UDP traffic

Datagrams matching proto:sip sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.8K

Datagrams

212

Source addresses

Networks

Countries

196

Destination ports

Traffic by type

Other services

2,793 datagrams from 212 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2,793

Latest SIP datagram, to 5060/udp

INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:49210;branch=z9hG4bK342010463 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=824034842 To: <sip:00148525223031@<HONEYPOT>> Call-ID: 548137658-680384854-1067653994 CSeq: 1 INVITE Contact: <sip:default@77.110.115.

Payload bytes withheld: they contain the sensor's address.

Destination ports

5060/udp SIP1,855
5059/udp SIP100
15060/udp SIP37
25060/udp SIP36
5080/udp SIP31
45060/udp SIP28
5062/udp SIP26
35060/udp SIP26
55060/udp SIP24
5070/udp SIP24
5061/udp SIP20
65060/udp SIP20

Networks

AS23470 ReliableSite.Net LLC from 10 sources1,153
AS203273 NetCrafters OU from 1 source430
AS16276 OVH SAS from 10 sources337
AS49870 Alsycon B.V. from 5 sources174
AS12876 Scaleway SAS from 8 sources115
AS32475 Internap Holding LLC from 2 sources59
AS51852 Private Layer INC from 3 sources52
AS53667 FranTech Solutions from 4 sources44
AS398324 Censys, Inc. from 14 sources43
AS14956 RouterHosting LLC from 7 sources40

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	786	2026-10-11 04:48
77.110.115.168	AS203273 NetCrafters OU	US	SIP	430	2026-10-11 06:18
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	153	2026-10-10 22:30
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	125	2026-10-11 03:48
135.148.29.54	AS16276 OVH SAS	US	SIP	113	2026-10-11 04:31
198.244.200.163	AS16276 OVH SAS	GB	SIP	70	2026-10-11 03:05
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	68	2026-10-11 04:42
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	60	2026-10-08 21:49
51.161.136.177	AS16276 OVH SAS	AU	SIP	57	2026-10-11 05:17
51.161.57.3	AS16276 OVH SAS	CA	SIP	56	2026-10-10 14:23
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	40	2026-10-11 05:52
179.43.167.3	AS51852 Private Layer INC	CH	SIP	33	2026-10-11 04:32
199.195.250.193	AS53667 FranTech Solutions	US	SIP	27	2026-10-09 10:22
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SIP	24	2026-10-10 20:33
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	21	2026-10-10 22:19

Latest datagrams

2026-10-11 06:18:1577.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:49210;branch=z9hG4bK342010463 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=824034842 To: <sip:00148525223031@<HO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:17:40167.250.202.30to 5060/udpSIPBR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 167.250.202.30:0;branch=z9hG4bK-3215664473;rport Max-Forwards: 70 To: "PBX"<sip:100@1.1.1.1> From: "PBX"<sip:100@1.1.1.1>;tag=303561666237383431
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:16:5477.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52131;branch=z9hG4bK1208711210 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=490281506 To: <sip:00948525223031@<H
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:15:3177.110.115.168to 5060/udpSIPUS
INVITE sip:981048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51841;branch=z9hG4bK1269694480 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=1580747286 To: <sip:981048525223031
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:14:1077.110.115.168to 5060/udpSIPUS
INVITE sip:81048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:49467;branch=z9hG4bK1072516214 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=194437704 To: <sip:81048525223031@<H
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:12:4977.110.115.168to 5060/udpSIPUS
INVITE sip:901148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:55990;branch=z9hG4bK1104087481 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=1090022372 To: <sip:901148525223031
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:12:22172.86.125.231to 5060/udpSIPUS
INVITE sip:90061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 172.86.125.231:25703;branch=z9hG4bK-524287-1---4c5e21e00b89088a;rport Max-Forwards: 70 From: <sip:16994061897@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:12:105.39.125.103to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5077;branch=z9hG4bK-3100406201;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533313363340134313038313
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:11:2777.110.115.168to 5060/udpSIPUS
INVITE sip:01148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:59700;branch=z9hG4bK1869346735 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=1635132941 To: <sip:01148525223031@<
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:10:0577.110.115.168to 5060/udpSIPUS
INVITE sip:048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60311;branch=z9hG4bK676603517 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=1456700196 To: <sip:048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:08:4377.110.115.168to 5060/udpSIPUS
INVITE sip:00048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62510;branch=z9hG4bK822480026 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=273398385 To: <sip:00048525223031@<HO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:07:2477.110.115.168to 5060/udpSIPUS
INVITE sip:90048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51626;branch=z9hG4bK295556049 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=480826962 To: <sip:90048525223031@<HO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:06:0277.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51938;branch=z9hG4bK886595565 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=527795844 To: <sip:0048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:04:4277.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61991;branch=z9hG4bK605709458 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=337453414 To: <sip:48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 06:03:2177.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61689;branch=z9hG4bK1366361688 Max-Forwards: 70 From: <sip:default@<HONEYPOT>>;tag=188919563 To: <sip:+48525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.