UDP traffic

Datagrams sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

19.0K

Datagrams

5.0K

Source addresses

936

Networks

Countries

3.7K

Destination ports

Traffic by type

Service queries

3,808 datagrams from 1.1K sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 961 DNS 884 NTP 520 SSDP 391 NetBIOS 324 Sun RPC 201 CoAP 194 TFTP 150 CLDAP 85 SOAP 72

Latest SNMP datagram, to 161/udp

0$·public·6·d0 0·+·

payload bytes

00000000  30 24 02 01 01 04 06 70  75 62 6c 69 63 a5 17 02  |0$.....public...|
00000010  04 f2 36 fc 9f 02 01 00  02 01 64 30 09 30 07 06  |..6.......d0.0..|
00000020  03 2b 06 01 05 00                                 |.+....|

Other services

5,050 datagrams from 1.7K sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2,563 SOCKS5 869 DTLS 756 STUN 370 Redis 148 GTP-U 51 XDMCP 47 GTP-C 44 HTTP 30 RTSP 27

Latest SIP datagram, to 5060/udp

INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:50227;branch=z9hG4bK1494494356 Max-Forwards: 70 From: <sip:800@<HONEYPOT>>;tag=80920345 To: <sip:0048525223031@<HONEYPOT>> Call-ID: 1840097279-113957800-736316902 CSeq: 1 INVITE Contact: <sip:800@77.110.115.168:50227>

Payload bytes withheld: they contain the sensor's address.

QUIC

141 datagrams from 107 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 141

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

10,026 datagrams from 3.3K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 10,026

Latest Unrecognised datagram, to 4500/udp

·?·.·0·

payload bytes

00000000  00 00 82 80 08 a7 3f 14  9d 2e 19 11 00 00 00 00  |......?.........|
00000010  00 00 00 00 0b 10 05 00  a3 1b f2 db 00 00 00 30  |...............0|
00000020  00 00 00 14 00 00 00 01  03 04 00 0b 00 00 82 80  |................|
00000030  00 00 82 80                                       |....|

Peer-to-peer

61,576 datagrams from 1.0K sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 61,576

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp +1	993	266	6.3
DNS	53/udp +3	752	249	28 to 54
NTP	123/udp	521	221	556.9
SSDP	1900/udp +3	434	172	30.8
NetBIOS	137/udp +3	333	163	3.8
mDNS	5353/udp	205	142	2 to 10
Memcached	11211/udp +1	154	93	10,000 to 51,000
Portmap	111/udp	179	80	7 to 28
TFTP	69/udp +3	159	80	60
WS-Discovery	3702/udp	229	74	10 to 500
CLDAP	389/udp +3	201	64	56 to 70
CharGEN	19/udp	84	51	358.8
QOTD	17/udp	53	42	140.3
RIPv1	520/udp	54	34	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP1,761
161/udp SNMP986
53/udp DNS673
123/udp NTP521
1900/udp SSDP389
500/udp IKE323
137/udp NetBIOS296
443/udp QUIC274
1194/udp OpenVPN230
3702/udp WS-Discovery229
1434/udp MSSQL Browser213
5353/udp DNS205

DNS questions

DNS record types

TXT306
ANY201
A160
PTR158
NS4

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 31 sources32
q13i0307h9_55b375c5d22e_2f871f65fa7d from 16 sources16
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 16 sources16
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 15 sources15
q13i0308h3_55b375c5d22e_bc854dc9d3af from 15 sources15
q13i0311dq_55b375c5d22e_c183556c78e2 from 4 sources12
q13i0311h3_55b375c5d22e_c183556c78e2 from 4 sources8
q13i0310h3_55b375c5d22e_df5b9e597968 from 1 source4
q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 3 sources3

QUIC transport parameters

60647680e335 from 44 sources47
1f7a23748abd from 31 sources32
4c2cac1ef1cb from 15 sources15
cde977acba33 from 4 sources12
12d07494ae7c from 4 sources8
94dccb934778 from 1 source4
5826be32c2d4 from 2 sources2
24dc672a03ab from 1 source1

QUIC versions

Networks

AS396982 Google LLC from 718 sources1,724
AS398324 Censys, Inc. from 97 sources1,469
AS23470 ReliableSite.Net LLC from 10 sources1,124
AS6939 Hurricane Electric LLC from 576 sources1,107
AS7552 Viettel Group from 31 sources1,031
AS8075 Microsoft Corporation from 605 sources905
AS14061 DigitalOcean, LLC from 78 sources635
AS215925 Vpsvault.host Ltd from 4 sources560
AS20052 Arbor Networks, Inc. from 28 sources545
AS63949 Akamai Connected Cloud from 52 sources342

