UDP traffic
Datagrams matching country:DK sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
2
Datagrams
2
Source addresses
2
Networks
1
Countries
2
Destination ports
Traffic by type
Other services
1 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
1 datagrams from 1 sourceDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 11211/udp
payload bytes
00000000 79 2e 4c 16 62 5d 36 3e 28 78 48 09 41 6c 55 1c |y.L.b]6>(xH.AlU.|
00000010 5f 43 5e 7c 37 6e 60 36 05 3c 33 57 2e 37 3e 27 |_C^|7n`6.<3W.7>'|
00000020 74 0b 3d 56 68 74 15 11 6c 5d 1a 2e 49 6f 4a 28 |t.=Vht..l]..IoJ(|
00000030 33 28 24 6a 16 05 20 1b 41 53 72 6f 0a 31 16 7e |3($j.. .ASro.1.~|
00000040 3c 53 55 24 9b 7b |<SU$.{|Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| Memcached | 11211/udp | 1 | 1 | 10,000 to 51,000 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS8075 Microsoft Corporation from 1 source1
- AS42708 Glesys AB from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 85.203.47.86 | AS42708 Glesys AB | DK | SIP | 1 | 2026-10-10 15:17 |
| 9.205.105.97 | AS8075 Microsoft Corporation | DK | Unrecognised | 1 | 2026-10-10 00:27 |
Latest datagrams
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 79 2e 4c 16 62 5d 36 3e 28 78 48 09 41 6c 55 1c |y.L.b]6>(xH.AlU.| 00000010 5f 43 5e 7c 37 6e 60 36 05 3c 33 57 2e 37 3e 27 |_C^|7n`6.<3W.7>'| 00000020 74 0b 3d 56 68 74 15 11 6c 5d 1a 2e 49 6f 4a 28 |t.=Vht..l]..IoJ(| 00000030 33 28 24 6a 16 05 20 1b 41 53 72 6f 0a 31 16 7e |3($j.. .ASro.1.~| 00000040 3c 53 55 24 9b 7b |<SU$.{|