HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching country:HK sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

293

Datagrams

14

Source addresses

3

Networks

1

Countries

88

Destination ports

Traffic by type

Service queries

1 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

CoAP 1

Latest CoAP datagram, to 5683/udp

@·λ.well-known·core

payload bytes
00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

Other services

244 datagrams from 8 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 240 DTLS 1 TARGUSDATASPEED 1 RADIUS 1 RTP 1

Latest SIP datagram, to 5059/udp

INVITE sip:10000@<HONEYPOT>:5059 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t1794191089 Via: SIP/2.0/UDP 172.110.223.179:10015;branch=z9hG4bK-1794191089;rport Call-ID: c1794191089 CSeq: 1794191089 INVITE Contact: <sip:10000@172.110.223.179:10015> Max-Forwards: 70 Use

Payload bytes withheld: they contain the sensor's address.

Unrecognised

47 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 47

Latest Unrecognised datagram, to 32800/udp

r·|·

payload bytes
00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
172.110.223.179AS23470 ReliableSite.Net LLCHKSIP1542026-10-11 04:48
172.110.223.192AS23470 ReliableSite.Net LLCHKSIP442026-10-10 23:43
172.110.223.200AS23470 ReliableSite.Net LLCHKSIP352026-10-11 03:48
104.28.163.53AS13335 Cloudflare, Inc.HKUnrecognised282026-10-11 01:15
104.28.163.52AS13335 Cloudflare, Inc.HKUnrecognised142026-10-10 09:27
172.110.223.188AS23470 ReliableSite.Net LLCHKSIP72026-10-11 04:42
150.107.36.236AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKUnrecognised42026-10-11 05:08
165.154.41.232AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKBitTorrent12026-10-10 15:53
150.107.38.251AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKUnrecognised12026-10-10 14:37
165.154.43.179AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKCoAP12026-10-11 04:59
165.154.41.182AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKRTP12026-10-10 13:51
118.193.44.169AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKRADIUS12026-10-10 09:53
185.243.5.10AS23470 ReliableSite.Net LLCHKSIP12026-10-10 06:57
152.32.188.207AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITHKDTLS12026-10-10 13:55

Latest datagrams