UDP traffic

Datagrams matching country:GB sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

572

Datagrams

289

Source addresses

Networks

Countries

163

Destination ports

Traffic by type

Service queries

91 datagrams from 64 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 19 DNS 17 SNMP 15 NTP 10 SSDP 10 SOAP 10 NetBIOS 5 CoAP 2 TFTP 2 mDNS 1

Latest Sun RPC datagram, to 2049/udp

C·qn·

payload bytes

00000000  43 ec 71 6e 00 00 00 00  00 00 00 02 00 01 86 a0  |C.qn............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Other services

160 datagrams from 56 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 84 DTLS 33 GOOGLE 23 SOCKS5 13 XDMCP 2 RADIUS 2 RTP 2 Redis 1

Latest SIP datagram, to 5060/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5218;branch=z9hG4bK-1330281108;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340131373036333435393434 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Con

Payload bytes withheld: they contain the sensor's address.

QUIC

99 datagrams from 86 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 99

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

221 datagrams from 137 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 221

Latest Unrecognised datagram, to 1027/udp

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	17	17	28 to 54
SNMPv2	161/udp	15	15	6.3
NTP	123/udp	10	8	556.9
SSDP	1900/udp +3	10	8	30.8
Portmap	111/udp	9	7	7 to 28
NetBIOS	2137/udp +3	5	5	3.8
WS-Discovery	3702/udp	8	3	10 to 500
mDNS	5353/udp	2	2	2 to 10
TFTP	19876/udp +1	2	2	60
RIPv1	520/udp	4	1	131.24
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

443/udp QUIC85
5060/udp SIP78
8443/udp QUIC47
10001/udp Ubiquiti discovery17
161/udp SNMP15
4500/udp IPsec NAT-T14
500/udp IKE13
53/udp DNS10
123/udp NTP10
1701/udp L2TP9
2049/udp Sun RPC9
111/udp Sun RPC9

DNS questions

DNS record types

A8
TXT5
PTR4

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 31 sources32
q13i0307h9_55b375c5d22e_2f871f65fa7d from 16 sources16
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 16 sources16
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 15 sources15
q13i0308h3_55b375c5d22e_bc854dc9d3af from 15 sources15
q13i0311dq_55b375c5d22e_c183556c78e2 from 1 source3
q13i0311h3_55b375c5d22e_c183556c78e2 from 1 source2

QUIC transport parameters

60647680e335 from 44 sources47
1f7a23748abd from 31 sources32
4c2cac1ef1cb from 15 sources15
cde977acba33 from 1 source3
12d07494ae7c from 1 source2

QUIC versions

Networks

AS211298 Driftnet Ltd from 174 sources313
AS396982 Google LLC from 73 sources78
AS16276 OVH SAS from 1 source70
AS9009 M247 Europe SRL from 1 source23
AS63949 Akamai Connected Cloud from 5 sources19
AS14061 DigitalOcean, LLC from 4 sources17
AS5089 Virgin Media from 9 sources15
AS45102 Alibaba (US) Technology Co., Ltd. from 3 sources11
AS5607 Sky UK Limited from 5 sources7
AS2856 British Telecommunications Limited from 5 sources5

Countries

GB United Kingdom572

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
198.244.200.163	AS16276 OVH SAS	GB	SIP	70	2026-10-11 03:05
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	23	2026-10-10 22:30
167.71.143.137	AS14061 DigitalOcean, LLC	GB	Unrecognised	8	2026-10-07 14:06
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	QUIC	7	2026-10-10 02:37
165.227.238.235	AS14061 DigitalOcean, LLC	GB	Unrecognised	7	2026-10-11 02:59
86.25.66.22	AS5089 Virgin Media	GB	SOCKS5	6	2026-10-08 00:28
193.163.125.139	AS211298 Driftnet Ltd	GB	Unrecognised	6	2026-10-10 22:23
193.163.125.170	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-10 22:56
193.163.125.173	AS211298 Driftnet Ltd	GB	Sun RPC	5	2026-10-11 02:48
193.163.125.241	AS211298 Driftnet Ltd	GB	SOAP	5	2026-10-08 22:52
193.163.125.116	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-09 03:09
193.163.125.178	AS211298 Driftnet Ltd	GB	DTLS	5	2026-10-10 17:59
193.163.125.130	AS211298 Driftnet Ltd	GB	DTLS	4	2026-10-10 23:43
178.79.137.171	AS63949 Akamai Connected Cloud	GB	Unrecognised	4	2026-10-07 13:25
212.71.250.62	AS63949 Akamai Connected Cloud	GB	Unrecognised	4	2026-10-07 01:38
193.163.125.231	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-11 02:36
193.163.125.137	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-10 14:10
193.163.125.175	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-08 09:32
178.79.148.203	AS63949 Akamai Connected Cloud	GB	Unrecognised	4	2026-10-09 14:21
193.163.125.150	AS211298 Driftnet Ltd	GB	TFTP	4	2026-10-09 10:35

