UDP traffic

Datagrams matching proto:sip sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.6K

Datagrams

211

Source addresses

Networks

Countries

195

Destination ports

Traffic by type

Other services

2,624 datagrams from 211 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2,624

Latest SIP datagram, to 5060/udp

INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65049;branch=z9hG4bK901272499 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1264474260 To: <sip:48525223031@<HONEYPOT>> Call-ID: 1713111602-752268486-1114980680 CSeq: 1 INVITE Contact: <sip:2001@77.110.115.168:65049>

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP1,706
5059/udp SIP98
15060/udp SIP35
25060/udp SIP34
5080/udp SIP29
5062/udp SIP26
45060/udp SIP26
5070/udp SIP24
35060/udp SIP24
55060/udp SIP22
5061/udp SIP20
5090/udp SIP19

Networks

AS23470 ReliableSite.Net LLC from 10 sources1,133
AS16276 OVH SAS from 10 sources333
AS203273 NetCrafters OU from 1 source299
AS49870 Alsycon B.V. from 5 sources174
AS12876 Scaleway SAS from 8 sources115
AS32475 Internap Holding LLC from 2 sources56
AS51852 Private Layer INC from 3 sources51
AS53667 FranTech Solutions from 4 sources44
AS398324 Censys, Inc. from 14 sources42
AS215925 Vpsvault.host Ltd from 2 sources40

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	770	2026-10-11 03:21
77.110.115.168	AS203273 NetCrafters OU	US	SIP	299	2026-10-11 03:27
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	153	2026-10-10 22:30
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	124	2026-10-11 02:45
135.148.29.54	AS16276 OVH SAS	US	SIP	111	2026-10-11 03:12
198.244.200.163	AS16276 OVH SAS	GB	SIP	70	2026-10-11 03:05
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	65	2026-10-11 01:32
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	60	2026-10-08 21:49
51.161.136.177	AS16276 OVH SAS	AU	SIP	56	2026-10-11 03:09
51.161.57.3	AS16276 OVH SAS	CA	SIP	56	2026-10-10 14:23
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	38	2026-10-10 22:26
179.43.167.3	AS51852 Private Layer INC	CH	SIP	32	2026-10-11 03:22
199.195.250.193	AS53667 FranTech Solutions	US	SIP	27	2026-10-09 10:22
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SIP	24	2026-10-10 20:33
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19

Latest datagrams

2026-10-11 03:27:0077.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65049;branch=z9hG4bK901272499 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1264474260 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:25:3877.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52431;branch=z9hG4bK2078030923 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=400786037 To: <sip:+48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:24:1377.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51980;branch=z9hG4bK784180262 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=799950121 To: <sip:80048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:22:59179.43.167.3to 5060/udpSIPCH
INVITE sip:003908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28305;branch=z9hG4bK-524287-1---b7f324a56a230346 From: <sip:13493984677@0.0.0.0>;tag=6e03dcd3 To: <sip:0039
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:22:5277.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:55595;branch=z9hG4bK453747540 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=480504904 To: <sip:00148525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 65060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:65060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624303 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624303;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 55060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:55060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624295 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624295;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5059/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5059 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624252 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624252;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 45060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:45060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624288 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624288;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624245 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624245;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 35060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:35060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624278 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624278;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 25060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:25060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624270 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624270;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 15060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:15060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624261 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624261;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:3177.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65350;branch=z9hG4bK1391413057 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=2056177907 To: <sip:00948525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:20:1277.110.115.168to 5060/udpSIPUS
INVITE sip:981048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:57024;branch=z9hG4bK897449037 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=214818256 To: <sip:981048525223031@<HON
Payload bytes withheld: they contain the sensor's address.