UDP traffic

Datagrams matching country:CA sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

364

Datagrams

Source addresses

Networks

Countries

111

Destination ports

Traffic by type

Service queries

60 datagrams from 11 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 40 CLDAP 6 CoAP 4 SSDP 4 NetBIOS 2 DNS 2 NTP 1 SOAP 1

Latest SNMP datagram, to 161/udp

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

Other services

72 datagrams from 15 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 57 SOCKS5 12 DTLS 2 Redis 1

Latest SIP datagram, to 50007/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-4287440660;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353701363937373232363334 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Co

Payload bytes withheld: they contain the sensor's address.

Unrecognised

98 datagrams from 39 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 98

Latest Unrecognised datagram, to 5353/udp

·.#> ·^·Wyq96N9@'$s ·m·p<|z·o· ·J·.K*·j·[:<)t|Q·o[2\w"·

payload bytes

00000000  12 2e 23 3e 0a 1b 00 12  5e 1f 57 79 71 39 36 4e  |..#>....^.Wyq96N|
00000010  39 40 27 24 73 0a 19 6d  1c 70 3c 7c 7a 13 6f 0c  |9@'$s..m.p<|z.o.|
00000020  0d 12 4a 17 2e 4b 2a 0c  6a 01 05 5b 3a 3c 29 74  |..J..K*.j..[:<)t|
00000030  7c 51 18 6f 5b 32 5c 77  22 00 01                 ||Q.o[2\w"..|

Peer-to-peer

134 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 134

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	41	6	6.3
mDNS	5353/udp	4	4	2 to 10
SSDP	1900/udp	8	3	30.8
CLDAP	389/udp	6	3	56 to 70
CharGEN	19/udp	5	2	358.8
QOTD	17/udp	4	1	140.3
NetBIOS	137/udp	2	1	3.8
Memcached	11211/udp	2	1	10,000 to 51,000
NTP	123/udp	1	1	556.9
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent134
161/udp SNMP41
1900/udp SSDP8
389/udp CLDAP6
19/udp CharGEN5
443/udp QUIC5
5683/udp CoAP4
4590/udp SIP4
7272/udp SIP4
17/udp QOTD4
27016/udp4
5376/udp SIP4

DNS questions

_services._dns-sd._udp.local PTR2

DNS record types

PTR2

Networks

AS11290 Cogeco Connexion inc from 1 source134
AS16276 OVH SAS from 3 sources64
AS852 TELUS Communications Inc. from 9 sources44
AS63949 Akamai Connected Cloud from 9 sources40
AS12989 Black HOST Ltd from 4 sources24
AS812 Rogers Communications Canada Inc. from 7 sources17
AS11814 Distributel Communications Limited from 3 sources10
AS14061 DigitalOcean, LLC from 2 sources9
AS5769 Videotron Ltee from 2 sources4
AS6327 Shaw Communications from 3 sources4

Countries

CA Canada364

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
24.230.235.211	AS11290 Cogeco Connexion inc	CA	BitTorrent	134	2026-10-09 02:30
51.161.57.3	AS16276 OVH SAS	CA	SIP	56	2026-10-10 14:23
208.181.90.27	AS852 TELUS Communications Inc.	CA	SNMP	32	2026-10-09 03:15
86.54.31.32	AS12989 Black HOST Ltd	CA	Unrecognised	9	2026-10-10 05:50
86.54.31.38	AS12989 Black HOST Ltd	CA	Unrecognised	9	2026-10-10 23:38
174.138.216.234	AS11814 Distributel Communications Limited	CA	Unrecognised	8	2026-10-11 03:53
172.105.101.33	AS63949 Akamai Connected Cloud	CA	Unrecognised	8	2026-10-10 07:29
167.114.107.175	AS16276 OVH SAS	CA	Unrecognised	7	2026-10-07 14:11
147.182.149.28	AS14061 DigitalOcean, LLC	CA	Unrecognised	6	2026-10-07 13:41
86.54.31.34	AS12989 Black HOST Ltd	CA	Unrecognised	5	2026-10-10 16:20
172.105.13.33	AS63949 Akamai Connected Cloud	CA	SSDP	4	2026-10-07 18:59
99.250.196.13	AS812 Rogers Communications Canada Inc.	CA	Unrecognised	4	2026-10-10 13:29
99.233.136.193	AS812 Rogers Communications Canada Inc.	CA	Unrecognised	4	2026-10-10 13:05
172.105.22.202	AS63949 Akamai Connected Cloud	CA	CLDAP	4	2026-10-08 17:56
172.105.16.212	AS63949 Akamai Connected Cloud	CA	CoAP	4	2026-10-08 15:15
170.187.181.200	AS63949 Akamai Connected Cloud	CA	SNMP	4	2026-10-06 01:00
139.177.198.244	AS63949 Akamai Connected Cloud	CA	Unrecognised	4	2026-10-06 22:08
172.105.15.108	AS63949 Akamai Connected Cloud	CA	Unrecognised	4	2026-10-09 13:22
172.105.106.177	AS63949 Akamai Connected Cloud	CA	Unrecognised	4	2026-10-06 20:59
170.187.181.208	AS63949 Akamai Connected Cloud	CA	Unrecognised	4	2026-10-08 02:15

