UDP traffic

Datagrams matching proto:sip sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

948

Datagrams

Source addresses

Networks

Countries

114

Destination ports

Traffic by type

Other services

948 datagrams from 58 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 948

Latest SIP datagram, to 5060/udp

INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:54365;branch=z9hG4bK639628462 Max-Forwards: 70 From: <sip:9001@<HONEYPOT>>;tag=816087486 To: <sip:48525223031@<HONEYPOT>> Call-ID: 83975412-1334778167-816476268 CSeq: 1 INVITE Contact: <sip:9001@77.110.115.168:54365> C

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP599
25060/udp SIP18
15060/udp SIP18
45060/udp SIP17
65060/udp SIP16
55060/udp SIP16
35060/udp SIP16
5080/udp SIP15
5059/udp SIP8
5070/udp SIP6
5010/udp SIP5
5067/udp SIP5

Networks

AS203273 NetCrafters OU from 1 source393
AS23470 ReliableSite.Net LLC from 5 sources240
AS12876 Scaleway SAS from 5 sources105
AS16276 OVH SAS from 7 sources87
AS49870 Alsycon B.V. from 3 sources31
AS14956 RouterHosting LLC from 4 sources27
AS32475 Internap Holding LLC from 2 sources11
AS51852 Private Layer INC from 2 sources9
AS398324 Censys, Inc. from 4 sources7
AS8560 IONOS SE from 2 sources6

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
77.110.115.168	AS203273 NetCrafters OU	US	SIP	393	2026-10-11 05:29
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	153	2026-10-11 04:48
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	35	2026-10-11 03:48
51.161.57.3	AS16276 OVH SAS	CA	SIP	24	2026-10-10 14:23
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	20	2026-10-10 22:30
135.148.29.54	AS16276 OVH SAS	US	SIP	20	2026-10-11 04:31
198.244.200.163	AS16276 OVH SAS	GB	SIP	17	2026-10-11 03:05
51.161.136.177	AS16276 OVH SAS	AU	SIP	12	2026-10-11 05:17
144.172.64.68	AS14956 RouterHosting LLC	AU	SIP	10	2026-10-11 03:14
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	10	2026-10-11 03:30
89.190.156.22	AS49870 Alsycon B.V.	NL	SIP	10	2026-10-10 20:43
172.86.125.231	AS14956 RouterHosting LLC	US	SIP	9	2026-10-11 03:28
179.43.167.3	AS51852 Private Layer INC	CH	SIP	8	2026-10-11 04:32
144.172.64.83	AS14956 RouterHosting LLC	AU	SIP	7	2026-10-11 05:00

Latest datagrams

2026-10-11 05:29:2677.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:54365;branch=z9hG4bK639628462 Max-Forwards: 70 From: <sip:9001@<HONEYPOT>>;tag=816087486 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:28:0577.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:58228;branch=z9hG4bK2049164708 Max-Forwards: 70 From: <sip:9001@<HONEYPOT>>;tag=365207258 To: <sip:+48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:26:3877.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:56953;branch=z9hG4bK634057035 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=2108336978 To: <sip:80048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:25:1977.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53449;branch=z9hG4bK464062772 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=968525592 To: <sip:00148525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:23:5877.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53063;branch=z9hG4bK2107306109 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=861586347 To: <sip:00948525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:22:3877.110.115.168to 5060/udpSIPUS
INVITE sip:981048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51554;branch=z9hG4bK1233751428 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=371857527 To: <sip:981048525223031@<HO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:21:1677.110.115.168to 5060/udpSIPUS
INVITE sip:81048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60412;branch=z9hG4bK1337584188 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=789521418 To: <sip:81048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:19:5877.110.115.168to 5060/udpSIPUS
INVITE sip:901148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53029;branch=z9hG4bK81322130 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=556539363 To: <sip:901148525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:18:3677.110.115.168to 5060/udpSIPUS
INVITE sip:01148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51393;branch=z9hG4bK1203498138 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=773107361 To: <sip:01148525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:17:1951.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5068;branch=z9hG4bK-1212839104;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401323938383
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:17:1677.110.115.168to 5060/udpSIPUS
INVITE sip:048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:63868;branch=z9hG4bK873966168 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=1289928296 To: <sip:048525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:15:59209.46.124.116to 5080/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1464194708 Via: SIP/2.0/UDP 209.46.124.116:10032;branch=z9hG4bK-1464194708;rport Call-ID: c1464194708
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:15:5277.110.115.168to 5060/udpSIPUS
INVITE sip:00048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60299;branch=z9hG4bK2090277420 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=1776448413 To: <sip:00048525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:14:3577.110.115.168to 5060/udpSIPUS
INVITE sip:90048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51801;branch=z9hG4bK1374674774 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=2071088988 To: <sip:90048525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:13:1277.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:55672;branch=z9hG4bK353433623 Max-Forwards: 70 From: <sip:8001@<HONEYPOT>>;tag=808551985 To: <sip:0048525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.