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	763	2026-10-11 01:06
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SNMP	281	2026-10-11 02:16
141.98.83.48	AS209588 Flyservers S.A.	PA	Unrecognised	268	2026-10-11 02:25
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	CoAP	268	2026-10-11 02:29
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	SNMP	260	2026-10-11 02:23
77.110.115.168	AS203273 NetCrafters OU	US	SIP	260	2026-10-11 02:35
16.5.0.234	AS401661 EMBNEX, LLC	BR	Unrecognised	155	2026-10-10 07:10
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	153	2026-10-10 22:30
117.3.123.242	AS7552 Viettel Group	VN	Unrecognised	143	2026-10-11 01:49
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	135	2026-10-10 20:31
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	122	2026-10-11 01:15
27.68.152.94	AS7552 Viettel Group	VN	Unrecognised	120	2026-10-10 14:15
185.94.111.1	AS51115 HLL LLC	RU	Unrecognised	114	2026-10-11 02:25
135.148.29.54	AS16276 OVH SAS	US	SIP	109	2026-10-10 23:10
27.66.49.95	AS7552 Viettel Group	VN	Unrecognised	89	2026-10-10 14:12
141.98.11.129	AS209605 UAB Host Baltic	LT	Unrecognised	81	2026-10-11 02:32
27.67.72.112	AS7552 Viettel Group	VN	Unrecognised	80	2026-10-10 13:56
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	Unrecognised	75	2026-10-11 02:15
193.47.62.187	AS216014 BestDC Limited	BG	Sun RPC	75	2026-10-10 22:38
31.56.19.21	AS403005 Blatant	AE	SSDP	69	2026-10-05 15:49

Latest datagrams

2026-10-11 02:35:4777.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:50227;branch=z9hG4bK1494494356 Max-Forwards: 70 From: <sip:800@<HONEYPOT>>;tag=80920345 To: <sip:0048525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:35:0935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:35:0464.62.156.38to 4500/udpUnrecognisedUS

·?·.·0·

payload bytes

00000000  00 00 82 80 08 a7 3f 14  9d 2e 19 11 00 00 00 00  |......?.........|
00000010  00 00 00 00 0b 10 05 00  a3 1b f2 db 00 00 00 30  |...............0|
00000020  00 00 00 14 00 00 00 01  03 04 00 0b 00 00 82 80  |................|
00000030  00 00 82 80                                       |....|

2026-10-11 02:34:2777.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61219;branch=z9hG4bK1269759615 Max-Forwards: 70 From: <sip:800@<HONEYPOT>>;tag=1794707327 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:34:2535.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:34:12176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```

2026-10-11 02:33:50198.235.24.95to 12446/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 02:33:3145.170.248.29to 5060/udpUnrecognisedMX
u.XUY·v:R{^j· y
payload bytes
```
00000000  75 2e 58 55 59 11 76 3a  52 7b 5e 6a 14 09 79     |u.XUY.v:R{^j..y|
```

2026-10-11 02:33:2266.132.172.243to 54010/udpUnrecognisedUS

payload bytes

00000000  01 08 00 14 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00                                       |....|

2026-10-11 02:33:1077.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65200;branch=z9hG4bK1747072051 Max-Forwards: 70 From: <sip:800@<HONEYPOT>>;tag=327684005 To: <sip:+48525223031@<HONEYPOT>
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:33:01195.85.207.31to 1900/udpUnrecognisedTR
d.'wPJ]31_·
payload bytes
```
00000000  64 2e 27 77 50 4a 5d 33  31 5f f0                 |d.'wPJ]31_.|
```

2026-10-11 02:32:24207.241.172.146to 8082/udpRedisDE

$.I·X$·K·%·3}q·{QG·}=t$T·z`t~·/G·k·S·

payload bytes

00000000  24 2e 49 02 58 24 07 4b  06 25 17 0e 33 7d 71 02  |$.I.X$.K.%..3}q.|
00000010  7b 51 47 11 19 7d 3d 74  24 54 19 7a 60 74 7e 04  |{QG..}=t$T.z`t~.|
00000020  2f 47 07 08 6b 0e 53 1c  0c                       |/G..k.S..|

2026-10-11 02:32:19141.98.11.129to 389/udpUnrecognisedLT

0%·c · · ·objectclass0·

payload bytes

00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

2026-10-11 02:32:1065.49.1.54to 10074/udpMemcachedUS
stats
payload bytes
```
00000000  73 74 61 74 73 0a                                 |stats.|
```
2026-10-11 02:31:4477.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:64671;branch=z9hG4bK70005222 Max-Forwards: 70 From: <sip:700@<HONEYPOT>>;tag=670334394 To: <sip:80048525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.