UDP traffic

Datagrams matching country:CA sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

3 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 1 SNMP 1 SOAP 1

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Other services

26 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 24 SOCKS5 2

Latest SIP datagram, to 50007/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-4287440660;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353701363937373232363334 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Co

Payload bytes withheld: they contain the sensor's address.

Unrecognised

13 datagrams from 7 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 13

Latest Unrecognised datagram, to 5060/udp

·.j2·wY·^·]7U iB·Fx?5·G;e·s3·Dv*Ra\aX6z6=Xn·eWTz·M9Rk· P·.EyY·Z5y2kti(LW:1·6

payload bytes

00000000  1b 2e 6a 32 0f 77 59 19  5e 07 5d 37 55 0d 69 42  |..j2.wY.^.]7U.iB|
00000010  14 46 78 3f 35 1e 47 3b  65 1f 73 33 0f 44 76 2a  |.Fx?5.G;e.s3.Dv*|
00000020  52 61 5c 61 58 36 7a 36  3d 58 6e 12 65 57 54 7a  |Ra\aX6z6=Xn.eWTz|
00000030  1d 4d 39 52 6b 00 0d 50  1f 01 03 2e 45 79 59 18  |.M9Rk..P....EyY.|
00000040  5a 35 79 32 6b 74 69 28  4c 57 3a 31 1a 36        |Z5y2kti(LW:1.6|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	1	1	2 to 10
NTP	123/udp	1	1	556.9
SNMPv2	161/udp	1	1	6.3
SSDP	1900/udp	1	1	30.8
Memcached	11211/udp	1	1	10,000 to 51,000
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS16276 OVH SAS from 2 sources25
AS11814 Distributel Communications Limited from 1 source5
AS12989 Black HOST Ltd from 3 sources3
AS14061 DigitalOcean, LLC from 1 source3
AS812 Rogers Communications Canada Inc. from 2 sources2
AS852 TELUS Communications Inc. from 2 sources2
AS209334 Modat B.V. from 1 source1
AS63949 Akamai Connected Cloud from 1 source1

Countries

CA Canada42

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.161.57.3	AS16276 OVH SAS	CA	SIP	24	2026-10-10 14:23
174.138.216.234	AS11814 Distributel Communications Limited	CA	Unrecognised	5	2026-10-11 04:41
2604:a880:cad:d0:0:1:ba2b:9001	AS14061 DigitalOcean, LLC	CA	Unrecognised	3	2026-10-10 22:18
85.217.149.24	AS209334 Modat B.V.	CA	Unrecognised	1	2026-10-10 05:31
86.54.31.34	AS12989 Black HOST Ltd	CA	SNMP	1	2026-10-10 16:20
172.105.101.33	AS63949 Akamai Connected Cloud	CA	Unrecognised	1	2026-10-10 07:29
51.161.33.215	AS16276 OVH SAS	CA	Unrecognised	1	2026-10-10 11:37
86.54.31.38	AS12989 Black HOST Ltd	CA	SOAP	1	2026-10-10 23:38
86.54.31.32	AS12989 Black HOST Ltd	CA	NTP	1	2026-10-10 05:50
66.222.149.159	AS852 TELUS Communications Inc.	CA	Unrecognised	1	2026-10-10 21:23
207.81.204.231	AS852 TELUS Communications Inc.	CA	SOCKS5	1	2026-10-10 15:33
99.233.136.193	AS812 Rogers Communications Canada Inc.	CA	SOCKS5	1	2026-10-10 13:05
99.250.196.13	AS812 Rogers Communications Canada Inc.	CA	Unrecognised	1	2026-10-10 13:29

Latest datagrams

2026-10-11 04:41:34174.138.216.234to 5060/udpUnrecognisedCA

·.j2·wY·^·]7U iB·Fx?5·G;e·s3·Dv*Ra\aX6z6=Xn·eWTz·M9Rk· P·.EyY·Z5y2kti(LW:1·6

payload bytes

00000000  1b 2e 6a 32 0f 77 59 19  5e 07 5d 37 55 0d 69 42  |..j2.wY.^.]7U.iB|
00000010  14 46 78 3f 35 1e 47 3b  65 1f 73 33 0f 44 76 2a  |.Fx?5.G;e.s3.Dv*|
00000020  52 61 5c 61 58 36 7a 36  3d 58 6e 12 65 57 54 7a  |Ra\aX6z6=Xn.eWTz|
00000030  1d 4d 39 52 6b 00 0d 50  1f 01 03 2e 45 79 59 18  |.M9Rk..P....EyY.|
00000040  5a 35 79 32 6b 74 69 28  4c 57 3a 31 1a 36        |Z5y2kti(LW:1.6|

2026-10-11 03:53:22174.138.216.234to 5353/udpUnrecognisedCA

·.#> ·^·Wyq96N9@'$s ·m·p<|z·o· ·J·.K*·j·[:<)t|Q·o[2\w"·

payload bytes

00000000  12 2e 23 3e 0a 1b 00 12  5e 1f 57 79 71 39 36 4e  |..#>....^.Wyq96N|
00000010  39 40 27 24 73 0a 19 6d  1c 70 3c 7c 7a 13 6f 0c  |9@'$s..m.p<|z.o.|
00000020  0d 12 4a 17 2e 4b 2a 0c  6a 01 05 5b 3a 3c 29 74  |..J..K*.j..[:<)t|
00000030  7c 51 18 6f 5b 32 5c 77  22 00 01                 ||Q.o[2\w"..|

