UDP traffic

Datagrams matching asn:16276 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

sip from 4 sources18

Destination ports

5060/udp from 3 sources13
6496/udp from 1 source1
48769/udp from 1 source1
49930/udp from 1 source1
50051/udp from 1 source1
50307/udp from 1 source1

Networks

AS16276 OVH SAS from 4 sources18

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
5.39.125.103	AS16276 OVH SAS	FR	5	2026-10-05 16:23
135.148.29.54	AS16276 OVH SAS	US	5	2026-10-05 16:54
198.244.200.163	AS16276 OVH SAS	GB	4	2026-10-05 17:19
51.161.136.177	AS16276 OVH SAS	AU	4	2026-10-05 19:53

Latest datagrams

2026-10-05 19:53:3851.161.136.177to 5060/udpsipAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5072;branch=z9hG4bK-62288303;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340132333632303
payload bytes
2026-10-05 17:19:53198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5118;branch=z9hG4bK-1378743462;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313938323839373
payload bytes
2026-10-05 17:03:2351.161.136.177to 5060/udpsipAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5071;branch=z9hG4bK-3230613104;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401333638373
payload bytes
2026-10-05 16:54:31135.148.29.54to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:47302;branch=z9hG4bK-9007207;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3137
payload bytes
2026-10-05 16:29:11198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5111;branch=z9hG4bK-991914996;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336334013434363439393139
payload bytes
2026-10-05 16:29:10135.148.29.54to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:33098;branch=z9hG4bK-579837453;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=30
payload bytes
2026-10-05 16:23:055.39.125.103to 48769/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-856909545;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653362653831013933303333353
payload bytes
2026-10-05 16:23:055.39.125.103to 49930/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-802416268;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653363333061013336303239393
payload bytes
2026-10-05 16:23:055.39.125.103to 50307/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-2993799883;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336334383301313435343932
payload bytes
2026-10-05 16:23:055.39.125.103to 6496/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3059551696;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333139363001343139353732
payload bytes
2026-10-05 16:23:055.39.125.103to 50051/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3260274920;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333383301323939303936
payload bytes
2026-10-05 16:00:55135.148.29.54to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:53337;branch=z9hG4bK-4250689830;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3
payload bytes
2026-10-05 15:47:25198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5306;branch=z9hG4bK-2266814520;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401333739343938373
payload bytes
2026-10-05 15:16:23198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5292;branch=z9hG4bK-720719696;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336334013430323138353137
payload bytes
2026-10-05 15:16:0751.161.136.177to 5060/udpsipAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5074;branch=z9hG4bK-626416628;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336334013332353739
payload bytes
2026-10-05 15:07:21135.148.29.54to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:36038;branch=z9hG4bK-4187253003;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6
payload bytes
2026-10-05 14:58:25135.148.29.54to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:38082;branch=z9hG4bK-2241927572;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6
payload bytes
2026-10-05 11:20:3051.161.136.177to 5060/udpsipAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5064;branch=z9hG4bK-807701991;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=303561666237383431336334013231323330
payload bytes