UDP traffic

Datagrams matching asn:53667 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

3 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 3

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-2729267454;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401373332333132363533 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Cont

Payload bytes withheld: they contain the sensor's address.

Unrecognised

4 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 8000/udp

x.·8#"X·

payload bytes

00000000  78 2e 1b 38 23 22 58 04                           |x..8#"X.|

Destination ports

Networks

AS53667 FranTech Solutions from 3 sources7

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
209.141.51.29	AS53667 FranTech Solutions	US	Unrecognised	3	2026-10-11 07:55
199.195.252.209	AS53667 FranTech Solutions	US	SIP	3	2026-10-10 23:47
107.189.1.154	AS53667 FranTech Solutions	LU	Unrecognised	1	2026-10-11 02:54

Latest datagrams

2026-10-11 07:55:10209.141.51.29to 8000/udpUnrecognisedUS
x.·8#"X·
payload bytes
```
00000000  78 2e 1b 38 23 22 58 04                           |x..8#"X.|
```

2026-10-11 02:54:39107.189.1.154to 1434/udpUnrecognisedLU

j.Vn·.7·V6uei';*j,hx·P

payload bytes

00000000  6a 2e 56 6e 00 2e 37 06  56 36 75 65 69 27 3b 2a  |j.Vn..7.V6uei';*|
00000010  6a 2c 68 78 14 dc 50                              |j,hx..P|

2026-10-10 23:47:28199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-2729267454;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363340137333233313236
Payload bytes withheld: they contain the sensor's address.

2026-10-10 20:11:20209.141.51.29to 8083/udpUnrecognisedUS

·.QIbZr·\b5w#·SL·[<\YEL3-m5#/·o

payload bytes

00000000  1b 2e 51 49 62 5a 72 11  5c 62 35 77 23 18 53 4c  |..QIbZr.\b5w#.SL|
00000010  12 03 5b 3c 5c 59 45 4c  33 2d 6d 35 23 2f 99 6f  |..[<\YEL3-m5#/.o|

2026-10-10 15:38:48199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-1266136753;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340135333836323335
Payload bytes withheld: they contain the sensor's address.
2026-10-10 15:20:07199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5067;branch=z9hG4bK-1139286983;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340132353234363936
Payload bytes withheld: they contain the sensor's address.

2026-10-10 15:19:29209.141.51.29to 30301/udpUnrecognisedUS

·.4#xCHSFXtO(]·J·A~)4I·

payload bytes

00000000  14 2e 34 23 78 43 48 53  46 58 74 4f 28 5d 1c 4a  |..4#xCHSFXtO(].J|
00000010  1f 16 41 7e 29 34 49 dd                           |..A~)4I.|