UDP traffic
Datagrams matching asn:401661 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
160
Datagrams
1
Source addresses
1
Networks
1
Countries
32
Destination ports
Traffic by type
Service queries
57 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest DNS datagram, to 5353/udp
payload bytes
00000000 00 00 00 00 00 01 00 00 00 00 00 00 09 5f 73 65 |............._se| 00000010 72 76 69 63 65 73 07 5f 64 6e 73 2d 73 64 04 5f |rvices._dns-sd._| 00000020 75 64 70 05 6c 6f 63 61 6c 00 00 0c 00 01 |udp.local.....|
Other services
19 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
Unrecognised
79 datagrams from 1 sourceDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 47808/udp
payload bytes
00000000 81 0a 00 08 01 00 10 08 |........|
Peer-to-peer
5 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| SNMPv2 | 161/udp | 14 | 1 | 6.3 |
| DNS | 5355/udp +2 | 12 | 1 | 28 to 54 |
| NetBIOS | 137/udp | 9 | 1 | 3.8 |
| SSDP | 1900/udp | 8 | 1 | 30.8 |
| TFTP | 69/udp | 5 | 1 | 60 |
| mDNS | 5353/udp | 3 | 1 | 2 to 10 |
| RIPv1 | 520/udp | 3 | 1 | 131.24 |
| CharGEN | 19/udp | 3 | 1 | 358.8 |
| QOTD | 17/udp | 3 | 1 | 140.3 |
| Portmap | 111/udp | 1 | 1 | 7 to 28 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
DNS questions
DNS record types
Networks
- AS401661 EMBNEX, LLC from 1 source160
Countries
- BR Brazil160
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 16.5.0.234 | AS401661 EMBNEX, LLC | BR | Unrecognised | 160 | 2026-10-10 07:10 |
Latest datagrams
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|
payload bytes
00000000 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 40 31 20 |OPTIONS sip:1@1 | 00000010 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 |SIP/2.0..Via: SI| 00000020 50 2f 32 2e 30 2f 55 44 50 20 31 3a 35 30 36 30 |P/2.0/UDP 1:5060| 00000030 3b 62 72 61 6e 63 68 3d 7a 0d 0a 46 72 6f 6d 3a |;branch=z..From:| 00000040 20 3c 73 69 70 3a 31 40 31 3e 3b 74 61 67 3d 31 | <sip:1@1>;tag=1| 00000050 0d 0a 54 6f 3a 20 3c 73 69 70 3a 31 40 31 3e 0d |..To: <sip:1@1>.| 00000060 0a 43 61 6c 6c 2d 49 44 3a 20 31 0d 0a 43 53 65 |.Call-ID: 1..CSe| 00000070 71 3a 20 31 20 4f 50 54 49 4f 4e 53 0d 0a 43 6f |q: 1 OPTIONS..Co| 00000080 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d |ntent-Length: 0.| 00000090 0a 0d 0a |...|