UDP traffic
Datagrams matching ip:172.110.223.200 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
Source addresses (unverified)
| Address | Network | Cc | Datagrams | Last seen (UTC) |
|---|
| 172.110.223.200 | AS23470 ReliableSite.Net LLC | HK | 5 | 2026-10-05 18:54 |
Latest datagrams
2026-10-05 18:54:53172.110.223.200to 5060/udpsipHK INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 172.110.223.200:5315;branch=z9hG4bK-3031713029;rport
Content-Length: 0
From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401323836323
payload bytes
2026-10-05 17:05:06172.110.223.200to 5060/udpsipHK INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 172.110.223.200:5323;branch=z9hG4bK-2941319726;rport
Content-Length: 0
From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401333735373
payload bytes
2026-10-05 16:54:41172.110.223.200to 5060/udpsipHK INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 172.110.223.200:5706;branch=z9hG4bK-1670875375;rport
Content-Length: 0
From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401323838313
payload bytes
2026-10-05 12:54:08172.110.223.200to 5060/udpsipHK INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 172.110.223.200:5396;branch=z9hG4bK-3876748657;rport
Content-Length: 0
From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401313230323
payload bytes
2026-10-05 12:38:19172.110.223.200to 5060/udpsipHK INVITE sip:100@<HONEYPOT> SIP/2.0
Via: SIP/2.0/UDP 172.110.223.200:5261;branch=z9hG4bK-2613874073;rport
Content-Length: 0
From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313832373
payload bytes