UDP traffic

Datagrams matching country:GB sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

103

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

12 datagrams from 12 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 5 SNMP 3 NTP 2 Sun RPC 2

Latest DNS datagram, to 51/udp

DNS query TXT/CH VERQION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  51 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |QION.BIND.....|

Other services

29 datagrams from 12 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 17 DTLS 5 GOOGLE 4 SOCKS5 2 RADIUS 1

Latest SIP datagram, to 15060/udp

OPTIONS sip:RECQqpJw@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 10.154.1.118:56880;branch=LHuBxs.8634091427;rport;alias From: sip:HzeMkmot@10.154.1.118:56880;tag=77392728 To: sip:zcJjVipd@<HONEYPOT> Call-ID: 0564726047@10.154.1.118 CSeq: 1 OPTIONS Contact: sip:KkbNdaHX@10.154.1.118:56880 Content-Len

Payload bytes withheld: they contain the sensor's address.

QUIC

12 datagrams from 12 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 12

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

50 datagrams from 38 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 50

Latest Unrecognised datagram, to 8600/udp

DH·

payload bytes

00000000  44 48 01 01                                       |DH..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	5	5	28 to 54
SNMPv2	161/udp	3	3	6.3
NTP	123/udp	2	2	556.9
Portmap	111/udp	1	1	7 to 28
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP16
443/udp QUIC10
8443/udp QUIC6
10001/udp Ubiquiti discovery4
161/udp SNMP3
500/udp IKE3
1701/udp L2TP3
53/udp DNS2
30770/udp2
25632/udp2
24800/udp2
123/udp NTP2

DNS questions

DNS record types

PTR2
A2
TXT1

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 4 sources4
q13i0307h9_55b375c5d22e_2f871f65fa7d from 2 sources2
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 2 sources2
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 2 sources2
q13i0308h3_55b375c5d22e_bc854dc9d3af from 2 sources2

QUIC transport parameters

60647680e335 from 6 sources6
1f7a23748abd from 4 sources4
4c2cac1ef1cb from 2 sources2

QUIC versions

Networks

AS211298 Driftnet Ltd from 39 sources52
AS396982 Google LLC from 21 sources21
AS16276 OVH SAS from 1 source15
AS14061 DigitalOcean, LLC from 3 sources4
AS9009 M247 Europe SRL from 1 source4
AS5089 Virgin Media from 2 sources2
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 1 source2
AS212238 Datacamp Limited from 1 source1
AS2856 British Telecommunications Limited from 1 source1
AS45102 Alibaba (US) Technology Co., Ltd. from 1 source1

Countries

GB United Kingdom103

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
198.244.200.163	AS16276 OVH SAS	GB	SIP	15	2026-10-11 06:24
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	4	2026-10-10 22:30
193.163.125.151	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-11 05:37
193.163.125.170	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-10 22:56
193.163.125.137	AS211298 Driftnet Ltd	GB	Unrecognised	3	2026-10-10 14:10
101.36.97.205	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	GB	Unrecognised	2	2026-10-11 07:00
193.163.125.161	AS211298 Driftnet Ltd	GB	Sun RPC	2	2026-10-10 11:03
193.163.125.165	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-11 02:40
193.163.125.139	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 22:23
193.163.125.237	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 12:20
193.163.125.251	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 23:02
193.163.125.178	AS211298 Driftnet Ltd	GB	Unrecognised	2	2026-10-10 17:59
165.227.238.235	AS14061 DigitalOcean, LLC	GB	Unrecognised	2	2026-10-11 02:59
193.163.125.168	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-10 19:06
87.236.176.249	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:41
87.236.176.252	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:42
35.203.211.124	AS396982 Google LLC	GB	Unrecognised	1	2026-10-11 06:56
87.236.176.109	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:23
193.163.125.128	AS211298 Driftnet Ltd	GB	Unrecognised	1	2026-10-10 11:12
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	NTP	1	2026-10-11 04:54

