UDP traffic

Datagrams matching asn:211680 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

28 datagrams from 7 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 19 TFTP 2 NetBIOS 1 NTP 1 CLDAP 1 DNS 1 Sun RPC 1 SSDP 1 SOAP 1

Latest SNMP datagram, to 161/udp

0)·public·VZ·]·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 56 5a dc 5d 02 01 00  02 01 00 30 0e 30 0c 06  |.VZ.]......0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

Other services

7 datagrams from 4 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 3 GTP-C 2 GTP-U 1 Redis 1

Latest SIP datagram, to 5060/udp

OPTIONS sip:nzeliNQl@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.156.129.166:55875;branch=mtNAdi.7725660277;rport;alias From: sip:ZElXVCoj@45.156.129.166:55875;tag=05513667 To: sip:vkinDDMW@<HONEYPOT> Call-ID: 6522710525@45.156.129.166 CSeq: 1 OPTIONS Contact: sip:ZbtRKAnm@45.156.129.166:55875 Con

Payload bytes withheld: they contain the sensor's address.

Unrecognised

31 datagrams from 6 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 31

Latest Unrecognised datagram, to 500/udp

·D ·=U·! "·"·0·,·(·M·H ·e(n·DP·_·ƹ·'·X·0·9·c"·<6·YS'·O·&·yZ~·o x·y·n·3⟮·+·WO:BM·ڑ·o\·(·%·Ox·

payload bytes

00000000  a0 a5 44 20 97 08 3d 55  00 00 00 00 00 00 00 00  |..D ..=U........|
00000010  21 20 22 08 00 00 00 00  00 00 01 88 22 00 00 30  |! "........."..0|
00000020  00 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 05 03 00 00 08  |................|
00000040  03 00 00 0c 00 00 00 08  04 00 00 0e 28 00 01 08  |............(...|
00000050  00 0e 00 00 cf 4d e8 04  0e 48 0a cc ee 65 28 6e  |.....M...H...e(n|
00000060  a4 44 50 97 c4 5f 82 c6  b9 b8 c2 9a 9c 27 aa dc  |.DP.._.......'..|
00000070  58 af 30 da 39 01 63 22  00 3c 36 c7 c0 83 c1 84  |X.0.9.c".<6.....|
00000080  a6 a4 ba 59 53 27 9c 4f  05 26 d7 cf c1 fe e4 12  |...YS'.O.&......|
00000090  d1 79 5a 7e 1d a9 1b 6f  09 78 f2 df 79 19 6e 0f  |.yZ~...o.x..y.n.|
000000a0  33 e2 9f ae 93 2b 15 d3  57 4f 3a 42 4d d8 7f da  |3....+..WO:BM...|
000000b0  91 ca 6f 5c b0 b0 bf 14  28 f8 ee 04 b8 8f 25 16  |..o\....(.....%.|
000000c0  88 de 4f 78 16 86 a9 e5  5a 41 2b ad ce f5 d0 e3  |..Ox....ZA+.....|
000000d0  bb 78 21 c0 67 64 d9 a7  c5 bf 5b 82 2a fd 6e 0c  |.x!.gd....[.*.n.|
000000e0  21 ac 1c 79 77 e8 99 48  e7 04 62 1f 6d ab 6a 52  |!..yw..H..b.m.jR|
000000f0  16 47 34 3c 73 6b be af  c3 4b 03 63 35 ec 66 5e  |.G4<sk...K.c5.f^|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	19	5	6.3
RIPv1	520/udp	2	2	131.24
TFTP	69/udp +1	3	1	60
Portmap	111/udp	1	1	7 to 28
mDNS	5353/udp	1	1	2 to 10
NTP	123/udp	1	1	556.9
NetBIOS	137/udp	1	1	3.8
CLDAP	389/udp	1	1	56 to 70
CharGEN	19/udp	1	1	358.8
SSDP	1900/udp	1	1	30.8
Memcached	11211/udp	1	1	10,000 to 51,000
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP19
5060/udp SIP3
1434/udp MSSQL Browser3
500/udp IKE2
520/udp RIP2
6969/udp2
2152/udp GTP-U2
2123/udp GTP-C2
69/udp TFTP2
3671/udp1
623/udp IPMI1
427/udp SLP1

DNS questions

_services._dns-sd._udp.local PTR1

DNS record types

PTR1

Networks

AS211680 Sistemas Informaticos, S.A. from 7 sources67

Countries

PT Portugal67

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.156.129.85	AS211680 Sistemas Informaticos, S.A.	PT	Unrecognised	15	2026-10-08 02:52
45.156.129.87	AS211680 Sistemas Informaticos, S.A.	PT	BitTorrent	14	2026-10-08 02:51
45.156.129.86	AS211680 Sistemas Informaticos, S.A.	PT	Unrecognised	11	2026-10-08 02:50
45.156.129.88	AS211680 Sistemas Informaticos, S.A.	PT	Unrecognised	10	2026-10-08 02:52
45.156.129.165	AS211680 Sistemas Informaticos, S.A.	PT	SNMP	7	2026-10-08 05:37
45.156.129.166	AS211680 Sistemas Informaticos, S.A.	PT	SNMP	6	2026-10-08 05:37
45.156.129.164	AS211680 Sistemas Informaticos, S.A.	PT	SNMP	4	2026-10-08 05:37

