c 2e |REGISTER sip:.\.| 00000010 30 5c 2e 30 5c 2e 30 20 53 49 50 2f 32 2e 30 0d |0\.0\.0 SIP/2.0.| 00000020 0a 56 69 61 3a 20 53 49 50 2f 32 2e 30 2f 55 44 |.Via: SIP/2.0/UD| 00000030 50 20 31 39 32 2e 31 36 38 2e 30 2e 32 33 35 3a |P 192.168.0.235:| 00000040 35 32 35 33 35 3b 72 70 6f 72 74 3b 62 72 61 6e |52535;rport;bran| 00000050 63 68 3d 7a 39 68 47 34 62 4b 50 6a 36 66 64 66 |ch=z9hG4bKPj6fdf| 00000060 31 66 37 35 61 63 38 38 34 61 63 30 62 32 39 65 |1f75ac884ac0b29e| 00000070 36 32 39 36 37 37 61 33 35 66 61 38 0d 0a 4d 61 |629677a35fa8..Ma| 00000080 78 2d 46 6f 72 77 61 72 64 73 3a 20 37 30 0d 0a |x-Forwards: 70..| 00000090 46 72 6f 6d 3a 20 3c 73 69 70 3a 61 73 64 61 64 |From: <sip:asdad| 000000a0 40 31 32 33 31 32 33 3e 3b 74 61 67 3d 66 30 38 |@123123>;tag=f08| 000000b0 39 61 65 32 38 35 34 32 32 34 65 62 33 62 30 62 |9ae2854224eb3b0b| 000000c0 35 64 34 65 30 65 35 64 34 63 61 66 62 0d 0a 54 |5d4e0e5d4cafb..T| 000000d0 6f 3a 20 3c 73 69 70 3a 61 73 64 61 64 40 31 32 |o: <sip:asdad@12| 000000e0 33 31 32 33 3e 0d 0a 43 61 6c 6c 2d 49 44 3a 20 |3123>..Call-ID: | 000000f0 33 38 30 37 63 66 35 34 64 63 36 37 34 35 31 33 |3807cf54dc674513|
Destination ports
- 6060/udp SIP17
Networks
- AS396982 Google LLC from 4 sources4
- AS49870 Alsycon B.V. from 1 source4
- AS23470 ReliableSite.Net LLC from 1 source3
- AS16276 OVH SAS from 1 source2
- AS45102 Alibaba (US) Technology Co., Ltd. from 2 sources2
- AS24961 WIIT AG from 1 source1
- AS4134 Chinanet from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 160.119.76.127 | AS49870 Alsycon B.V. | SC | SIP | 4 | 2026-10-10 03:34 |
| 172.110.223.200 | AS23470 ReliableSite.Net LLC | HK | SIP | 3 | 2026-10-07 22:23 |
| 51.161.57.3 | AS16276 OVH SAS | CA | SIP | 2 | 2026-10-07 11:16 |
| 35.203.210.3 | AS396982 Google LLC | GB | SIP | 1 | 2026-10-09 13:22 |
| 125.84.251.37 | AS4134 Chinanet | CN | SIP | 1 | 2026-10-10 06:50 |
| 216.25.89.118 | AS396982 Google LLC | US | SIP | 1 | 2026-10-08 01:58 |
| 47.88.90.74 | AS45102 Alibaba (US) Technology Co., Ltd. | US | SIP | 1 | 2026-10-10 17:36 |
| 147.185.132.35 | AS396982 Google LLC | US | SIP | 1 | 2026-10-10 09:57 |
| 193.111.198.244 | AS24961 WIIT AG | DE | Redis | 1 | 2026-10-05 16:28 |
| 47.84.203.235 | AS45102 Alibaba (US) Technology Co., Ltd. | SG | SIP | 1 | 2026-10-06 16:58 |
| 162.216.149.209 | AS396982 Google LLC | US | SIP | 1 | 2026-10-09 22:20 |
Latest datagrams
payload bytes