Latest datagrams

2026-10-11 07:16:4235.203.211.118to 15060/udpSIPGB
OPTIONS sip:RECQqpJw@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 10.154.1.118:56880;branch=LHuBxs.8634091427;rport;alias From: sip:HzeMkmot@10.154.1.118:56880;tag=77392728 To: sip:zcJjVipd@<HONEYPOT> Call
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:00:12101.36.97.205to 8600/udpUnrecognisedGB
DH·
payload bytes
```
00000000  44 48 01 01                                       |DH..|
```
2026-10-11 06:56:1935.203.211.124to 5634/udpUnrecognisedGB
NQ
payload bytes
```
00000000  4e 51                                             |NQ|
```
2026-10-11 06:50:32193.163.125.167to 3283/udpUnrecognisedGB
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```
2026-10-11 06:44:0935.203.211.138to 4802/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 08 00 00 00 00                           |........|
```
2026-10-11 06:24:21198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5533;branch=z9hG4bK-1422637903;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401313734333637363
Payload bytes withheld: they contain the sensor's address.

2026-10-11 05:37:27193.163.125.151to 500/udpUnrecognisedGB

J·#S·w·! "·D"·,· · ·

payload bytes

00000000  4a ed 23 53 c3 77 ec a6  00 00 00 00 00 00 00 00  |J.#S.w..........|
00000010  21 20 22 08 00 00 00 00  00 00 02 44 22 00 01 a8  |! "........D"...|
00000020  02 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 06 03 00 00 08  |................|
00000040  03 00 00 0d 00 00 00 08  04 00 00 14 02 00 00 f0  |................|
00000050  02 01 00 1c 03 00 00 08  01 00 00 02 03 00 00 08  |................|
00000060  01 00 00 03 03 00 00 08  01 00 00 04 03 00 00 08  |................|
00000070  01 00 00 06 03 00 00 08  01 00 00 07 03 00 00 08  |................|
00000080  01 00 00 08 03 00 00 08  01 00 00 0b 03 00 00 0c  |................|
00000090  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
000000a0  80 0e 01 00 03 00 00 08  01 00 00 0d 03 00 00 08  |................|
000000b0  02 00 00 01 03 00 00 08  02 00 00 02 03 00 00 08  |................|
000000c0  02 00 00 05 03 00 00 08  02 00 00 06 03 00 00 08  |................|
000000d0  02 00 00 07 03 00 00 08  03 00 00 00 03 00 00 08  |................|
000000e0  03 00 00 01 03 00 00 08  03 00 00 02 03 00 00 08  |................|
000000f0  03 00 00 0c 03 00 00 08  03 00 00 0d 03 00 00 08  |................|
... 512 bytes shown in part

2026-10-11 04:54:188.208.10.94to 123/udpNTPGB

#· ·u·0I

payload bytes

00000000  23 00 00 20 00 00 00 00  00 00 00 00 00 00 00 00  |#.. ............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ee 75 94 fa 9c d6 30 49  |.........u....0I|

2026-10-11 04:49:3035.203.210.85to 31433/udpUnrecognisedGB
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 03:22:10193.163.125.151to 12346/udpDTLSGB

·y·y·Jv/·i·$_z·!{·k;V·iK·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 4a 76 2f 16 69  |y.......y..Jv/.i|
00000020  b3 e6 fa f5 ba c1 89 24  5f 7a 06 14 21 7b a2 8c  |.......$_z..!{..|
00000030  6b 3b 56 c7 ec c0 d2 18  69 4b 08 00 00 00 18 c0  |k;V.....iK......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 03:05:52198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5218;branch=z9hG4bK-1330281108;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401313730363334353
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:59:07165.227.238.235to 1027/udpUnrecognisedGB

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|

2026-10-11 02:53:1435.203.210.27to 47806/udpUnrecognisedGB

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-11 02:48:29193.163.125.173to 88/udpUnrecognisedGB

j·e0·b· ·U0S·P·NM·0·0·krbtgt·NM·20261011024929Z·X$·0·0·

payload bytes

00000000  6a 81 65 30 81 62 a1 03  02 01 05 a2 03 02 01 0a  |j.e0.b..........|
00000010  a4 81 55 30 53 a0 07 03  05 00 50 00 00 00 a2 04  |..U0S.....P.....|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..NM..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 32 30 32 36 31 30 31  31 30 32 34 39 32 39 5a  |.20261011024929Z|
00000050  a7 06 02 04 58 24 d1 30  a8 0e 30 0c 02 01 12 02  |....X$.0..0.....|
00000060  01 11 02 01 17 02 01 03                           |........|

2026-10-11 02:45:21198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5484;branch=z9hG4bK-2730128076;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401313834313432303
Payload bytes withheld: they contain the sensor's address.