UDP traffic

Datagrams matching country:DE sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

671

Datagrams

Source addresses

Networks

Countries

228

Destination ports

Traffic by type

Service queries

141 datagrams from 23 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 73 CoAP 26 NetBIOS 19 NTP 8 TFTP 6 SNMP 6 SSDP 2 CLDAP 1

Latest DNS datagram, to 53/udp

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

Other services

113 datagrams from 19 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

Redis 82 SIP 25 STUN 2 XDMCP 1 GTP-U 1 RADIUS 1 RTP 1

Latest Redis datagram, to 8082/udp

$.I·X$·K·%·3}q·{QG·}=t$T·z`t~·/G·k·S·

payload bytes

00000000  24 2e 49 02 58 24 07 4b  06 25 17 0e 33 7d 71 02  |$.I.X$.K.%..3}q.|
00000010  7b 51 47 11 19 7d 3d 74  24 54 19 7a 60 74 7e 04  |{QG..}=t$T.z`t~.|
00000020  2f 47 07 08 6b 0e 53 1c  0c                       |/G..k.S..|

QUIC

8 datagrams from 2 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 8

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=h3,h3-29

Unrecognised

406 datagrams from 55 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 406

Latest Unrecognised datagram, to 1027/udp

{.+·KUvN·p3·/A`vh/v·?DPFY·Y& !g41m·cN!S·1·B·x*@n.·2~E·2((T·]·|]·`+,3,]6nn.·.·F.ODs[_·;b·g$·

payload bytes

00000000  7b 2e 2b 0f 05 4b 55 76  4e 1b 70 33 0f 2f 41 60  |{.+..KUvN.p3./A`|
00000010  76 68 2f 76 03 3f 44 50  46 59 1d 59 26 0d 09 21  |vh/v.?DPFY.Y&..!|
00000020  67 34 31 6d 00 06 63 4e  21 53 01 31 02 42 11 78  |g41m..cN!S.1.B.x|
00000030  2a 40 6e 2e 7f 32 7e 45  0c 1b 1f 32 28 28 54 0f  |*@n..2~E...2((T.|
00000040  5d 05 7c 5d 0b 60 2b 2c  33 2c 5d 36 6e 6e 2e 18  |].|].`+,3,]6nn..|
00000050  2e 1d 46 2e 4f 44 73 5b  5f 12 0e 07 3b 62 17 18  |..F.ODs[_...;b..|
00000060  67 24 82                                          |g$.|

Peer-to-peer

3 datagrams from 3 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 3

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +1	69	10	28 to 54
mDNS	5353/udp	8	6	2 to 10
SNMPv2	161/udp	9	4	6.3
NTP	123/udp	8	4	556.9
NetBIOS	137/udp	19	3	3.8
SSDP	1900/udp	4	3	30.8
WS-Discovery	3702/udp	27	2	10 to 500
CLDAP	389/udp	26	2	56 to 70
TFTP	69/udp +1	6	2	60

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS68
3702/udp WS-Discovery27
389/udp CLDAP26
5683/udp CoAP26
5060/udp SIP25
12333/udp23
55493/udp20
5684/udp20
137/udp NetBIOS19
500/udp IKE11
161/udp SNMP9
443/udp QUIC8

DNS questions

DNS record types

ANY36
A30
PTR4
TXT2

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_df5b9e597968 from 1 source4

QUIC transport parameters

94dccb934778 from 1 source4

QUIC versions

0x1a1a1a1a4
14

Networks

AS14061 DigitalOcean, LLC from 15 sources211
AS51396 Pfcloud UG (haftungsbeschrankt) from 3 sources96
AS24961 WIIT AG from 5 sources81
AS29484 Ruhr-Universitaet Bochum from 1 source60
AS45102 Alibaba (US) Technology Co., Ltd. from 24 sources46
AS3320 Deutsche Telekom AG from 7 sources37
AS63949 Akamai Connected Cloud from 9 sources35
AS680 Verein zur Foerderung eines Deutschen Fo from 2 sources27
AS8560 IONOS SE from 5 sources24
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 1 source13

Countries

DE Germany671

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	135	2026-10-10 20:31
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	Unrecognised	75	2026-10-11 02:15
185.73.23.133	AS29484 Ruhr-Universitaet Bochum	DE	CoAP	60	2026-10-10 09:32
141.82.3.32	AS680 Verein zur Foerderung eines Deutschen Fo	DE	Unrecognised	23	2026-10-10 22:33
201.79.2.46	AS14061 DigitalOcean, LLC	DE	Unrecognised	21	2026-10-05 16:48
87.159.30.86	AS3320 Deutsche Telekom AG	DE	Unrecognised	20	2026-10-09 21:33
64.226.83.235	AS14061 DigitalOcean, LLC	DE	Unrecognised	18	2026-10-10 22:04
89.163.146.51	AS24961 WIIT AG	DE	Redis	17	2026-10-05 17:40
193.111.198.241	AS24961 WIIT AG	DE	Redis	16	2026-10-05 16:27
89.163.212.86	AS24961 WIIT AG	DE	Redis	16	2026-10-05 16:28
193.111.198.244	AS24961 WIIT AG	DE	Redis	16	2026-10-05 16:28
89.163.239.201	AS24961 WIIT AG	DE	Redis	16	2026-10-05 16:27
104.248.129.131	AS14061 DigitalOcean, LLC	DE	Unrecognised	14	2026-10-05 16:14
165.154.164.21	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	DE	NetBIOS	13	2026-10-08 08:08
176.65.134.60	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	CoAP	12	2026-10-09 17:01
201.79.14.100	AS14061 DigitalOcean, LLC	DE	Unrecognised	11	2026-10-08 15:41
31.70.64.154	AS8560 IONOS SE	DE	SIP	10	2026-10-11 03:03
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	9	2026-10-11 00:15
172.104.152.125	AS63949 Akamai Connected Cloud	DE	Unrecognised	8	2026-10-10 10:52
179.254.163.155	AS213877 U1 Digital Services Ltd	DE	Unrecognised	7	2026-10-10 22:02

