UDP traffic

Datagrams matching country:DE sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

133

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

19 datagrams from 5 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 15 CoAP 4

Latest DNS datagram, to 53/udp

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

Other services

4 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 3 Redis 1

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5069;branch=z9hG4bK-3517743053;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=6330303337363932313363340133353736303835363235 User-Agent: friendly-scanner Call-ID: 9103947926586866

Payload bytes withheld: they contain the sensor's address.

Unrecognised

110 datagrams from 22 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 110

Latest Unrecognised datagram, to 5060/udp

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	15	5	28 to 54
CLDAP	389/udp	4	1	56 to 70
WS-Discovery	3702/udp	4	1	10 to 500
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS15
5684/udp4
389/udp CLDAP4
12333/udp4
3702/udp WS-Discovery4
5683/udp CoAP4
8082/udp3
5060/udp SIP3
8080/udp3
5351/udp NAT-PMP3
64738/udp2
1434/udp MSSQL Browser2

DNS questions

DNS record types

ANY9
A6

Networks

AS14061 DigitalOcean, LLC from 4 sources75
AS51396 Pfcloud UG (haftungsbeschrankt) from 2 sources17
AS29484 Ruhr-Universitaet Bochum from 1 source12
AS45102 Alibaba (US) Technology Co., Ltd. from 8 sources8
AS63949 Akamai Connected Cloud from 3 sources5
AS680 Verein zur Foerderung eines Deutschen Fo from 1 source4
AS8560 IONOS SE from 2 sources3
AS206216 Advin Services LLC from 1 source3
AS3320 Deutsche Telekom AG from 2 sources2
AS213877 U1 Digital Services Ltd from 1 source2

Countries

DE Germany133

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	67	2026-10-10 20:31
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	Unrecognised	14	2026-10-11 03:59
185.73.23.133	AS29484 Ruhr-Universitaet Bochum	DE	DNS	12	2026-10-10 09:32
64.226.83.235	AS14061 DigitalOcean, LLC	DE	Unrecognised	6	2026-10-10 22:04
141.82.3.32	AS680 Verein zur Foerderung eines Deutschen Fo	DE	Unrecognised	4	2026-10-10 22:33
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	3	2026-10-11 00:15
207.241.172.146	AS206216 Advin Services LLC	DE	Unrecognised	3	2026-10-11 02:43
139.162.186.195	AS63949 Akamai Connected Cloud	DE	Unrecognised	3	2026-10-10 21:54
179.254.163.155	AS213877 U1 Digital Services Ltd	DE	Unrecognised	2	2026-10-10 22:02
31.70.64.154	AS8560 IONOS SE	DE	SIP	2	2026-10-11 03:03
217.160.190.176	AS8560 IONOS SE	DE	Unrecognised	1	2026-10-11 03:55
45.82.78.100	AS212512 Detai Prosperous Technologies Limited	DE	SIP	1	2026-10-10 23:42
172.104.152.125	AS63949 Akamai Connected Cloud	DE	Unrecognised	1	2026-10-10 10:52
8.211.42.24	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 01:57
164.92.182.157	AS14061 DigitalOcean, LLC	DE	DNS	1	2026-10-10 06:42
87.150.15.111	AS3320 Deutsche Telekom AG	DE	Unrecognised	1	2026-10-10 06:08
47.245.141.134	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-10 13:00
8.211.44.115	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 01:45
8.209.83.9	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	1	2026-10-11 03:55
91.34.37.59	AS3320 Deutsche Telekom AG	DE	Unrecognised	1	2026-10-11 04:21

Latest datagrams

2026-10-11 04:21:0291.34.37.59to 5060/udpUnrecognisedDE

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

2026-10-11 03:59:1145.135.193.115to 3702/udpUnrecognisedDE
<:>
payload bytes
```
00000000  3c 3a 3e                                          |<:>|
```

2026-10-11 03:55:27217.160.190.176to 4000/udpUnrecognisedDE

x.~!P!E<@Q{·smF@|(!y0`4·?RTL·*D5(e·J*A·

payload bytes

00000000  78 2e 7e 21 50 21 45 3c  40 51 7b 18 19 73 6d 46  |x.~!P!E<@Q{..smF|
00000010  40 7c 28 21 79 30 60 34  1e 3f 52 54 4c 16 2a 44  |@|(!y0`4.?RTL.*D|
00000020  35 28 65 05 4a 2a 41 f0  1b                       |5(e.J*A..|