Latest datagrams

2026-10-08 05:37:5645.156.129.165to 500/udpUnrecognisedPT

·D ·=U·! "·"·0·,·(·M·H ·e(n·DP·_·ƹ·'·X·0·9·c"·<6·YS'·O·&·

payload bytes

00000000  a0 a5 44 20 97 08 3d 55  00 00 00 00 00 00 00 00  |..D ..=U........|
00000010  21 20 22 08 00 00 00 00  00 00 01 88 22 00 00 30  |! "........."..0|
00000020  00 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 05 03 00 00 08  |................|
00000040  03 00 00 0c 00 00 00 08  04 00 00 0e 28 00 01 08  |............(...|
00000050  00 0e 00 00 cf 4d e8 04  0e 48 0a cc ee 65 28 6e  |.....M...H...e(n|
00000060  a4 44 50 97 c4 5f 82 c6  b9 b8 c2 9a 9c 27 aa dc  |.DP.._.......'..|
00000070  58 af 30 da 39 01 63 22  00 3c 36 c7 c0 83 c1 84  |X.0.9.c".<6.....|
00000080  a6 a4 ba 59 53 27 9c 4f  05 26 d7 cf c1 fe e4 12  |...YS'.O.&......|
00000090  d1 79 5a 7e 1d a9 1b 6f  09 78 f2 df 79 19 6e 0f  |.yZ~...o.x..y.n.|
000000a0  33 e2 9f ae 93 2b 15 d3  57 4f 3a 42 4d d8 7f da  |3....+..WO:BM...|
000000b0  91 ca 6f 5c b0 b0 bf 14  28 f8 ee 04 b8 8f 25 16  |..o\....(.....%.|
000000c0  88 de 4f 78 16 86 a9 e5  5a 41 2b ad ce f5 d0 e3  |..Ox....ZA+.....|
000000d0  bb 78 21 c0 67 64 d9 a7  c5 bf 5b 82 2a fd 6e 0c  |.x!.gd....[.*.n.|
000000e0  21 ac 1c 79 77 e8 99 48  e7 04 62 1f 6d ab 6a 52  |!..yw..H..b.m.jR|
000000f0  16 47 34 3c 73 6b be af  c3 4b 03 63 35 ec 66 5e  |.G4<sk...K.c5.f^|
... 392 bytes shown in part

2026-10-08 05:37:4345.156.129.164to 161/udpSNMPPT

0)·public·VZ·]·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 56 5a dc 5d 02 01 00  02 01 00 30 0e 30 0c 06  |.VZ.]......0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-08 05:37:2945.156.129.165to 161/udpSNMPPT

06·a·.·0#0·+·0·+·

payload bytes

00000000  30 36 02 01 01 04 01 61  a0 2e 02 01 00 02 01 00  |06.....a........|
00000010  02 01 00 30 23 30 0c 06  08 2b 06 01 02 01 01 01  |...0#0...+......|
00000020  00 05 00 30 13 06 0f 2b  06 01 04 01 a3 0b 02 04  |...0...+........|
00000030  01 01 06 01 01 00 05 00                           |........|

2026-10-08 05:37:2945.156.129.165to 161/udpSNMPPT

06·a·.·0#0·+·0·+·

payload bytes

00000000  30 36 02 01 01 04 01 61  a0 2e 02 01 00 02 01 00  |06.....a........|
00000010  02 01 00 30 23 30 0c 06  08 2b 06 01 02 01 01 01  |...0#0...+......|
00000020  00 05 00 30 13 06 0f 2b  06 01 04 01 a3 0b 02 04  |...0...+........|
00000030  01 01 06 01 01 00 05 00                           |........|

2026-10-08 05:37:2945.156.129.165to 161/udpSNMPPT

06·a·.·0#0·+·0·+·

payload bytes

00000000  30 36 02 01 01 04 01 61  a0 2e 02 01 00 02 01 00  |06.....a........|
00000010  02 01 00 30 23 30 0c 06  08 2b 06 01 02 01 01 01  |...0#0...+......|
00000020  00 05 00 30 13 06 0f 2b  06 01 04 01 a3 0b 02 04  |...0...+........|
00000030  01 01 06 01 01 00 05 00                           |........|

2026-10-08 05:37:1345.156.129.166to 427/udpUnrecognisedPT

·b@·en·,·slpTest://test:31337/·)slpTest://test:31337/aaaaaaaaaaaaaaaaaaaa·default·

payload bytes

00000000  02 03 00 00 62 40 00 00  00 00 88 11 00 02 65 6e  |....b@........en|
00000010  00 01 2c 00 15 73 6c 70  54 65 73 74 3a 2f 2f 74  |..,..slpTest://t|
00000020  65 73 74 3a 33 31 33 33  37 2f 00 00 29 73 6c 70  |est:31337/..)slp|
00000030  54 65 73 74 3a 2f 2f 74  65 73 74 3a 33 31 33 33  |Test://test:3133|
00000040  37 2f 61 61 61 61 61 61  61 61 61 61 61 61 61 61  |7/aaaaaaaaaaaaaa|
00000050  61 61 61 61 61 61 00 07  64 65 66 61 75 6c 74 00  |aaaaaa..default.|
00000060  00 00                                             |..|

2026-10-08 05:36:5945.156.129.166to 161/udpSNMPPT

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-08 05:36:5945.156.129.166to 161/udpSNMPPT

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-08 05:36:5945.156.129.166to 161/udpSNMPPT

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-08 05:36:4745.156.129.166to 5060/udpSIPPT
OPTIONS sip:nzeliNQl@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.156.129.166:55875;branch=mtNAdi.7725660277;rport;alias From: sip:ZElXVCoj@45.156.129.166:55875;tag=05513667 To: sip:vkinDDMW@<HONEYPOT>
Payload bytes withheld: they contain the sensor's address.

2026-10-08 05:36:3445.156.129.164to 161/udpSNMPPT