UDP traffic

Datagrams matching asn:45102 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 2

Latest NTP datagram, to 123/udp

#· ·u·0I

payload bytes

00000000  23 00 00 20 00 00 00 00  00 00 00 00 00 00 00 00  |#.. ............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 75 94 fa 9c d6 30 49  |.........u....0I|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1

Latest SIP datagram, to 6060/udp

REGISTER sip:·\.0\.0\.0 SIP/2.0 Via: SIP/2.0/UDP 192.168.0.235:52535;rport;branch=z9hG4bKPj6fdf1f75ac884ac0b29e629677a35fa8 Max-Forwards: 70 From: <sip:asdad@123123>;tag=f089ae2854224eb3b0b5d4e0e5d4cafb To: <sip:asdad@123123> Call-ID: 3807cf54dc674513a9bcc10af470fc2d CSeq: 57551 REGISTER User

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 00 5c 2e  |REGISTER sip:.\.|
00000010  30 5c 2e 30 5c 2e 30 20  53 49 50 2f 32 2e 30 0d  |0\.0\.0 SIP/2.0.|
00000020  0a 56 69 61 3a 20 53 49  50 2f 32 2e 30 2f 55 44  |.Via: SIP/2.0/UD|
00000030  50 20 31 39 32 2e 31 36  38 2e 30 2e 32 33 35 3a  |P 192.168.0.235:|
00000040  35 32 35 33 35 3b 72 70  6f 72 74 3b 62 72 61 6e  |52535;rport;bran|
00000050  63 68 3d 7a 39 68 47 34  62 4b 50 6a 36 66 64 66  |ch=z9hG4bKPj6fdf|
00000060  31 66 37 35 61 63 38 38  34 61 63 30 62 32 39 65  |1f75ac884ac0b29e|
00000070  36 32 39 36 37 37 61 33  35 66 61 38 0d 0a 4d 61  |629677a35fa8..Ma|
00000080  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000090  46 72 6f 6d 3a 20 3c 73  69 70 3a 61 73 64 61 64  |From: <sip:asdad|
000000a0  40 31 32 33 31 32 33 3e  3b 74 61 67 3d 66 30 38  |@123123>;tag=f08|
000000b0  39 61 65 32 38 35 34 32  32 34 65 62 33 62 30 62  |9ae2854224eb3b0b|
000000c0  35 64 34 65 30 65 35 64  34 63 61 66 62 0d 0a 54  |5d4e0e5d4cafb..T|
000000d0  6f 3a 20 3c 73 69 70 3a  61 73 64 61 64 40 31 32  |o: <sip:asdad@12|
000000e0  33 31 32 33 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |3123>..Call-ID: |
000000f0  33 38 30 37 63 66 35 34  64 63 36 37 34 35 31 33  |3807cf54dc674513|

Unrecognised

11 datagrams from 11 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 11

Latest Unrecognised datagram, to 5095/udp

· ·N

payload bytes

00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	2	2	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

123/udp NTP2
5095/udp2
28784/udp2
64738/udp2
623/udp IPMI1
1434/udp MSSQL Browser1
1604/udp1
4500/udp IPsec NAT-T1
6060/udp SIP1
6969/udp1

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 14 sources14

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
8.211.47.19	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-10 08:34
8.211.46.83	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-10 09:16
8.211.33.23	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-10 11:53
47.250.38.169	AS45102 Alibaba (US) Technology Co., Ltd.	MY	Unrecognised	1	2026-10-10 16:13
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	NTP	1	2026-10-11 04:54
8.209.83.9	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 03:55
47.251.76.211	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	1	2026-10-10 17:26
8.211.42.24	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 01:57
47.251.13.59	AS45102 Alibaba (US) Technology Co., Ltd.	US	NTP	1	2026-10-10 11:19
47.88.90.74	AS45102 Alibaba (US) Technology Co., Ltd.	US	SIP	1	2026-10-10 17:36
47.251.81.110	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	1	2026-10-11 04:47
47.245.141.134	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-10 13:00
8.211.44.115	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 01:45
47.254.167.143	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 03:28

