UDP traffic

Datagrams matching asn:197170 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

6 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 6

Latest SIP datagram, to 5060/udp

REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:52042;branch=z9hG4bK41e60d55919a472bb258eaa5755b051d;rport From: <sip:87287@91.92.47.232>;tag=c1a5c6842d54 To: <sip:3292@<HONEYPOT>> Max-Forwards: 60 CSeq: 28918 REGISTER Call-ID: b0884fec542b446e8988923e76cbd42f@91.92.47.232

Payload bytes withheld: they contain the sensor's address.

Unrecognised

8 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 8

Latest Unrecognised datagram, to 1434/udp

payload bytes

00000000  02                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	3	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP6
1434/udp MSSQL Browser4
1900/udp SSDP3
443/udp QUIC1

Networks

AS197170 TechTies Inc. from 2 sources14

Countries

NL The Netherlands14

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.153.34.163	AS197170 TechTies Inc.	NL	Unrecognised	8	2026-10-07 02:41
91.92.47.232	AS197170 TechTies Inc.	NL	SIP	6	2026-10-06 18:11

Latest datagrams

2026-10-07 02:41:3145.153.34.163to 1434/udpUnrecognisedNL
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-07 00:52:3245.153.34.163to 1434/udpUnrecognisedNL
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-06 22:39:5845.153.34.163to 1434/udpUnrecognisedNL
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-06 19:50:3545.153.34.163to 1434/udpUnrecognisedNL
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-06 18:11:5491.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:52042;branch=z9hG4bK41e60d55919a472bb258eaa5755b051d;rport From: <sip:87287@91.92.47.232>;tag=c1a5c6842d54 To: <sip:3292@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-06 18:11:5391.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:33015;branch=z9hG4bKad55b9100466470f97c32e2855dbe410;rport Max-Forwards: 69 From: <sip:58774@91.92.47.232>;tag=8657bf2736d0 To: <
Payload bytes withheld: they contain the sensor's address.
2026-10-06 18:11:5191.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:15209;branch=z9hG4bKc3790b172d7d4121afffe66c938dce2c;rport Max-Forwards: 60 From: <sip:9340@91.92.47.232>;tag=1992c3816969 To: <s
Payload bytes withheld: they contain the sensor's address.
2026-10-06 10:26:3191.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:12020;branch=z9hG4bKa810563c54044ca599916407b2cc882a;rport Max-Forwards: 62 From: <sip:95772@91.92.47.232>;tag=4f39d6cc3dd7 To: <
Payload bytes withheld: they contain the sensor's address.
2026-10-06 10:26:3091.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:48812;branch=z9hG4bK3fc22b37af994974ab71fc920723af30;rport Max-Forwards: 60 To: <sip:34555@<HONEYPOT>> From: <sip:12059@91.92.47.
Payload bytes withheld: they contain the sensor's address.
2026-10-06 10:26:2891.92.47.232to 5060/udpSIPNL
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 91.92.47.232:30895;branch=z9hG4bKc4bc0aa7b91a485db01eed85c30390d0;rport To: <sip:40969@<HONEYPOT>> Max-Forwards: 60 From: <sip:10544@91.92.47.
Payload bytes withheld: they contain the sensor's address.

2026-10-06 03:53:5145.153.34.163to 1900/udpUnrecognisedNL

M-SEARCH ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  0d 0a 53 54 3a 73 73 64  |M-SEARCH..ST:ssd|
00000010  70 3a 61 6c 6c 0d 0a 4d  41 4e 3a 22 73 73 64 70  |p:all..MAN:"ssdp|
00000020  3a 64 69 73 63 6f 76 65  72 22 0d 0a              |:discover"..|

2026-10-06 01:18:5245.153.34.163to 1900/udpUnrecognisedNL

M-SEARCH ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  0d 0a 53 54 3a 73 73 64  |M-SEARCH..ST:ssd|
00000010  70 3a 61 6c 6c 0d 0a 4d  41 4e 3a 22 73 73 64 70  |p:all..MAN:"ssdp|
00000020  3a 64 69 73 63 6f 76 65  72 22 0d 0a              |:discover"..|

2026-10-06 00:46:3945.153.34.163to 1900/udpUnrecognisedNL

M-SEARCH ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  0d 0a 53 54 3a 73 73 64  |M-SEARCH..ST:ssd|
00000010  70 3a 61 6c 6c 0d 0a 4d  41 4e 3a 22 73 73 64 70  |p:all..MAN:"ssdp|
00000020  3a 64 69 73 63 6f 76 65  72 22 0d 0a              |:discover"..|

2026-10-05 20:04:2845.153.34.163to 443/udpUnrecognisedNL

M-SEARCH ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  0d 0a 53 54 3a 73 73 64  |M-SEARCH..ST:ssd|
00000010  70 3a 61 6c 6c 0d 0a 4d  41 4e 3a 22 73 73 64 70  |p:all..MAN:"ssdp|
00000020  3a 64 69 73 63 6f 76 65  72 22 0d 0a              |:discover"..|