UDP traffic

Datagrams matching asn:44382 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

4 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 4

Latest SIP datagram, to 5060/udp

PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5115;branch=z9hG4bK-3800159989;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363340133353033393032323533 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 11211/udp

·stats

payload bytes

00000000  00 00 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP3
11211/udp Memcached1
65476/udp SIP1

Networks

AS44382 Fiba Cloud Operation Company, LLC from 2 sources5

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.141.148.75	AS44382 Fiba Cloud Operation Company, LLC	TR	SIP	4	2026-10-10 03:56
216.9.225.228	AS44382 Fiba Cloud Operation Company, LLC	US	Unrecognised	1	2026-10-07 09:46

Latest datagrams

2026-10-10 03:56:1845.141.148.75to 5060/udpSIPTR
PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5115;branch=z9hG4bK-3800159989;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336334013335303339
Payload bytes withheld: they contain the sensor's address.
2026-10-10 02:52:0445.141.148.75to 5060/udpSIPTR
PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5109;branch=z9hG4bK-1158495407;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336334013230353236
Payload bytes withheld: they contain the sensor's address.
2026-10-07 19:13:5145.141.148.75to 65476/udpSIPTR
PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5229;branch=z9hG4bK-1109176757;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393266666334013334303534
Payload bytes withheld: they contain the sensor's address.
2026-10-07 09:46:06216.9.225.228to 11211/udpUnrecognisedUS
·stats
payload bytes
```
00000000  00 00 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```
2026-10-06 14:21:1345.141.148.75to 5060/udpSIPTR
PUBLISH sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 45.141.148.75:5500;branch=z9hG4bK-2339968288;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653331336334013331393739
Payload bytes withheld: they contain the sensor's address.