Latest datagrams

2026-10-11 03:53:22174.138.216.234to 5353/udpUnrecognisedCA

·.#> ·^·Wyq96N9@'$s ·m·p<|z·o· ·J·.K*·j·[:<)t|Q·o[2\w"·

payload bytes

00000000  12 2e 23 3e 0a 1b 00 12  5e 1f 57 79 71 39 36 4e  |..#>....^.Wyq96N|
00000010  39 40 27 24 73 0a 19 6d  1c 70 3c 7c 7a 13 6f 0c  |9@'$s..m.p<|z.o.|
00000020  0d 12 4a 17 2e 4b 2a 0c  6a 01 05 5b 3a 3c 29 74  |..J..K*.j..[:<)t|
00000030  7c 51 18 6f 5b 32 5c 77  22 00 01                 ||Q.o[2\w"..|

2026-10-10 23:38:4786.54.31.38to 3702/udpSOAPCA

<?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"><s:Header><a:Action s:mustUnderstand="1">

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 55 54  |.0" encoding="UT|
00000020  46 2d 38 22 3f 3e 3c 73  3a 45 6e 76 65 6c 6f 70  |F-8"?><s:Envelop|
00000030  65 20 78 6d 6c 6e 73 3a  73 3d 22 68 74 74 70 3a  |e xmlns:s="http:|
00000040  2f 2f 77 77 77 2e 77 33  2e 6f 72 67 2f 32 30 30  |//www.w3.org/200|
00000050  33 2f 30 35 2f 73 6f 61  70 2d 65 6e 76 65 6c 6f  |3/05/soap-envelo|
00000060  70 65 22 20 78 6d 6c 6e  73 3a 61 3d 22 68 74 74  |pe" xmlns:a="htt|
00000070  70 3a 2f 2f 73 63 68 65  6d 61 73 2e 78 6d 6c 73  |p://schemas.xmls|
00000080  6f 61 70 2e 6f 72 67 2f  77 73 2f 32 30 30 34 2f  |oap.org/ws/2004/|
00000090  30 38 2f 61 64 64 72 65  73 73 69 6e 67 22 3e 3c  |08/addressing"><|
000000a0  73 3a 48 65 61 64 65 72  3e 3c 61 3a 41 63 74 69  |s:Header><a:Acti|
000000b0  6f 6e 20 73 3a 6d 75 73  74 55 6e 64 65 72 73 74  |on s:mustUnderst|
000000c0  61 6e 64 3d 22 31 22 3e  68 74 74 70 3a 2f 2f 73  |and="1">http://s|
000000d0  63 68 65 6d 61 73 2e 78  6d 6c 73 6f 61 70 2e 6f  |chemas.xmlsoap.o|
000000e0  72 67 2f 77 73 2f 32 30  30 35 2f 30 34 2f 64 69  |rg/ws/2005/04/di|
000000f0  73 63 6f 76 65 72 79 2f  50 72 6f 62 65 3c 2f 61  |scovery/Probe</a|
... 512 bytes shown in part

2026-10-10 22:18:232604:a880:cad:d0:0:1:ba2b:9001to 8888/udpUnrecognisedCA
AMSNIFF
payload bytes
```
00000000  41 4d 53 4e 49 46 46                              |AMSNIFF|
```
2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 80/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 443/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 21:23:3266.222.149.159to 45258/udpUnrecognisedCA

·Es·ͨ·4Vx·7·

payload bytes

00000000  01 b7 99 e6 45 73 99 cd  a8 00 ff ff 00 fe fe fe  |....Es..........|
00000010  fe fd fd fd fd 12 34 56  78 a2 88 ab b9 95 b8 37  |......4Vx......7|
00000020  e1                                                |.|

2026-10-10 19:44:23174.138.216.234to 11211/udpUnrecognisedCA

^.·'4pH<·t7·ur%_J· 4;=$8:·V·q<l·J·D:\·XP7\i,N·,MZiq·#qi2b%·ro27)·7·_o]I·,X'EwS·Q·1

payload bytes

00000000  5e 2e 0e 27 34 70 48 3c  1e 74 37 04 19 75 72 25  |^..'4pH<.t7..ur%|
00000010  5f 4a 10 20 34 3b 3d 24  38 3a 00 56 0e 71 3c 6c  |_J. 4;=$8:.V.q<l|
00000020  10 4a 14 44 3a 5c 00 58  50 37 5c 69 2c 4e 0f 0c  |.J.D:\.XP7\i,N..|
00000030  19 1f 2c 4d 5a 69 71 12  23 71 69 32 62 25 1e 72  |..,MZiq.#qi2b%.r|
00000040  6f 32 37 29 0f 37 01 5f  6f 5d 49 1b 2c 58 27 45  |o27).7._o]I.,X'E|
00000050  77 53 12 51 ec 31                                 |wS.Q.1|

2026-10-10 18:16:48174.138.216.234to 1900/udpUnrecognisedCA
^.GMCG·x·W
payload bytes
```
00000000  5e 2e 47 4d 43 47 05 18  78 80 57                 |^.GMCG..x.W|
```

2026-10-10 16:20:0886.54.31.34to 161/udpSNMPCA

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-10 15:33:12207.81.204.231to 46399/udpSOCKS5CA

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 09 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 14:23:2851.161.57.3to 50007/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-4287440660;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353701363937373232
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 50000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1512239646;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353001333535373233
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 51000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1126879505;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336337333801323538313338
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 52000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-3940295715;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336362323001323739363430
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 46000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-3892586813;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336233623001333334373735
Payload bytes withheld: they contain the sensor's address.