UDP traffic
Datagrams matching asn:53667 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
57
Datagrams
6
Source addresses
1
Networks
2
Countries
20
Destination ports
Traffic by type
Other services
44 datagrams from 4 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
12 datagrams from 2 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 1434/udp
payload bytes
00000000 6a 2e 56 6e 00 2e 37 06 56 36 75 65 69 27 3b 2a |j.Vn..7.V6uei';*| 00000010 6a 2c 68 78 14 dc 50 |j,hx..P|
Peer-to-peer
1 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 2 | 1 | 2 to 10 |
| SSDP | 1900/udp | 1 | 1 | 30.8 |
| Memcached | 11211/udp | 1 | 1 | 10,000 to 51,000 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 199.195.250.193 | AS53667 FranTech Solutions | US | SIP | 27 | 2026-10-09 10:22 |
| 209.141.51.29 | AS53667 FranTech Solutions | US | Unrecognised | 12 | 2026-10-10 20:11 |
| 199.195.252.209 | AS53667 FranTech Solutions | US | SIP | 8 | 2026-10-10 23:47 |
| 198.98.58.74 | AS53667 FranTech Solutions | US | SIP | 6 | 2026-10-09 20:19 |
| 198.98.57.120 | AS53667 FranTech Solutions | US | SIP | 3 | 2026-10-06 10:49 |
| 107.189.1.154 | AS53667 FranTech Solutions | LU | Unrecognised | 1 | 2026-10-11 02:54 |
Latest datagrams
payload bytes
00000000 6a 2e 56 6e 00 2e 37 06 56 36 75 65 69 27 3b 2a |j.Vn..7.V6uei';*| 00000010 6a 2c 68 78 14 dc 50 |j,hx..P|
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 1b 2e 51 49 62 5a 72 11 5c 62 35 77 23 18 53 4c |..QIbZr.\b5w#.SL| 00000010 12 03 5b 3c 5c 59 45 4c 33 2d 6d 35 23 2f 99 6f |..[<\YEL3-m5#/.o|
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 14 2e 34 23 78 43 48 53 46 58 74 4f 28 5d 1c 4a |..4#xCHSFXtO(].J| 00000010 1f 16 41 7e 29 34 49 dd |..A~)4I.|
payload bytes
00000000 7d 2e 2d 19 23 23 6d 53 07 27 1f 2a 01 18 13 72 |}.-.##mS.'.*...r| 00000010 69 19 69 4a 3a 76 17 7e 12 52 46 6a 64 68 46 62 |i.iJ:v.~.RFjdhFb| 00000020 19 73 7b 3c 16 68 0f 1d 0f 2e 48 11 47 5b 03 30 |.s{<.h....H.G[.0| 00000030 75 6c 7a 2f 63 11 2d 75 63 73 5f 48 5b 25 2a 74 |ulz/c.-ucs_H[%*t| 00000040 19 25 30 2f 0d 3f 4d 1c 6e 15 2d 35 70 31 65 65 |.%0/.?M.n.-5p1ee| 00000050 1d 5f 14 00 70 41 75 54 34 55 aa 77 |._..pAuT4U.w|Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 75 2e 28 66 0c 72 43 37 6a 15 68 2d 13 3a 08 03 |u.(f.rC7j.h-.:..| 00000010 27 63 28 7e 17 4b 7a 76 5b 13 7e 3a 5c 76 09 52 |'c(~.Kzv[.~:\v.R| 00000020 2a 32 38 36 24 7b 6e 0e 11 56 3c 24 11 44 27 38 |*286${n..V<$.D'8| 00000030 27 50 37 3e 1b 31 34 77 45 32 31 21 28 3a 73 52 |'P7>.14wE21!(:sR| 00000040 6c 2b 09 10 27 77 1f 38 4d 5b 5c 5e 1f 04 17 46 |l+..'w.8M[\^...F| 00000050 54 4e 04 6f 7f 38 66 44 6a 17 66 12 52 59 6e 1d |TN.o.8fDj.f.RYn.|Payload bytes withheld: they contain the sensor's address.