UDP traffic

Datagrams matching port:65476 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

12 datagrams from 4 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 12

Latest SIP datagram, to 65476/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-290398993;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533666663340134303030353831353631 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Destination ports

65476/udp SIP12

Networks

AS23470 ReliableSite.Net LLC from 2 sources9
AS16276 OVH SAS from 1 source2
AS44382 Fiba Cloud Operation Company, LLC from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	7	2026-10-11 01:32
51.161.57.3	AS16276 OVH SAS	CA	SIP	2	2026-10-07 11:16
185.243.5.164	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-08 20:03
45.141.148.75	AS44382 Fiba Cloud Operation Company, LLC	TR	SIP	1	2026-10-07 19:13

Latest datagrams

2026-10-11 01:32:04172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-290398993;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666334013430303035
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:15:45172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5072;branch=z9hG4bK-1733294988;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163396666633401323439343
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:15:05172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-2912102874;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633401313531373
Payload bytes withheld: they contain the sensor's address.
2026-10-08 20:03:21185.243.5.164to 65476/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 185.243.5.164:5095;branch=z9hG4bK-4039945142;rport Content-Length: 0 From: "Bob"<sip:100@46.166.160.136>;tag=313735653235653366666334013231383838
Payload bytes withheld: they contain the sensor's address.
2026-10-08 18:25:51172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-3881875645;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633401313030393
Payload bytes withheld: they contain the sensor's address.
2026-10-08 17:26:55172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-2834289290;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639326666633401333437303
Payload bytes withheld: they contain the sensor's address.
2026-10-08 13:15:52185.243.5.164to 65476/udpSIPHK
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 185.243.5.164:5061;branch=z9hG4bK-1486592356;rport Content-Length: 0 From: "Bob"<sip:100@46.166.160.136>;tag=303561666237383466666334013330303034
Payload bytes withheld: they contain the sensor's address.
2026-10-07 19:13:5145.141.148.75to 65476/udpSIPTR
PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5229;branch=z9hG4bK-1109176757;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393266666334013334303534
Payload bytes withheld: they contain the sensor's address.
2026-10-07 11:16:1151.161.57.3to 65476/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:5615;branch=z9hG4bK-500878946;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666334013234333130323
Payload bytes withheld: they contain the sensor's address.
2026-10-07 06:59:1251.161.57.3to 65476/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:6239;branch=z9hG4bK-1324020512;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633401313939303532
Payload bytes withheld: they contain the sensor's address.
2026-10-06 20:24:11172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5073;branch=z9hG4bK-287697322;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666334013738333431
Payload bytes withheld: they contain the sensor's address.
2026-10-06 19:42:24172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-3619750544;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633401313334313
Payload bytes withheld: they contain the sensor's address.