00000000 52 45 47 49 53 54 45 52 20 73 69 70 3a 00 5c 2e |REGISTER sip:.\.| 00000010 30 5c 2e 30 5c 2e 30 20 53 49 50 2f 32 2e 30 0d |0\.0\.0 SIP/2.0.| 00000020 0a 56 69 61 3a 20 53 49 50 2f 32 2e 30 2f 55 44 |.Via: SIP/2.0/UD| 00000030 50 20 31 39 32 2e 31 36 38 2e 30 2e 32 33 35 3a |P 192.168.0.235:| 00000040 35 32 35 33 35 3b 72 70 6f 72 74 3b 62 72 61 6e |52535;rport;bran| 00000050 63 68 3d 7a 39 68 47 34 62 4b 50 6a 36 66 64 66 |ch=z9hG4bKPj6fdf| 00000060 31 66 37 35 61 63 38 38 34 61 63 30 62 32 39 65 |1f75ac884ac0b29e| 00000070 36 32 39 36 37 37 61 33 35 66 61 38 0d 0a 4d 61 |629677a35fa8..Ma| 00000080 78 2d 46 6f 72 77 61 72 64 73 3a 20 37 30 0d 0a |x-Forwards: 70..| 00000090 46 72 6f 6d 3a 20 3c 73 69 70 3a 61 73 64 61 64 |From: <sip:asdad| 000000a0 40 31 32 33 31 32 33 3e 3b 74 61 67 3d 66 30 38 |@123123>;tag=f08| 000000b0 39 61 65 32 38 35 34 32 32 34 65 62 33 62 30 62 |9ae2854224eb3b0b| 000000c0 35 64 34 65 30 65 35 64 34 63 61 66 62 0d 0a 54 |5d4e0e5d4cafb..T| 000000d0 6f 3a 20 3c 73 69 70 3a 61 73 64 61 64 40 31 32 |o: <sip:asdad@12| 000000e0 33 31 32 33 3e 0d 0a 43 61 6c 6c 2d 49 44 3a 20 |3123>..Call-ID: | 000000f0 33 38 30 37 63 66 35 34 64 63 36 37 34 35 31 33 |3807cf54dc674513| ... 504 bytes shown in part
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 6e 6d 20 53 |OPTIONS sip:nm S| 00000010 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 50 |IP/2.0..Via: SIP| 00000020 2f 32 2e 30 2f 55 44 50 20 6e 6d 3b 62 72 61 6e |/2.0/UDP nm;bran| 00000030 63 68 3d 66 6f 6f 3b 72 70 6f 72 74 0d 0a 4d 61 |ch=foo;rport..Ma| 00000040 78 2d 46 6f 72 77 61 72 64 73 3a 20 37 30 0d 0a |x-Forwards: 70..| 00000050 54 6f 3a 20 3c 73 69 70 3a 6e 6d 40 6e 6d 3e 0d |To: <sip:nm@nm>.| 00000060 0a 46 72 6f 6d 3a 20 3c 73 69 70 3a 6e 6d 40 6e |.From: <sip:nm@n| 00000070 6d 3e 3b 74 61 67 3d 72 6f 6f 74 0d 0a 43 61 6c |m>;tag=root..Cal| 00000080 6c 2d 49 44 3a 20 35 30 30 30 30 0d 0a 43 53 65 |l-ID: 50000..CSe| 00000090 71 3a 20 36 33 31 30 34 20 4f 50 54 49 4f 4e 53 |q: 63104 OPTIONS| 000000a0 0d 0a 43 6f 6e 74 61 63 74 3a 20 3c 73 69 70 3a |..Contact: <sip:| 000000b0 6e 6d 40 6e 6d 3e 0d 0a 41 63 63 65 70 74 3a 20 |nm@nm>..Accept: | 000000c0 61 70 70 6c 69 63 61 74 69 6f 6e 2f 73 64 70 0d |application/sdp.| 000000d0 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a |.Content-Length:| 000000e0 20 30 0d 0a 0d 0a | 0....|
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.