UDP traffic

Datagrams matching asn:16276 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

346

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

335 datagrams from 10 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 335

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:29135;branch=z9hG4bK-1278396525;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533313363340133323237343333373331 User-Agent: friendly-scanner Call-ID: 12214713511805

Payload bytes withheld: they contain the sensor's address.

Unrecognised

11 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 11

Latest Unrecognised datagram, to 30301/udp

A.WqhTQ=·}.r7\u]·uQ·1·z"<·%Jn4·8·} `N]aK·S·hH_t=1·n6!iX]·p1

payload bytes

00000000  41 2e 57 71 68 54 51 3d  00 7d 2e 72 37 5c 75 5d  |A.WqhTQ=.}.r7\u]|
00000010  0c 75 51 1e 31 05 0f 7a  22 3c 1d 25 4a 6e 34 0c  |.uQ.1..z"<.%Jn4.|
00000020  38 0c 7d 20 60 4e 5d 61  4b 0b 53 02 68 48 5f 74  |8.} `N]aK.S.hH_t|
00000030  3d 31 12 6e 36 21 69 58  5d 06 70 31              |=1.n6!iX].p1|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	3	1	30.8
mDNS	5353/udp	1	1	2 to 10
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP275
5376/udp SIP4
7272/udp SIP4
4590/udp SIP4
1900/udp SSDP3
11000/udp SIP2
50000/udp SIP2
6060/udp SIP2
60000/udp SIP2
7070/udp SIP2
56000/udp SIP2
7777/udp SIP2

Networks

AS16276 OVH SAS from 14 sources346

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
135.148.29.54	AS16276 OVH SAS	US	SIP	113	2026-10-11 04:31
198.244.200.163	AS16276 OVH SAS	GB	SIP	70	2026-10-11 03:05
51.161.136.177	AS16276 OVH SAS	AU	SIP	56	2026-10-11 03:09
51.161.57.3	AS16276 OVH SAS	CA	SIP	56	2026-10-10 14:23
5.39.125.103	AS16276 OVH SAS	FR	SIP	13	2026-10-10 22:40
51.178.198.251	AS16276 OVH SAS	FR	SIP	8	2026-10-11 03:06
167.114.107.175	AS16276 OVH SAS	CA	Unrecognised	7	2026-10-07 14:11
51.38.221.109	AS16276 OVH SAS	FR	SIP	6	2026-10-08 14:02
5.196.61.130	AS16276 OVH SAS	FR	SIP	5	2026-10-11 02:51
5.135.106.85	AS16276 OVH SAS	FR	SIP	4	2026-10-07 09:53
162.19.19.234	AS16276 OVH SAS	FR	SIP	4	2026-10-09 21:58
51.75.24.26	AS16276 OVH SAS	FR	Unrecognised	2	2026-10-08 17:15
51.161.33.215	AS16276 OVH SAS	CA	Unrecognised	1	2026-10-10 11:37
151.80.60.145	AS16276 OVH SAS	FR	Unrecognised	1	2026-10-10 14:23

Latest datagrams

2026-10-11 04:31:17135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:29135;branch=z9hG4bK-1278396525;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3
Payload bytes withheld: they contain the sensor's address.
2026-10-11 04:06:20135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:28760;branch=z9hG4bK-2041312579;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:12:43135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:22756;branch=z9hG4bK-2636899107;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:09:1851.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5075;branch=z9hG4bK-4094195512;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313736343
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:06:3751.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: 3nPj9eW

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 33 6e 50 6a 39 65 57  4f 76 46 6c 70 4d 48 6e  | 3nPj9eWOvFlpMHn|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-11 03:05:52198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5218;branch=z9hG4bK-1330281108;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401313730363334353
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:03:49135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:18159;branch=z9hG4bK-164405339;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=62
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:51:555.196.61.130to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.196.61.130:5283;branch=z9hG4bK-3231253739;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340134323537323
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:45:21198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5484;branch=z9hG4bK-2730128076;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401313834313432303
Payload bytes withheld: they contain the sensor's address.

2026-10-11 01:31:3451.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: I6kJoS2

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 49 36 6b 4a 6f 53 32  4d 67 67 50 33 7a 6e 39  | I6kJoS2MggP3zn9|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-10 23:10:3451.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5075;branch=z9hG4bK-3704031564;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401323337333
Payload bytes withheld: they contain the sensor's address.
2026-10-10 23:10:11135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:10938;branch=z9hG4bK-516525199;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:44:50135.148.29.54to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 135.148.29.54:43147;branch=z9hG4bK-1108417142;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:40:175.39.125.103to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5098;branch=z9hG4bK-647785917;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401333638353437
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:20:575.196.61.130to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.196.61.130:5077;branch=z9hG4bK-1663786547;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533313363340131383530353
Payload bytes withheld: they contain the sensor's address.