UDP traffic
Datagrams matching asn:8560 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
38
Datagrams
6
Source addresses
1
Networks
2
Countries
15
Destination ports
Traffic by type
Other services
28 datagrams from 4 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5080/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
9 datagrams from 2 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 4000/udp
payload bytes
00000000 78 2e 7e 21 50 21 45 3c 40 51 7b 18 19 73 6d 46 |x.~!P!E<@Q{..smF|
00000010 40 7c 28 21 79 30 60 34 1e 3f 52 54 4c 16 2a 44 |@|(!y0`4.?RTL.*D|
00000020 35 28 65 05 4a 2a 41 f0 1b |5(e.J*A..|Peer-to-peer
1 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 1 | 1 | 2 to 10 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 209.46.124.116 | AS8560 IONOS SE | US | SIP | 13 | 2026-10-11 03:38 |
| 31.70.64.154 | AS8560 IONOS SE | DE | SIP | 10 | 2026-10-11 03:03 |
| 217.160.190.176 | AS8560 IONOS SE | DE | Unrecognised | 7 | 2026-10-11 03:55 |
| 31.70.105.186 | AS8560 IONOS SE | DE | SIP | 4 | 2026-10-09 04:44 |
| 87.106.134.4 | AS8560 IONOS SE | DE | Unrecognised | 3 | 2026-10-07 13:51 |
| 31.70.77.230 | AS8560 IONOS SE | DE | SIP | 1 | 2026-10-06 11:28 |
Latest datagrams
payload bytes
00000000 78 2e 7e 21 50 21 45 3c 40 51 7b 18 19 73 6d 46 |x.~!P!E<@Q{..smF| 00000010 40 7c 28 21 79 30 60 34 1e 3f 52 54 4c 16 2a 44 |@|(!y0`4.?RTL.*D| 00000020 35 28 65 05 4a 2a 41 f0 1b |5(e.J*A..|Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 39 2e 5c 68 3f 68 54 3b 10 19 5b 57 5c 44 21 74 |9.\h?hT;..[W\D!t| 00000010 54 6b 28 2b 05 5d 7d 60 7c 27 5e 37 74 2b 78 2e |Tk(+.]}`|'^7t+x.| 00000020 07 55 16 46 3d 6a 01 4e 03 5c 25 5f 20 47 53 74 |.U.F=j.N.\%_ GSt| 00000030 32 7c 20 38 9c f2 |2| 8..|