UDP traffic

Datagrams matching country:AU sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

332

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 2

Latest DNS datagram, to 53/udp

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

Other services

81 datagrams from 5 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 78 SOCKS5 2 OOKLA 1

Latest SIP datagram, to 5060/udp

INVITE sip:900061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:27632;branch=z9hG4bK-524287-1---c8183379f8e165bc;rport Max-Forwards: 70 From: <sip:19260344082@<HONEYPOT>>;tag=d1ca23be To: <sip:900061420163737@<HONEYPOT>:5060> Call-ID: T2kLwt0Di3nkT4AsRCgYvo.. CS

Payload bytes withheld: they contain the sensor's address.

Unrecognised

17 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 17

Latest Unrecognised datagram, to 8080/udp

3.P·4Q"·g0,w=gz·n·H%·T ·Qhpe·#64W·Vrn·eC·`FsbR<·W[·+9·

payload bytes

00000000  33 2e 50 18 34 51 22 1b  67 30 2c 77 3d 67 7a 03  |3.P.4Q".g0,w=gz.|
00000010  6e 02 0b 48 25 05 1f 14  54 0a 15 51 68 70 65 1b  |n..H%...T..Qhpe.|
00000020  23 36 34 57 07 56 72 6e  06 1e 65 43 05 60 46 73  |#64W.Vrn..eC.`Fs|
00000030  62 52 3c 07 57 5b 1b 2b  39 90                    |bR<.W[.+9.|

Peer-to-peer

232 datagrams from 5 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 232

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	2	1	28 to 54
mDNS	5353/udp	1	1	2 to 10
SSDP	1900/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent231
5060/udp SIP79
8080/udp SOCKS54
1027/udp3
53/udp DNS2
80/udp2
1434/udp MSSQL Browser2
8000/udp2
1900/udp SSDP1
5353/udp mDNS1
6881/udp BitTorrent1
8083/udp1

DNS questions

www.stage TXT2

DNS record types

TXT2

Networks

AS1221 Telstra Limited from 3 sources160
AS38195 Superloop from 2 sources72
AS16276 OVH SAS from 1 source57
AS14956 RouterHosting LLC from 2 sources21
AS14061 DigitalOcean, LLC from 1 source8
AS60024 Hk Cedoc Limited from 1 source6
AS4804 Microplex PTY LTD from 2 sources5
AS396982 Google LLC from 1 source2
AS14593 Space Exploration Technologies Corporati from 1 source1

Countries

AU Australia332

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
101.185.179.82	AS1221 Telstra Limited	AU	BitTorrent	156	2026-10-10 07:10
203.123.113.224	AS38195 Superloop	AU	BitTorrent	70	2026-10-06 22:53
51.161.136.177	AS16276 OVH SAS	AU	SIP	57	2026-10-11 05:17
144.172.64.68	AS14956 RouterHosting LLC	AU	SIP	13	2026-10-11 08:02
144.172.64.83	AS14956 RouterHosting LLC	AU	SIP	8	2026-10-11 07:22
209.38.93.248	AS14061 DigitalOcean, LLC	AU	Unrecognised	8	2026-10-10 14:14
82.115.30.245	AS60024 Hk Cedoc Limited	AU	Unrecognised	6	2026-10-10 09:20
49.178.186.54	AS4804 Microplex PTY LTD	AU	BitTorrent	3	2026-10-10 02:45
125.63.8.221	AS38195 Superloop	AU	Unrecognised	2	2026-10-07 23:34
101.173.46.92	AS1221 Telstra Limited	AU	BitTorrent	2	2026-10-10 13:26
1.42.113.191	AS4804 Microplex PTY LTD	AU	SOCKS5	2	2026-10-06 19:33
144.130.164.158	AS1221 Telstra Limited	AU	Unrecognised	2	2026-10-09 17:03
34.151.128.127	AS396982 Google LLC	AU	DNS	2	2026-10-06 07:59
150.228.243.233	AS14593 Space Exploration Technologies Corporati	AU	Unrecognised	1	2026-10-10 06:05

Latest datagrams

2026-10-11 08:02:57144.172.64.68to 5060/udpSIPAU
INVITE sip:900061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:27632;branch=z9hG4bK-524287-1---c8183379f8e165bc;rport Max-Forwards: 70 From: <sip:19260344082@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:22:06144.172.64.83to 5060/udpSIPAU
INVITE sip:81061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.83:34398;branch=z9hG4bK-524287-1---75ec9ffa99953bf6;rport Max-Forwards: 70 From: <sip:14679084643@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:38:27144.172.64.68to 5060/udpSIPAU
INVITE sip:00161420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:24628;branch=z9hG4bK-524287-1---5b61d8900faae2d6;rport Max-Forwards: 70 From: <sip:19260344082@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:17:1951.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5068;branch=z9hG4bK-1212839104;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401323938383
Payload bytes withheld: they contain the sensor's address.
2026-10-11 05:00:06144.172.64.83to 5060/udpSIPAU
INVITE sip:00061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.83:33852;branch=z9hG4bK-524287-1---19dd5c7970e56444;rport Max-Forwards: 70 From: <sip:14679084643@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:14:13144.172.64.68to 5060/udpSIPAU
INVITE sip:01261420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:29813;branch=z9hG4bK-524287-1---da105e9a14c99cb5;rport Max-Forwards: 70 From: <sip:19260344082@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:09:1851.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5075;branch=z9hG4bK-4094195512;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313736343
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:37:49144.172.64.83to 5060/udpSIPAU
INVITE sip:90061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.83:30312;branch=z9hG4bK-524287-1---0ed4cea9fe840181;rport Max-Forwards: 70 From: <sip:14679084643@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 00:50:54144.172.64.68to 5060/udpSIPAU
INVITE sip:01061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:33011;branch=z9hG4bK-524287-1---e30bdafe1f0e2b06;rport Max-Forwards: 70 From: <sip:19260344082@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 00:16:12144.172.64.83to 5060/udpSIPAU
INVITE sip:61420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.83:24982;branch=z9hG4bK-524287-1---964ff1cebef8b677;rport Max-Forwards: 70 From: <sip:14679084643@<HONEYPOT>
Payload bytes withheld: they contain the sensor's address.
2026-10-10 23:10:3451.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5075;branch=z9hG4bK-3704031564;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401323337333
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:28:35144.172.64.68to 5060/udpSIPAU
INVITE sip:001161420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.68:33770;branch=z9hG4bK-524287-1---00d3d8bf973bf283;rport Max-Forwards: 70 From: <sip:19260344082@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-10 22:07:4051.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5077;branch=z9hG4bK-4054731326;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401323832363
Payload bytes withheld: they contain the sensor's address.
2026-10-10 21:54:31144.172.64.83to 5060/udpSIPAU
INVITE sip:0061420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 144.172.64.83:23910;branch=z9hG4bK-524287-1---5aee1e575d5f7013;rport Max-Forwards: 70 From: <sip:14679084643@<HONEYPO
Payload bytes withheld: they contain the sensor's address.
2026-10-10 20:26:2251.161.136.177to 5060/udpSIPAU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.136.177:5066;branch=z9hG4bK-1082480849;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401323034393
Payload bytes withheld: they contain the sensor's address.