UDP traffic
Datagrams matching country:AU sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
34
Datagrams
6
Source addresses
5
Networks
1
Countries
4
Destination ports
Traffic by type
Other services
30 datagrams from 3 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
2 datagrams from 2 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 8080/udp
payload bytes
00000000 33 2e 50 18 34 51 22 1b 67 30 2c 77 3d 67 7a 03 |3.P.4Q".g0,w=gz.| 00000010 6e 02 0b 48 25 05 1f 14 54 0a 15 51 68 70 65 1b |n..H%...T..Qhpe.| 00000020 23 36 34 57 07 56 72 6e 06 1e 65 43 05 60 46 73 |#64W.Vrn..eC.`Fs| 00000030 62 52 3c 07 57 5b 1b 2b 39 90 |bR<.W[.+9.|
Peer-to-peer
2 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 1 | 1 | 2 to 10 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS14956 RouterHosting LLC from 2 sources18
- AS16276 OVH SAS from 1 source12
- AS1221 Telstra Limited from 1 source2
- AS60024 Hk Cedoc Limited from 1 source1
- AS14061 DigitalOcean, LLC from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 51.161.136.177 | AS16276 OVH SAS | AU | SIP | 12 | 2026-10-11 05:17 |
| 144.172.64.68 | AS14956 RouterHosting LLC | AU | SIP | 10 | 2026-10-11 08:02 |
| 144.172.64.83 | AS14956 RouterHosting LLC | AU | SIP | 8 | 2026-10-11 07:22 |
| 101.173.46.92 | AS1221 Telstra Limited | AU | BitTorrent | 2 | 2026-10-10 13:26 |
| 82.115.30.245 | AS60024 Hk Cedoc Limited | AU | Unrecognised | 1 | 2026-10-10 09:20 |
| 209.38.93.248 | AS14061 DigitalOcean, LLC | AU | Unrecognised | 1 | 2026-10-10 14:14 |
Latest datagrams
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.