UDP traffic

Datagrams matching asn:53667 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

44 datagrams from 4 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 44

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-2729267454;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401373332333132363533 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Cont

Payload bytes withheld: they contain the sensor's address.

Unrecognised

13 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 13

Latest Unrecognised datagram, to 8000/udp

x.·8#"X·

payload bytes

00000000  78 2e 1b 38 23 22 58 04                           |x..8#"X.|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	2	1	2 to 10
SSDP	1900/udp	1	1	30.8
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP14
5062/udp SIP4
5063/udp SIP4
5064/udp SIP4
5065/udp SIP4
5067/udp SIP4
5068/udp SIP4
5066/udp SIP3
5069/udp SIP3
5353/udp mDNS2
8000/udp2
8083/udp2

Networks

AS53667 FranTech Solutions from 6 sources58

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
199.195.250.193	AS53667 FranTech Solutions	US	SIP	27	2026-10-09 10:22
209.141.51.29	AS53667 FranTech Solutions	US	Unrecognised	13	2026-10-11 07:55
199.195.252.209	AS53667 FranTech Solutions	US	SIP	8	2026-10-10 23:47
198.98.58.74	AS53667 FranTech Solutions	US	SIP	6	2026-10-09 20:19
198.98.57.120	AS53667 FranTech Solutions	US	SIP	3	2026-10-06 10:49
107.189.1.154	AS53667 FranTech Solutions	LU	Unrecognised	1	2026-10-11 02:54

Latest datagrams

2026-10-11 07:55:10209.141.51.29to 8000/udpUnrecognisedUS
x.·8#"X·
payload bytes
```
00000000  78 2e 1b 38 23 22 58 04                           |x..8#"X.|
```

2026-10-11 02:54:39107.189.1.154to 1434/udpUnrecognisedLU

j.Vn·.7·V6uei';*j,hx·P

payload bytes

00000000  6a 2e 56 6e 00 2e 37 06  56 36 75 65 69 27 3b 2a  |j.Vn..7.V6uei';*|
00000010  6a 2c 68 78 14 dc 50                              |j,hx..P|

2026-10-10 23:47:28199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-2729267454;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363340137333233313236
Payload bytes withheld: they contain the sensor's address.

2026-10-10 20:11:20209.141.51.29to 8083/udpUnrecognisedUS

·.QIbZr·\b5w#·SL·[<\YEL3-m5#/·o

payload bytes

00000000  1b 2e 51 49 62 5a 72 11  5c 62 35 77 23 18 53 4c  |..QIbZr.\b5w#.SL|
00000010  12 03 5b 3c 5c 59 45 4c  33 2d 6d 35 23 2f 99 6f  |..[<\YEL3-m5#/.o|

2026-10-10 15:38:48199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-1266136753;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340135333836323335
Payload bytes withheld: they contain the sensor's address.
2026-10-10 15:20:07199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5067;branch=z9hG4bK-1139286983;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340132353234363936
Payload bytes withheld: they contain the sensor's address.

2026-10-10 15:19:29209.141.51.29to 30301/udpUnrecognisedUS

·.4#xCHSFXtO(]·J·A~)4I·

payload bytes

00000000  14 2e 34 23 78 43 48 53  46 58 74 4f 28 5d 1c 4a  |..4#xCHSFXtO(].J|
00000010  1f 16 41 7e 29 34 49 dd                           |..A~)4I.|

2026-10-10 04:04:55209.141.51.29to 5353/udpUnrecognisedUS

}.-·##mS·'·*·ri·iJ:v·~·RFjdhFb·s{<·h·.H·G[·0ulz/c·-ucs_H[%*t·%0/ ?M·n·-5p1ee·_·pAuT4U·w

payload bytes

00000000  7d 2e 2d 19 23 23 6d 53  07 27 1f 2a 01 18 13 72  |}.-.##mS.'.*...r|
00000010  69 19 69 4a 3a 76 17 7e  12 52 46 6a 64 68 46 62  |i.iJ:v.~.RFjdhFb|
00000020  19 73 7b 3c 16 68 0f 1d  0f 2e 48 11 47 5b 03 30  |.s{<.h....H.G[.0|
00000030  75 6c 7a 2f 63 11 2d 75  63 73 5f 48 5b 25 2a 74  |ulz/c.-ucs_H[%*t|
00000040  19 25 30 2f 0d 3f 4d 1c  6e 15 2d 35 70 31 65 65  |.%0/.?M.n.-5p1ee|
00000050  1d 5f 14 00 70 41 75 54  34 55 aa 77              |._..pAuT4U.w|

2026-10-09 20:19:38198.98.58.74to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-3014822446;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363340132363938333038
Payload bytes withheld: they contain the sensor's address.
2026-10-09 17:19:30199.195.252.209to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5064;branch=z9hG4bK-844813469;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401323734313330353
Payload bytes withheld: they contain the sensor's address.
2026-10-09 11:05:26198.98.58.74to 5060/udpSIPUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-1356195227;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340137333830303837
Payload bytes withheld: they contain the sensor's address.
2026-10-09 10:22:29199.195.250.193to 5066/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=0390c72ca Via: SIP/2.0/UDP 199.195.250.193:57921;branch=z9hG4bK-d87543-059104363-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 10:11:27199.195.250.193to 5062/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=2df1e9a6e Via: SIP/2.0/UDP 199.195.250.193:65520;branch=z9hG4bK-d87543-922907499-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.
2026-10-09 09:56:49199.195.250.193to 5069/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:1001@<HONEYPOT>> From: <sip:1001@<HONEYPOT>>;tag=49eb6f664 Via: SIP/2.0/UDP 199.195.250.193:53571;branch=z9hG4bK-d87543-310053152-1--d87543;rport Call-ID:
Payload bytes withheld: they contain the sensor's address.

2026-10-09 09:13:48209.141.51.29to 8083/udpUnrecognisedUS

u.(f·rC7j·h-·:·'c(~·Kzv[·~:\v R*286${n·V<$·D'8'P7>·14wE21!(:sRl+ ·'w·8M[\^·FTN·o·8fDj·f·RYn·

payload bytes

00000000  75 2e 28 66 0c 72 43 37  6a 15 68 2d 13 3a 08 03  |u.(f.rC7j.h-.:..|
00000010  27 63 28 7e 17 4b 7a 76  5b 13 7e 3a 5c 76 09 52  |'c(~.Kzv[.~:\v.R|
00000020  2a 32 38 36 24 7b 6e 0e  11 56 3c 24 11 44 27 38  |*286${n..V<$.D'8|
00000030  27 50 37 3e 1b 31 34 77  45 32 31 21 28 3a 73 52  |'P7>.14wE21!(:sR|
00000040  6c 2b 09 10 27 77 1f 38  4d 5b 5c 5e 1f 04 17 46  |l+..'w.8M[\^...F|
00000050  54 4e 04 6f 7f 38 66 44  6a 17 66 12 52 59 6e 1d  |TN.o.8fDj.f.RYn.|