UDP traffic

Datagrams matching asn:4837 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1 SIP 1

Latest SOCKS5 datagram, to 22140/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

5 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 5

Latest Unrecognised datagram, to 31065/udp

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
RIPv1	520/udp	1	1	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS4837 CHINA UNICOM China169 Backbone from 7 sources7

Countries

CN China7

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
122.136.26.139	AS4837 CHINA UNICOM China169 Backbone	CN	SOCKS5	1	2026-10-10 13:10
113.206.146.178	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 17:06
123.144.21.9	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 22:27
182.88.7.101	AS4837 CHINA UNICOM China169 Backbone	CN	SIP	1	2026-10-11 03:30
175.163.103.77	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-11 04:23
115.63.190.167	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 10:18
123.14.125.191	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 13:46

Latest datagrams

2026-10-11 04:23:57175.163.103.77to 31065/udpUnrecognisedCN

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

2026-10-11 03:30:08182.88.7.101to 5060/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 22:27:28123.144.21.9to 520/udpUnrecognisedCN

·D·

payload bytes

00000000  01 01 00 00 00 02 00 00  44 00 00 00 00 00 00 00  |........D.......|
00000010  00 00 00 00 00 00 00 0f                           |........|

2026-10-10 17:06:26113.206.146.178to 5008/udpUnrecognisedCN

·@P·]·(·|·@·9·B7e·

payload bytes

00000000  00 40 50 00 00 00 00 85  5d b4 91 28 00 00 00 00  |.@P.....]..(....|
00000010  00 01 7c 91 40 00 00 00  aa 39 da 42 37 65 cf 01  |..|.@....9.B7e..|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-10 13:46:26123.14.125.191to 5050/udpUnrecognisedCN
· · S·
payload bytes
```
00000000  00 00 00 0d 01 00 00 01  00 0a 20 53 18           |.......... S.|
```

2026-10-10 13:10:48122.136.26.139to 22140/udpSOCKS5CN

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 10:18:35115.63.190.167to 4000/udpUnrecognisedCN

·.· Nc·rfMm? 6coy Ynk·246 w·E·`·iarrSX?@·`wzOp·(^r7·'n·c"·C\%

payload bytes

00000000  1a 2e 0c 09 4e 63 08 72  66 4d 6d 3f 20 36 63 6f  |....Nc.rfMm? 6co|
00000010  79 0d 59 6e 6b 0f 32 34  36 0d 77 1a 45 04 02 60  |y.Ynk.246.w.E..`|
00000020  13 0e 69 61 72 72 53 58  3f 40 17 60 77 7a 4f 70  |..iarrSX?@.`wzOp|
00000030  07 28 5e 72 37 10 27 6e  1e 1e 08 63 22 0b 43 5c  |.(^r7.'n...c".C\|
00000040  25                                                |%|