UDP traffic

Datagrams matching asn:4134 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1 SIP 1

Latest SOCKS5 datagram, to 56941/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

4 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 4000/udp

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

Destination ports

Networks

AS4134 Chinanet from 6 sources6

Countries

CN China6

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
59.49.230.168	AS4134 Chinanet	CN	Unrecognised	1	2026-10-10 11:17
116.30.9.218	AS4134 Chinanet	CN	Unrecognised	1	2026-10-11 01:28
183.129.148.70	AS4134 Chinanet	CN	Unrecognised	1	2026-10-10 21:24
106.117.111.115	AS4134 Chinanet	CN	Unrecognised	1	2026-10-10 11:16
124.31.106.10	AS4134 Chinanet	CN	SIP	1	2026-10-10 19:01
14.145.44.147	AS4134 Chinanet	CN	SOCKS5	1	2026-10-10 11:11

Latest datagrams

2026-10-11 01:28:51116.30.9.218to 4000/udpUnrecognisedCN

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

2026-10-10 21:24:26183.129.148.70to 8081/udpUnrecognisedCN
·.MkR·&GG·k
payload bytes
```
00000000  0f 2e 4d 6b 52 05 26 47  47 8d 6b                 |..MkR.&GG.k|
```

2026-10-10 19:01:41124.31.106.10to 5061/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 11:17:5359.49.230.168to 80/udpUnrecognisedCN
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 11:16:59106.117.111.115to 1194/udpUnrecognisedCN

8·8·b·gF-ކsM,·Q·#·a·#·r·P·&,·

payload bytes

00000000  38 81 38 14 62 1d 67 46  2d de 86 73 4d 2c bf f1  |8.8.b.gF-..sM,..|
00000010  51 b2 b1 23 1b 61 e4 23  08 a2 72 81 8e 00 00 00  |Q..#.a.#..r.....|
00000020  01 50 ff 26 2c 00 00 00  00 00                    |.P.&,.....|

2026-10-10 11:11:3214.145.44.147to 56941/udpSOCKS5CN

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part