UDP traffic

Datagrams matching country:HK sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.3K

Datagrams

Source addresses

Networks

Countries

150

Destination ports

Traffic by type

Service queries

17 datagrams from 6 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 6 DNS 6 SNMP 2 CLDAP 1 CoAP 1 SSDP 1

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Other services

1,187 datagrams from 16 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 1,180 XDMCP 1 DTLS 1 TARGUSDATASPEED 1 MGCP 1 GTP-U 1 RADIUS 1 RTP 1

Latest SIP datagram, to 5060/udp

INVITE sip:10000@<HONEYPOT>:5060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3002150672 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-3002150672;rport Call-ID: c3002150672 CSeq: 3002150672 INVITE Contact: <sip:10000@172.110.223.179:10008> Max-Forwards: 70 Use

Payload bytes withheld: they contain the sensor's address.

Unrecognised

133 datagrams from 16 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 133

Latest Unrecognised datagram, to 63831/udp

·nP$*·

payload bytes

00000000  7f 00 01 6e 50 24 2a 01  00 00 05 00 00 00 00 ff  |...nP$*.........|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	6	2	28 to 54
NTP	123/udp	6	1	556.9
SNMPv2	161/udp	2	1	6.3
Portmap	111/udp	1	1	7 to 28
CLDAP	389/udp	1	1	56 to 70
SSDP	1900/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP623
5059/udp SIP97
56063/udp37
65082/udp28
15060/udp SIP26
65060/udp SIP20
55060/udp SIP20
45060/udp SIP20
35060/udp SIP20
25060/udp SIP20
64673/udp14
5070/udp SIP14

DNS questions

DNS record types

TXT4
A2

Networks

AS23470 ReliableSite.Net LLC from 9 sources1,177
AS13335 Cloudflare, Inc. from 5 sources99
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 14 sources38
AS9465 AGOTOZ PTE. LTD. from 2 sources18
AS45102 Alibaba (US) Technology Co., Ltd. from 2 sources3
AS4760 HKT Limited from 1 source2
AS61414 Edgenap Ltd from 1 source1

Countries

HK Hong Kong1,338

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	SIP	811	2026-10-11 08:30
172.110.223.200	AS23470 ReliableSite.Net LLC	HK	SIP	127	2026-10-11 07:43
172.110.223.188	AS23470 ReliableSite.Net LLC	HK	SIP	68	2026-10-11 04:42
172.110.223.159	AS23470 ReliableSite.Net LLC	HK	SIP	60	2026-10-08 21:49
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	SIP	53	2026-10-05 22:22
172.110.223.192	AS23470 ReliableSite.Net LLC	HK	SIP	44	2026-10-10 23:43
104.28.166.52	AS13335 Cloudflare, Inc.	HK	Unrecognised	37	2026-10-10 01:33
104.28.163.53	AS13335 Cloudflare, Inc.	HK	Unrecognised	28	2026-10-11 01:15
104.28.163.52	AS13335 Cloudflare, Inc.	HK	Unrecognised	14	2026-10-10 09:27
156.225.1.10	AS9465 AGOTOZ PTE. LTD.	HK	SIP	14	2026-10-11 08:57
150.107.36.236	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	13	2026-10-11 07:03
104.28.163.55	AS13335 Cloudflare, Inc.	HK	Unrecognised	13	2026-10-11 08:46
150.107.38.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	12	2026-10-10 14:37
172.110.223.207	AS23470 ReliableSite.Net LLC	HK	SIP	9	2026-10-10 02:22
104.28.166.47	AS13335 Cloudflare, Inc.	HK	Unrecognised	7	2026-10-10 03:52
156.225.1.99	AS9465 AGOTOZ PTE. LTD.	HK	SNMP	4	2026-10-05 19:01
185.243.5.10	AS23470 ReliableSite.Net LLC	HK	SIP	3	2026-10-10 06:57
165.154.40.205	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	MGCP	2	2026-10-09 07:53
8.210.123.17	AS45102 Alibaba (US) Technology Co., Ltd.	HK	DNS	2	2026-10-08 08:40
218.250.115.177	AS4760 HKT Limited	HK	Unrecognised	2	2026-10-08 14:06

Latest datagrams

2026-10-11 08:57:58156.225.1.10to 123/udpNTPHK

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-11 08:46:53104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 05 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:52104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 04 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:51104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 02 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:51104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 03 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:50104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 00 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:50104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 01 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:40104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 06 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:36104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 05 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:35104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 04 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:34104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 02 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:34104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 03 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:33104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 00 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:46:33104.28.163.55to 63831/udpUnrecognisedHK
·nP$*·
payload bytes
```
00000000  7f 00 01 6e 50 24 2a 01  00 00 01 00 00 00 00 ff  |...nP$*.........|
```
2026-10-11 08:30:46172.110.223.179to 55060/udpSIPHK
INVITE sip:10000@<HONEYPOT>:55060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3002150692 Via: SIP/2.0/UDP 172.110.223.179:10008;branch=z9hG4bK-3002150692;rport Call-ID: c3
Payload bytes withheld: they contain the sensor's address.