2026-10-11 03:55:178.209.83.9to 5095/udpUnrecognisedDE

· ·N

payload bytes

00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |

2026-10-11 03:28:0147.254.167.143to 623/udpUnrecognisedDE

payload bytes

00000000  06 00 ff 06 00 00 11 be  80 00 00 00              |............|

2026-10-11 03:03:2531.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5069;branch=z9hG4bK-3517743053;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=633
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:57:1431.70.64.154to 5060/udpSIPDE
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 31.70.64.154:5064;branch=z9hG4bK-2506594099;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=303
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:43:58207.241.172.146to 1027/udpUnrecognisedDE

{.+·KUvN·p3·/A`vh/v·?DPFY·Y& !g41m·cN!S·1·B·x*@n.·2~E·2((T·]·|]·`+,3,]6nn.·.·F.ODs[_·;b·g$·

payload bytes

00000000  7b 2e 2b 0f 05 4b 55 76  4e 1b 70 33 0f 2f 41 60  |{.+..KUvN.p3./A`|
00000010  76 68 2f 76 03 3f 44 50  46 59 1d 59 26 0d 09 21  |vh/v.?DPFY.Y&..!|
00000020  67 34 31 6d 00 06 63 4e  21 53 01 31 02 42 11 78  |g41m..cN!S.1.B.x|
00000030  2a 40 6e 2e 7f 32 7e 45  0c 1b 1f 32 28 28 54 0f  |*@n..2~E...2((T.|
00000040  5d 05 7c 5d 0b 60 2b 2c  33 2c 5d 36 6e 6e 2e 18  |].|].`+,3,]6nn..|
00000050  2e 1d 46 2e 4f 44 73 5b  5f 12 0e 07 3b 62 17 18  |..F.ODs[_...;b..|
00000060  67 24 82                                          |g$.|

2026-10-11 02:32:24207.241.172.146to 8082/udpRedisDE

$.I·X$·K·%·3}q·{QG·}=t$T·z`t~·/G·k·S·

payload bytes

00000000  24 2e 49 02 58 24 07 4b  06 25 17 0e 33 7d 71 02  |$.I.X$.K.%..3}q.|
00000010  7b 51 47 11 19 7d 3d 74  24 54 19 7a 60 74 7e 04  |{QG..}=t$T.z`t~.|
00000020  2f 47 07 08 6b 0e 53 1c  0c                       |/G..k.S..|

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:57:058.211.42.24to 28784/udpUnrecognisedDE

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-11 01:45:518.211.44.115to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-11 00:36:1245.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 00:15:2145.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 23:42:4645.82.78.100to 6379/udpSIPDE

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/TCP nm;branch=foo From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 OPTIONS Max-Forwards: 70 Content-Length: 0 Contact: <sip:nm@nm> Acce

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 54 43 50  20 6e 6d 3b 62 72 61 6e  |/2.0/TCP nm;bran|
00000030  63 68 3d 66 6f 6f 0d 0a  46 72 6f 6d 3a 20 3c 73  |ch=foo..From: <s|
00000040  69 70 3a 6e 6d 40 6e 6d  3e 3b 74 61 67 3d 72 6f  |ip:nm@nm>;tag=ro|
00000050  6f 74 0d 0a 54 6f 3a 20  3c 73 69 70 3a 6e 6d 32  |ot..To: <sip:nm2|
00000060  40 6e 6d 32 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |@nm2>..Call-ID: |
00000070  35 30 30 30 30 0d 0a 43  53 65 71 3a 20 34 32 20  |50000..CSeq: 42 |
00000080  4f 50 54 49 4f 4e 53 0d  0a 4d 61 78 2d 46 6f 72  |OPTIONS..Max-For|
00000090  77 61 72 64 73 3a 20 37  30 0d 0a 43 6f 6e 74 65  |wards: 70..Conte|
000000a0  6e 74 2d 4c 65 6e 67 74  68 3a 20 30 0d 0a 43 6f  |nt-Length: 0..Co|
000000b0  6e 74 61 63 74 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |ntact: <sip:nm@n|
000000c0  6d 3e 0d 0a 41 63 63 65  70 74 3a 20 61 70 70 6c  |m>..Accept: appl|
000000d0  69 63 61 74 69 6f 6e 2f  73 64 70 0d 0a 0d 0a     |ication/sdp....|