Latest datagrams

2026-10-11 04:54:188.208.10.94to 123/udpNTPGB

#· ·u·0I

payload bytes

00000000  23 00 00 20 00 00 00 00  00 00 00 00 00 00 00 00  |#.. ............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 75 94 fa 9c d6 30 49  |.........u....0I|

2026-10-11 04:47:5647.251.81.110to 5095/udpUnrecognisedUS
· ·N
payload bytes
```
00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |
```

2026-10-11 03:55:178.209.83.9to 5095/udpUnrecognisedDE

· ·N

payload bytes

00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |

2026-10-11 03:28:0147.254.167.143to 623/udpUnrecognisedDE

payload bytes

00000000  06 00 ff 06 00 00 11 be  80 00 00 00              |............|

2026-10-11 01:57:058.211.42.24to 28784/udpUnrecognisedDE

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-11 01:45:518.211.44.115to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-10 17:36:2947.88.90.74to 6060/udpSIPUS

REGISTER sip:·\.0\.0\.0 SIP/2.0 Via: SIP/2.0/UDP 192.168.0.235:52535;rport;branch=z9hG4bKPj6fdf1f75ac884ac0b29e629677a35fa8 Max-Forwards: 70 From: <sip:asdad@123123>;tag=f089ae2854224eb3b0b5d4e0e5d

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 00 5c 2e  |REGISTER sip:.\.|
00000010  30 5c 2e 30 5c 2e 30 20  53 49 50 2f 32 2e 30 0d  |0\.0\.0 SIP/2.0.|
00000020  0a 56 69 61 3a 20 53 49  50 2f 32 2e 30 2f 55 44  |.Via: SIP/2.0/UD|
00000030  50 20 31 39 32 2e 31 36  38 2e 30 2e 32 33 35 3a  |P 192.168.0.235:|
00000040  35 32 35 33 35 3b 72 70  6f 72 74 3b 62 72 61 6e  |52535;rport;bran|
00000050  63 68 3d 7a 39 68 47 34  62 4b 50 6a 36 66 64 66  |ch=z9hG4bKPj6fdf|
00000060  31 66 37 35 61 63 38 38  34 61 63 30 62 32 39 65  |1f75ac884ac0b29e|
00000070  36 32 39 36 37 37 61 33  35 66 61 38 0d 0a 4d 61  |629677a35fa8..Ma|
00000080  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000090  46 72 6f 6d 3a 20 3c 73  69 70 3a 61 73 64 61 64  |From: <sip:asdad|
000000a0  40 31 32 33 31 32 33 3e  3b 74 61 67 3d 66 30 38  |@123123>;tag=f08|
000000b0  39 61 65 32 38 35 34 32  32 34 65 62 33 62 30 62  |9ae2854224eb3b0b|
000000c0  35 64 34 65 30 65 35 64  34 63 61 66 62 0d 0a 54  |5d4e0e5d4cafb..T|
000000d0  6f 3a 20 3c 73 69 70 3a  61 73 64 61 64 40 31 32  |o: <sip:asdad@12|
000000e0  33 31 32 33 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |3123>..Call-ID: |
000000f0  33 38 30 37 63 66 35 34  64 63 36 37 34 35 31 33  |3807cf54dc674513|
... 504 bytes shown in part

2026-10-10 17:26:3547.251.76.211to 28784/udpUnrecognisedUS

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-10 16:13:1647.250.38.169to 6969/udpUnrecognisedMY
·'·o·6
payload bytes
```
00000000  00 00 04 17 27 10 19 80  00 00 00 00 6f 0b 11 36  |....'.......o..6|
```

2026-10-10 13:00:1847.245.141.134to 1604/udpUnrecognisedDE

·0·

payload bytes

00000000  1e 00 01 30 02 fd a8 e3  00 00 00 00 00 00 00 00  |...0............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-10 11:53:308.211.33.23to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-10 11:19:4647.251.13.59to 123/udpNTPUS

#·/·

payload bytes

00000000  23 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  e7 c0 e7 f1 2f ba d0 00  |............/...|

2026-10-10 09:16:128.211.46.83to 4500/udpUnrecognisedDE
H·r·]p!
payload bytes
```
00000000  48 8b 14 72 93 5d 70 21                           |H..r.]p!|
```
2026-10-10 08:34:428.211.47.19to 1434/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```