Latest datagrams

2026-10-11 03:22:10193.163.125.151to 12346/udpDTLSGB

·y·y·Jv/·i·$_z·!{·k;V·iK·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 4a 76 2f 16 69  |y.......y..Jv/.i|
00000020  b3 e6 fa f5 ba c1 89 24  5f 7a 06 14 21 7b a2 8c  |.......$_z..!{..|
00000030  6b 3b 56 c7 ec c0 d2 18  69 4b 08 00 00 00 18 c0  |k;V.....iK......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 03:05:52198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5218;branch=z9hG4bK-1330281108;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401313730363334353
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:59:07165.227.238.235to 1027/udpUnrecognisedGB

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|

2026-10-11 02:53:1435.203.210.27to 47806/udpUnrecognisedGB

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-11 02:48:29193.163.125.173to 88/udpUnrecognisedGB

j·e0·b· ·U0S·P·NM·0·0·krbtgt·NM·20261011024929Z·X$·0·0·

payload bytes

00000000  6a 81 65 30 81 62 a1 03  02 01 05 a2 03 02 01 0a  |j.e0.b..........|
00000010  a4 81 55 30 53 a0 07 03  05 00 50 00 00 00 a2 04  |..U0S.....P.....|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..NM..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 32 30 32 36 31 30 31  31 30 32 34 39 32 39 5a  |.20261011024929Z|
00000050  a7 06 02 04 58 24 d1 30  a8 0e 30 0c 02 01 12 02  |....X$.0..0.....|
00000060  01 11 02 01 17 02 01 03                           |........|

2026-10-11 02:45:21198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5484;branch=z9hG4bK-2730128076;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401313834313432303
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:40:02193.163.125.165to 427/udpUnrecognisedGB

·/·en·service:service-agent·

payload bytes

00000000  02 01 00 00 2f 00 00 00  00 00 00 01 00 02 65 6e  |..../.........en|
00000010  00 00 00 15 73 65 72 76  69 63 65 3a 73 65 72 76  |....service:serv|
00000020  69 63 65 2d 61 67 65 6e  74 00 00 00 00 00 00     |ice-agent......|

2026-10-11 02:36:48193.163.125.231to 1967/udpUnrecognisedGB
·
payload bytes
```
00000000  01                                                |.|
```

2026-10-11 02:28:44193.163.125.142to 35253/udpUnrecognisedGB

DB2GETADDR·SQL09010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 39  |DB2GETADDR.SQL09|
00000010  30 31 30 00                                       |010.|

2026-10-11 01:40:0435.203.211.47to 51/udpDNSGB

DNS query TXT/CH VERQION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  51 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |QION.BIND.....|

2026-10-11 01:12:42193.163.125.151to 1701/udpUnrecognisedGB

·d· · ·#·l2tpscan·driftnet· ·z· ·

payload bytes

00000000  c8 02 00 64 00 00 00 00  00 00 00 00 80 08 00 00  |...d............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 03  |................|
00000030  80 08 00 00 00 06 01 23  80 0e 00 00 00 07 6c 32  |.......#......l2|
00000040  74 70 73 63 61 6e 80 0e  00 00 00 08 64 72 69 66  |tpscan......drif|
00000050  74 6e 65 74 80 08 00 00  00 09 b3 7a 80 08 00 00  |tnet.......z....|
00000060  00 0a 00 01                                       |....|

2026-10-11 00:20:2286.133.94.88to 1129/udpSOCKS5GB

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 23:43:21193.163.125.130to 53/udpDNSGB

DNS query A example.com

payload bytes

00000000  96 3b 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.;. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

2026-10-10 23:02:12193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  02 08 00 00                                       |....|
```
2026-10-10 23:02:09193.163.125.251to 30770/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```