UDP traffic

Datagrams matching asn:32475 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

8 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 2 SNMP 2 NetBIOS 1 NTP 1 SSDP 1 SOAP 1

Latest DNS datagram, to 5353/udp

DNS query PTR _device-info._tcp.local

payload bytes

00000000  62 b9 01 20 00 01 00 00  00 00 00 01 0c 5f 64 65  |b.. ........._de|
00000010  76 69 63 65 2d 69 6e 66  6f 04 5f 74 63 70 05 6c  |vice-info._tcp.l|
00000020  6f 63 61 6c 00 00 0c 00  01 00 00 29 04 d0 00 00  |ocal.......)....|
00000030  00 00 00 0c 00 0a 00 08  83 4c 64 dd ca ac 8f 65  |.........Ld....e|

Other services

61 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 59 GTP-C 2

Latest SIP datagram, to 5060/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5479;branch=z9hG4bK-2891442139;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401343137303132343231 User-Agent: friendly-scanner Call-ID: 27806888688240748

Payload bytes withheld: they contain the sensor's address.

QUIC

1 datagrams from 1 source

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 1

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

4 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 2123/udp

·3133·

payload bytes

00000000  10 01 00 00 00 00 00 00  00 ff ff ff 33 31 33 33  |............3133|
00000010  00 00 00 00                                       |....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	2	1	2 to 10
SNMPv2	161/udp	2	1	6.3
NTP	123/udp	1	1	556.9
NetBIOS	137/udp	1	1	3.8
SSDP	1900/udp	1	1	30.8
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP59
2123/udp GTP-C3
161/udp SNMP2
5353/udp DNS2
123/udp NTP1
137/udp NetBIOS1
443/udp QUIC1
500/udp IKE1
1701/udp L2TP1
1900/udp SSDP1
3702/udp SOAP1
10001/udp Ubiquiti discovery1

DNS questions

DNS record types

PTR2

QUIC versions

0xfa1a1a1a1

Networks

AS32475 Internap Holding LLC from 5 sources74

Countries

US United States74

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	40	2026-10-11 05:52
108.178.17.26	AS32475 Internap Holding LLC	US	SIP	19	2026-10-11 03:59
203.55.131.5	AS32475 Internap Holding LLC	US	Unrecognised	11	2026-10-11 01:16
203.55.131.3	AS32475 Internap Holding LLC	US	SSDP	3	2026-10-10 05:08
203.55.131.4	AS32475 Internap Holding LLC	US	Unrecognised	1	2026-10-06 14:49

Latest datagrams

2026-10-11 05:52:13162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5479;branch=z9hG4bK-2891442139;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=31
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:59:13108.178.17.26to 5060/udpSIPUS
INVITE sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK-22yuir2zv1 Max-Forwards: 70 To: <sip:<HONEYPOT>> From: <sip:scan@scanner.local>;tag=6ezb6mk5 Call-ID: 179169115329
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:30:17162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5661;branch=z9hG4bK-3352974268;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=30
Payload bytes withheld: they contain the sensor's address.

2026-10-11 01:16:24203.55.131.5to 3702/udpSOAPUS

<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoa

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-10 22:26:38162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5541;branch=z9hG4bK-4051213666;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=63
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:25:11162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5348;branch=z9hG4bK-3546670515;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=62
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:37:29162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5278;branch=z9hG4bK-2193066189;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 16:10:40162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5829;branch=z9hG4bK-2350270343;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=63
Payload bytes withheld: they contain the sensor's address.
2026-10-10 16:07:24162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5654;branch=z9hG4bK-4057892813;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=62
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:17:13162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5651;branch=z9hG4bK-460629394;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=313
Payload bytes withheld: they contain the sensor's address.
2026-10-10 11:54:23162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5807;branch=z9hG4bK-4197134602;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=30
Payload bytes withheld: they contain the sensor's address.

2026-10-10 10:30:53203.55.131.5to 2123/udpGTP-CUS

@·

payload bytes

00000000  40 01 00 04 ff 00 00 00                           |@.......|

2026-10-10 10:08:09203.55.131.5to 2123/udpGTP-CUS

2·=·

payload bytes

00000000  32 01 00 04 00 00 00 00  0c 3d 00 00              |2........=..|

2026-10-10 09:45:41203.55.131.5to 2123/udpUnrecognisedUS

·3133·

payload bytes

00000000  10 01 00 00 00 00 00 00  00 ff ff ff 33 31 33 33  |............3133|
00000010  00 00 00 00                                       |....|

2026-10-10 06:46:11162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5653;branch=z9hG4bK-1309190304;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=63
Payload bytes withheld: they contain the sensor's address.