UDP traffic

Datagrams matching country:GB sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

589

Datagrams

293

Source addresses

Networks

Countries

168

Destination ports

Traffic by type

Service queries

94 datagrams from 64 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 19 DNS 17 SNMP 17 NTP 11 SSDP 10 SOAP 10 NetBIOS 5 CoAP 2 TFTP 2 mDNS 1

Latest Sun RPC datagram, to 2049/udp

C·qn·

payload bytes

00000000  43 ec 71 6e 00 00 00 00  00 00 00 02 00 01 86 a0  |C.qn............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Other services

167 datagrams from 57 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 90 DTLS 34 GOOGLE 23 SOCKS5 13 XDMCP 2 RADIUS 2 RTP 2 Redis 1

Latest SIP datagram, to 5060/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5276;branch=z9hG4bK-3426049020;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340133353435393434313337 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1> Con

Payload bytes withheld: they contain the sensor's address.

QUIC

99 datagrams from 86 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 99

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

228 datagrams from 140 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 228

Latest Unrecognised datagram, to 37700/udp

8f·6CK·y·

payload bytes

00000000  38 66 01 36 43 4b 81 af  79 00 00 00 00 00        |8f.6CK..y.....|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	17	17	28 to 54
SNMPv2	161/udp	17	16	6.3
NTP	123/udp	11	8	556.9
SSDP	1900/udp +3	10	8	30.8
Portmap	111/udp	9	7	7 to 28
NetBIOS	2137/udp +3	5	5	3.8
WS-Discovery	3702/udp	8	3	10 to 500
mDNS	5353/udp	2	2	2 to 10
TFTP	19876/udp +1	2	2	60
RIPv1	520/udp	4	1	131.24
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

443/udp QUIC86
5060/udp SIP83
8443/udp QUIC47
10001/udp Ubiquiti discovery17
161/udp SNMP17
4500/udp IPsec NAT-T14
500/udp IKE14
123/udp NTP11
53/udp DNS10
1701/udp L2TP9
2049/udp Sun RPC9
111/udp Sun RPC9

DNS questions

DNS record types

A8
TXT5
PTR4

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 31 sources32
q13i0307h9_55b375c5d22e_2f871f65fa7d from 16 sources16
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 16 sources16
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 15 sources15
q13i0308h3_55b375c5d22e_bc854dc9d3af from 15 sources15
q13i0311dq_55b375c5d22e_c183556c78e2 from 1 source3
q13i0311h3_55b375c5d22e_c183556c78e2 from 1 source2

QUIC transport parameters

60647680e335 from 44 sources47
1f7a23748abd from 31 sources32
4c2cac1ef1cb from 15 sources15
cde977acba33 from 1 source3
12d07494ae7c from 1 source2

QUIC versions

Networks

AS211298 Driftnet Ltd from 174 sources319
AS396982 Google LLC from 77 sources82
AS16276 OVH SAS from 1 source75
AS9009 M247 Europe SRL from 1 source23
AS63949 Akamai Connected Cloud from 5 sources19
AS14061 DigitalOcean, LLC from 4 sources17
AS5089 Virgin Media from 9 sources15
AS45102 Alibaba (US) Technology Co., Ltd. from 3 sources12
AS5607 Sky UK Limited from 5 sources7
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 4 sources6

Countries

GB United Kingdom589

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
198.244.200.163	AS16276 OVH SAS	GB	SIP	75	2026-10-11 08:38
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	23	2026-10-10 22:30
167.71.143.137	AS14061 DigitalOcean, LLC	GB	Unrecognised	8	2026-10-07 14:06
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	QUIC	8	2026-10-11 04:54
165.227.238.235	AS14061 DigitalOcean, LLC	GB	Unrecognised	7	2026-10-11 02:59
86.25.66.22	AS5089 Virgin Media	GB	Unrecognised	6	2026-10-08 00:28
193.163.125.139	AS211298 Driftnet Ltd	GB	Unrecognised	6	2026-10-10 22:23
193.163.125.170	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-10 22:56
193.163.125.173	AS211298 Driftnet Ltd	GB	DNS	5	2026-10-11 02:48
193.163.125.241	AS211298 Driftnet Ltd	GB	SOAP	5	2026-10-08 22:52
193.163.125.151	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-11 05:37
193.163.125.167	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-11 06:50
193.163.125.116	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-09 03:09
193.163.125.166	AS211298 Driftnet Ltd	GB	SNMP	5	2026-10-11 08:43
193.163.125.178	AS211298 Driftnet Ltd	GB	Unrecognised	5	2026-10-10 17:59
193.163.125.130	AS211298 Driftnet Ltd	GB	SIP	4	2026-10-10 23:43
178.79.137.171	AS63949 Akamai Connected Cloud	GB	Unrecognised	4	2026-10-07 13:25
212.71.250.62	AS63949 Akamai Connected Cloud	GB	Unrecognised	4	2026-10-07 01:38
193.163.125.231	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-11 02:36
193.163.125.137	AS211298 Driftnet Ltd	GB	Unrecognised	4	2026-10-10 14:10