Latest datagrams

2026-10-11 03:03:2531.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5069;branch=z9hG4bK-3517743053;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=633
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:57:1431.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5064;branch=z9hG4bK-2506594099;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=303
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:43:58207.241.172.146to 1027/udpUnrecognisedDE

{.+·KUvN·p3·/A`vh/v·?DPFY·Y& !g41m·cN!S·1·B·x*@n.·2~E·2((T·]·|]·`+,3,]6nn.·.·F.ODs[_·;b·g$·

payload bytes

00000000  7b 2e 2b 0f 05 4b 55 76  4e 1b 70 33 0f 2f 41 60  |{.+..KUvN.p3./A`|
00000010  76 68 2f 76 03 3f 44 50  46 59 1d 59 26 0d 09 21  |vh/v.?DPFY.Y&..!|
00000020  67 34 31 6d 00 06 63 4e  21 53 01 31 02 42 11 78  |g41m..cN!S.1.B.x|
00000030  2a 40 6e 2e 7f 32 7e 45  0c 1b 1f 32 28 28 54 0f  |*@n..2~E...2((T.|
00000040  5d 05 7c 5d 0b 60 2b 2c  33 2c 5d 36 6e 6e 2e 18  |].|].`+,3,]6nn..|
00000050  2e 1d 46 2e 4f 44 73 5b  5f 12 0e 07 3b 62 17 18  |..F.ODs[_...;b..|
00000060  67 24 82                                          |g$.|

2026-10-11 02:32:24207.241.172.146to 8082/udpRedisDE

$.I·X$·K·%·3}q·{QG·}=t$T·z`t~·/G·k·S·

payload bytes

00000000  24 2e 49 02 58 24 07 4b  06 25 17 0e 33 7d 71 02  |$.I.X$.K.%..3}q.|
00000010  7b 51 47 11 19 7d 3d 74  24 54 19 7a 60 74 7e 04  |{QG..}=t$T.z`t~.|
00000020  2f 47 07 08 6b 0e 53 1c  0c                       |/G..k.S..|

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:57:058.211.42.24to 28784/udpUnrecognisedDE

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-11 01:45:518.211.44.115to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-11 00:36:1245.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 00:15:2145.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 23:42:4645.82.78.100to 6379/udpSIPDE

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 OPTIONS Max-Forwards: 70 Content-Length: 0 Contact: <sip:nm@nm> Acce

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 54 43 50  20 6e 6d 3b 62 72 61 6e  |/2.0/TCP nm;bran|
00000030  63 68 3d 66 6f 6f 0d 0a  46 72 6f 6d 3a 20 3c 73  |ch=foo..From: <s|
00000040  69 70 3a 6e 6d 40 6e 6d  3e 3b 74 61 67 3d 72 6f  |ip:nm@nm>;tag=ro|
00000050  6f 74 0d 0a 54 6f 3a 20  3c 73 69 70 3a 6e 6d 32  |ot..To: <sip:nm2|
00000060  40 6e 6d 32 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |@nm2>..Call-ID: |
00000070  35 30 30 30 30 0d 0a 43  53 65 71 3a 20 34 32 20  |50000..CSeq: 42 |
00000080  4f 50 54 49 4f 4e 53 0d  0a 4d 61 78 2d 46 6f 72  |OPTIONS..Max-For|
00000090  77 61 72 64 73 3a 20 37  30 0d 0a 43 6f 6e 74 65  |wards: 70..Conte|
000000a0  6e 74 2d 4c 65 6e 67 74  68 3a 20 30 0d 0a 43 6f  |nt-Length: 0..Co|
000000b0  6e 74 61 63 74 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |ntact: <sip:nm@n|
000000c0  6d 3e 0d 0a 41 63 63 65  70 74 3a 20 61 70 70 6c  |m>..Accept: appl|
000000d0  69 63 61 74 69 6f 6e 2f  73 64 70 0d 0a 0d 0a     |ication/sdp....|

2026-10-10 23:16:5645.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-10 22:33:41141.82.3.32to 12333/udpUnrecognisedDE

tha_net_loop_scan!

payload bytes

00000000  74 68 61 5f 6e 65 74 5f  6c 6f 6f 70 5f 73 63 61  |tha_net_loop_sca|
00000010  6e 21                                             |n!|

2026-10-10 22:31:0845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 22:14:5845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 22:04:5664.226.83.235to 8081/udpUnrecognisedDE

e.zHn·h·P#o·KZS/Ows=>qA·h·_x ·

payload bytes

00000000  65 2e 7a 48 6e 13 01 68  17 50 23 6f 17 4b 5a 53  |e.zHn..h.P#o.KZS|
00000010  2f 4f 77 73 3d 3e 71 41  03 68 1e 5f 78 20 0c c1  |/Ows=>qA.h._x ..|