2026-10-10 23:38:4786.54.31.38to 3702/udpSOAPCA

<?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"><s:Header><a:Action s:mustUnderstand="1">

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 55 54  |.0" encoding="UT|
00000020  46 2d 38 22 3f 3e 3c 73  3a 45 6e 76 65 6c 6f 70  |F-8"?><s:Envelop|
00000030  65 20 78 6d 6c 6e 73 3a  73 3d 22 68 74 74 70 3a  |e xmlns:s="http:|
00000040  2f 2f 77 77 77 2e 77 33  2e 6f 72 67 2f 32 30 30  |//www.w3.org/200|
00000050  33 2f 30 35 2f 73 6f 61  70 2d 65 6e 76 65 6c 6f  |3/05/soap-envelo|
00000060  70 65 22 20 78 6d 6c 6e  73 3a 61 3d 22 68 74 74  |pe" xmlns:a="htt|
00000070  70 3a 2f 2f 73 63 68 65  6d 61 73 2e 78 6d 6c 73  |p://schemas.xmls|
00000080  6f 61 70 2e 6f 72 67 2f  77 73 2f 32 30 30 34 2f  |oap.org/ws/2004/|
00000090  30 38 2f 61 64 64 72 65  73 73 69 6e 67 22 3e 3c  |08/addressing"><|
000000a0  73 3a 48 65 61 64 65 72  3e 3c 61 3a 41 63 74 69  |s:Header><a:Acti|
000000b0  6f 6e 20 73 3a 6d 75 73  74 55 6e 64 65 72 73 74  |on s:mustUnderst|
000000c0  61 6e 64 3d 22 31 22 3e  68 74 74 70 3a 2f 2f 73  |and="1">http://s|
000000d0  63 68 65 6d 61 73 2e 78  6d 6c 73 6f 61 70 2e 6f  |chemas.xmlsoap.o|
000000e0  72 67 2f 77 73 2f 32 30  30 35 2f 30 34 2f 64 69  |rg/ws/2005/04/di|
000000f0  73 63 6f 76 65 72 79 2f  50 72 6f 62 65 3c 2f 61  |scovery/Probe</a|
... 512 bytes shown in part

2026-10-10 22:18:232604:a880:cad:d0:0:1:ba2b:9001to 8888/udpUnrecognisedCA
AMSNIFF
payload bytes
```
00000000  41 4d 53 4e 49 46 46                              |AMSNIFF|
```
2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 80/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 443/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 21:23:3266.222.149.159to 45258/udpUnrecognisedCA

·Es·ͨ·4Vx·7·

payload bytes

00000000  01 b7 99 e6 45 73 99 cd  a8 00 ff ff 00 fe fe fe  |....Es..........|
00000010  fe fd fd fd fd 12 34 56  78 a2 88 ab b9 95 b8 37  |......4Vx......7|
00000020  e1                                                |.|

2026-10-10 19:44:23174.138.216.234to 11211/udpUnrecognisedCA

^.·'4pH<·t7·ur%_J· 4;=$8:·V·q<l·J·D:\·XP7\i,N·,MZiq·#qi2b%·ro27)·7·_o]I·,X'EwS·Q·1

payload bytes

00000000  5e 2e 0e 27 34 70 48 3c  1e 74 37 04 19 75 72 25  |^..'4pH<.t7..ur%|
00000010  5f 4a 10 20 34 3b 3d 24  38 3a 00 56 0e 71 3c 6c  |_J. 4;=$8:.V.q<l|
00000020  10 4a 14 44 3a 5c 00 58  50 37 5c 69 2c 4e 0f 0c  |.J.D:\.XP7\i,N..|
00000030  19 1f 2c 4d 5a 69 71 12  23 71 69 32 62 25 1e 72  |..,MZiq.#qi2b%.r|
00000040  6f 32 37 29 0f 37 01 5f  6f 5d 49 1b 2c 58 27 45  |o27).7._o]I.,X'E|
00000050  77 53 12 51 ec 31                                 |wS.Q.1|

2026-10-10 18:16:48174.138.216.234to 1900/udpUnrecognisedCA
^.GMCG·x·W
payload bytes
```
00000000  5e 2e 47 4d 43 47 05 18  78 80 57                 |^.GMCG..x.W|
```

2026-10-10 16:20:0886.54.31.34to 161/udpSNMPCA

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-10 15:33:12207.81.204.231to 46399/udpSOCKS5CA

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 09 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 14:23:2851.161.57.3to 50007/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-4287440660;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353701363937373232
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 50000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1512239646;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333353001333535373233
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 51000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-1126879505;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336337333801323538313338
Payload bytes withheld: they contain the sensor's address.
2026-10-10 14:23:2851.161.57.3to 52000/udpSIPCA
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 51.161.57.3:7715;branch=z9hG4bK-3940295715;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336362323001323739363430
Payload bytes withheld: they contain the sensor's address.