UDP traffic
Datagrams matching asn:53667 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
67
Datagrams
6
Source addresses
1
Networks
2
Countries
21
Destination ports
Traffic by type
Other services
49 datagrams from 4 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
16 datagrams from 2 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 8000/udp
payload bytes
00000000 48 2e 4f 10 53 45 79 5a 6a 66 7c 65 60 65 65 09 |H.O.SEyZjf|e`ee.|
00000010 6a 72 5b 46 35 68 62 51 77 6b 70 48 22 3c 68 6a |jr[F5hbQwkpH"<hj|
00000020 0d 37 7b 60 7d 74 3b 67 5a 37 4c 3a 1d 31 43 07 |.7{`}t;gZ7L:.1C.|
00000030 24 1f 4d 59 07 2f 2a 7e 1b 1b 47 3d 57 2f 27 64 |$.MY./*~..G=W/'d|
00000040 67 95 d3 |g..|Peer-to-peer
2 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 2 | 1 | 2 to 10 |
| SSDP | 1900/udp | 1 | 1 | 30.8 |
| Memcached | 11211/udp | 1 | 1 | 10,000 to 51,000 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 199.195.250.193 | AS53667 FranTech Solutions | US | SIP | 27 | 2026-10-09 10:22 |
| 209.141.51.29 | AS53667 FranTech Solutions | US | Unrecognised | 15 | 2026-10-12 04:01 |
| 199.195.252.209 | AS53667 FranTech Solutions | US | SIP | 13 | 2026-10-12 06:50 |
| 198.98.58.74 | AS53667 FranTech Solutions | US | SIP | 6 | 2026-10-09 20:19 |
| 107.189.1.154 | AS53667 FranTech Solutions | LU | Unrecognised | 3 | 2026-10-11 18:14 |
| 198.98.57.120 | AS53667 FranTech Solutions | US | SIP | 3 | 2026-10-06 10:49 |
Latest datagrams
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 48 2e 4f 10 53 45 79 5a 6a 66 7c 65 60 65 65 09 |H.O.SEyZjf|e`ee.| 00000010 6a 72 5b 46 35 68 62 51 77 6b 70 48 22 3c 68 6a |jr[F5hbQwkpH"<hj| 00000020 0d 37 7b 60 7d 74 3b 67 5a 37 4c 3a 1d 31 43 07 |.7{`}t;gZ7L:.1C.| 00000030 24 1f 4d 59 07 2f 2a 7e 1b 1b 47 3d 57 2f 27 64 |$.MY./*~..G=W/'d| 00000040 67 95 d3 |g..|payload bytes
00000000 0e 2e 10 0e 18 66 49 1f 0f 77 32 56 57 46 11 32 |.....fI..w2VWF.2| 00000010 58 4f 4c 34 70 23 4c 20 34 42 51 6f 27 69 71 35 |XOL4p#L 4BQo'iq5| 00000020 21 01 43 1a bb |!.C..|
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 18 2e 0a 74 5f 3a 48 5f 71 7c 4d 21 6a 08 36 02 |...t_:H_q|M!j.6.| 00000010 19 0f 00 0e 6f 58 23 60 07 24 12 38 35 0f 67 4d |....oX#`.$.85.gM| 00000020 7b 71 42 5a a2 4c |{qBZ.L|payload bytes
00000000 1a 2e 03 1b 65 22 2e 20 14 1d 42 4c 57 40 55 1c |....e". ..BLW@U.| 00000010 2b 37 1f 17 6d 38 14 1d 24 2c 3d 68 44 34 55 5e |+7..m8..$,=hD4U^| 00000020 08 59 7a f8 e8 |.Yz..|
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 78 2e 1b 38 23 22 58 04 |x..8#"X.|
payload bytes
00000000 6a 2e 56 6e 00 2e 37 06 56 36 75 65 69 27 3b 2a |j.Vn..7.V6uei';*| 00000010 6a 2c 68 78 14 dc 50 |j,hx..P|
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 1b 2e 51 49 62 5a 72 11 5c 62 35 77 23 18 53 4c |..QIbZr.\b5w#.SL| 00000010 12 03 5b 3c 5c 59 45 4c 33 2d 6d 35 23 2f 99 6f |..[<\YEL3-m5#/.o|
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.