Latest datagrams

2026-10-11 08:43:18193.163.125.179to 161/udpSNMPGB

0>·0· g·0·0·N·0·

payload bytes

00000000  30 3e 02 01 03 30 11 02  04 09 67 89 95 02 03 00  |0>...0....g.....|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 14 04 00 04 00  |..........0.....|
00000030  a0 0e 02 04 4e bd b1 f1  02 01 00 02 01 00 30 00  |....N.........0.|

2026-10-11 08:43:15193.163.125.166to 161/udpSNMPGB

0)·public·*·8P·0·0·+·

payload bytes

00000000  30 29 02 01 01 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 2a eb 38 50 02 01 00  02 01 00 30 0e 30 0c 06  |.*.8P......0.0..|
00000020  08 2b 06 01 02 01 01 05  00 05 00                 |.+.........|

2026-10-11 08:38:18198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5276;branch=z9hG4bK-3426049020;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401333534353934343
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:59:26198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5286;branch=z9hG4bK-2620043038;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333133633401323337373537313
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:49:08198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5172;branch=z9hG4bK-1819373845;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401313332323832353
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:37:07193.163.125.148to 37700/udpUnrecognisedGB
8f·6CK·y·
payload bytes
```
00000000  38 66 01 36 43 4b 81 af  79 00 00 00 00 00        |8f.6CK..y.....|
```

2026-10-11 07:29:22193.163.125.253to 443/udpDTLSGB

·y·y·_·3·h+ ·3k*ܵ·)u·:Lb·{T·%ʃ·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 5f 07 f5 ef 33  |y.......y.._...3|
00000020  0e 68 2b 09 d4 33 6b 2a  dc b5 e8 d6 0f 29 75 86  |.h+..3k*.....)u.|
00000030  3a 4c 62 d8 d6 7b 54 8e  25 ca 83 00 00 00 18 c0  |:Lb..{T.%.......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 07:21:20198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5072;branch=z9hG4bK-515775037;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=303561666237383431336334013431303336373132
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:16:4235.203.211.118to 15060/udpSIPGB
OPTIONS sip:RECQqpJw@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 10.154.1.118:56880;branch=LHuBxs.8634091427;rport;alias From: sip:HzeMkmot@10.154.1.118:56880;tag=77392728 To: sip:zcJjVipd@<HONEYPOT> Call
Payload bytes withheld: they contain the sensor's address.
2026-10-11 07:00:12101.36.97.205to 8600/udpUnrecognisedGB
DH·
payload bytes
```
00000000  44 48 01 01                                       |DH..|
```
2026-10-11 06:56:1935.203.211.124to 5634/udpUnrecognisedGB
NQ
payload bytes
```
00000000  4e 51                                             |NQ|
```
2026-10-11 06:50:32193.163.125.167to 3283/udpUnrecognisedGB
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```
2026-10-11 06:44:0935.203.211.138to 4802/udpUnrecognisedGB
·
payload bytes
```
00000000  01 00 00 08 00 00 00 00                           |........|
```
2026-10-11 06:24:21198.244.200.163to 5060/udpSIPGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5533;branch=z9hG4bK-1422637903;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401313734333637363
Payload bytes withheld: they contain the sensor's address.

2026-10-11 05:37:27193.163.125.151to 500/udpUnrecognisedGB

J·#S·w·! "·D"·,· · ·

payload bytes

00000000  4a ed 23 53 c3 77 ec a6  00 00 00 00 00 00 00 00  |J.#S.w..........|
00000010  21 20 22 08 00 00 00 00  00 00 02 44 22 00 01 a8  |! "........D"...|
00000020  02 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 06 03 00 00 08  |................|
00000040  03 00 00 0d 00 00 00 08  04 00 00 14 02 00 00 f0  |................|
00000050  02 01 00 1c 03 00 00 08  01 00 00 02 03 00 00 08  |................|
00000060  01 00 00 03 03 00 00 08  01 00 00 04 03 00 00 08  |................|
00000070  01 00 00 06 03 00 00 08  01 00 00 07 03 00 00 08  |................|
00000080  01 00 00 08 03 00 00 08  01 00 00 0b 03 00 00 0c  |................|
00000090  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
000000a0  80 0e 01 00 03 00 00 08  01 00 00 0d 03 00 00 08  |................|
000000b0  02 00 00 01 03 00 00 08  02 00 00 02 03 00 00 08  |................|
000000c0  02 00 00 05 03 00 00 08  02 00 00 06 03 00 00 08  |................|
000000d0  02 00 00 07 03 00 00 08  03 00 00 00 03 00 00 08  |................|
000000e0  03 00 00 01 03 00 00 08  03 00 00 02 03 00 00 08  |................|
000000f0  03 00 00 0c 03 00 00 08  03 00 00 0d 03 00 00 08  |................|
... 512 bytes shown in part