UDP traffic

Datagrams matching country:HK sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

1.3K

Datagrams

Source addresses

Networks

Countries

146

Destination ports

Traffic by type

Service queries

14 datagrams from 5 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 6 NTP 4 SNMP 2 CLDAP 1 SSDP 1

Latest DNS datagram, to 53/udp

DNS query A <HONEYPOT>.round2026-10-05.odns.m.dnsmeasure.top

Payload bytes withheld: they contain the sensor's address.

Other services

1,144 datagrams from 16 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1,137 XDMCP 1 DTLS 1 TARGUSDATASPEED 1 MGCP 1 GTP-U 1 RADIUS 1 RTP 1

Latest SIP datagram, to 65477/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-193749612;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=3137356532356533666663350132343232343935393835 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Unrecognised

118 datagrams from 15 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 118

Latest Unrecognised datagram, to 65082/udp

·+·(·

payload bytes

00000000  7f 00 01 2b 99 86 28 01  00 00 06 00 00 00 00 ff  |...+..(.........|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	6	2	28 to 54
NTP	123/udp	4	1	556.9
SNMPv2	161/udp	2	1	6.3
Portmap	111/udp	1	1	7 to 28
CLDAP	389/udp	1	1	56 to 70
SSDP	1900/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP616
5059/udp SIP92
56063/udp37
65082/udp28
15060/udp SIP21
25060/udp SIP15
65060/udp SIP15
35060/udp SIP15
55060/udp SIP15
45060/udp SIP15
5070/udp SIP14
64673/udp14

DNS questions

DNS record types

TXT4
A2

Networks

AS23470 ReliableSite.Net LLC from 9 sources1,134
AS13335 Cloudflare, Inc. from 4 sources86
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 13 sources35
AS9465 AGOTOZ PTE. LTD. from 2 sources16
AS45102 Alibaba (US) Technology Co., Ltd. from 2 sources3
AS4760 HKT Limited from 1 source2
AS61414 Edgenap Ltd from 1 source1

Countries

HK Hong Kong1,277

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	771	2026-10-11 03:21
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	125	2026-10-11 03:48
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	67	2026-10-11 04:01
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	60	2026-10-08 21:49
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
104.28.166.52	AS13335 Cloudflare, Inc.	HK	Unrecognised	37	2026-10-10 01:33
104.28.163.53	AS13335 Cloudflare, Inc.	HK	Unrecognised	28	2026-10-11 01:15
104.28.163.52	AS13335 Cloudflare, Inc.	HK	Unrecognised	14	2026-10-10 09:27
150.107.38.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	12	2026-10-10 14:37
156.225.1.10	AS9465 AGOTOZ PTE. LTD.	HK	SIP	12	2026-10-07 15:45
150.107.36.236	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	11	2026-10-10 13:29
172.110.223.207	AS23470 ReliableSite.Net LLC	HK	SIP	9	2026-10-10 02:22
104.28.166.47	AS13335 Cloudflare, Inc.	HK	Unrecognised	7	2026-10-10 03:52
156.225.1.99	AS9465 AGOTOZ PTE. LTD.	HK	SNMP	4	2026-10-05 19:01
185.243.5.10	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-10 06:57
165.154.40.205	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	MGCP	2	2026-10-09 07:53
185.243.5.164	AS23470 ReliableSite.Net LLC	HK	SIP	2	2026-10-08 20:03
8.210.123.17	AS45102 Alibaba (US) Technology Co., Ltd.	HK	DNS	2	2026-10-08 08:40
218.250.115.177	AS4760 HKT Limited	HK	Unrecognised	2	2026-10-08 14:06

Latest datagrams

2026-10-11 04:01:32172.110.223.188to 65477/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-193749612;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666335013234323234
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:48:51172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5156;branch=z9hG4bK-601762153;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653331336334013430313239
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:37:15172.110.223.188to 65477/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5060;branch=z9hG4bK-2480972100;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738346666633501333635313
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 65060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:65060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624303 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624303;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 55060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:55060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624295 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624295;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5059/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5059 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624252 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624252;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 45060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:45060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624288 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624288;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 5060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:5060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624245 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624245;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 35060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:35060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624278 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624278;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 25060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:25060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624270 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624270;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:21:46172.110.223.179to 15060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:15060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2535624261 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-2535624261;rport Call-ID: c2
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:45:44172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5080;branch=z9hG4bK-337688147;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=633030333736393231336334013832363935
Payload bytes withheld: they contain the sensor's address.
2026-10-11 02:37:11172.110.223.200to 5060/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.200:5253;branch=z9hG4bK-3282375035;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401313433363
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:32:04172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5061;branch=z9hG4bK-290398993;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653366666334013430303035
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:15:45172.110.223.188to 65476/udpSIPHK
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 172.110.223.188:5072;branch=z9hG4bK-1733294988;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163396666633401323439343
Payload bytes withheld: they contain the sensor's address.