UDP traffic

Datagrams matching country:NL sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

239

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

39 datagrams from 7 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 28 DNS 7 NTP 3 CoAP 1

Latest SNMP datagram, to 161/udp

0:·0·Ji·0·0·0·0·0·0·0·00·0·0·7·0·000

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 30 ff e3  |0:...0...Ji..0..|
00000010  04 01 04 02 01 03 04 10  30 0e 04 30 02 01 30 02  |........0..0..0.|
00000020  01 30 04 30 04 30 04 30  30 12 04 30 04 30 a0 0c  |.0.0.0.00..0.0..|
00000030  02 02 37 f0 02 01 30 02  01 30 30 30              |..7...0..000|

Other services

158 datagrams from 8 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 115 Redis 40 STUN 2 RTP 1

Latest SIP datagram, to 5070/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3b470ea1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=4ede08fc Call-ID: fc4d11f4ea6df60d CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5063> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

Unrecognised

38 datagrams from 11 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 38

Latest Unrecognised datagram, to 1743/udp

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

Peer-to-peer

4 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 4

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	29	3	6.3
DNS	53/udp	6	2	28 to 54
CharGEN	19/udp	6	2	358.8
SSDP	1900/udp	2	2	30.8
NTP	123/udp	3	1	556.9
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP49
161/udp SNMP29
5080/udp SIP14
19/udp CharGEN6
53/udp DNS6
1027/udp SIP5
5030/udp SIP4
5070/udp SIP4
39131/udp BitTorrent4
1020/udp SIP4
1021/udp SIP4
1022/udp SIP4

DNS questions

DNS record types

Networks

AS12876 Scaleway SAS from 6 sources149
AS14061 DigitalOcean, LLC from 2 sources26
AS219502 Storm Industries LLC from 1 source20
AS51396 Pfcloud UG (haftungsbeschrankt) from 5 sources13
AS49870 Alsycon B.V. from 1 source10
AS202412 Omegatech LTD from 1 source6
AS202425 IP Volume inc from 3 sources5
AS215125 Church of Cyberology from 1 source4
AS24875 NovoServe B.V. from 1 source3
AS57043 Hostkey B.v. from 1 source3

Countries

NL The Netherlands239

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
159.223.223.14	AS14061 DigitalOcean, LLC	NL	Unrecognised	21	2026-10-11 08:47
94.154.43.163	AS219502 Storm Industries LLC	NL	SNMP	20	2026-10-10 15:26
89.190.156.22	AS49870 Alsycon B.V.	NL	SIP	10	2026-10-10 20:43
130.12.180.42	AS202412 Omegatech LTD	NL	SNMP	6	2026-10-10 20:34
176.65.149.208	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	5	2026-10-11 03:28
146.190.30.184	AS14061 DigitalOcean, LLC	NL	Unrecognised	5	2026-10-11 01:00
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	5	2026-10-11 07:31
192.42.116.243	AS215125 Church of Cyberology	NL	BitTorrent	4	2026-10-10 19:04
176.65.149.188	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Redis	3	2026-10-11 06:39
141.11.209.245	AS57043 Hostkey B.v.	NL	Unrecognised	3	2026-10-11 08:46
89.105.218.83	AS24875 NovoServe B.V.	NL	Unrecognised	3	2026-10-11 08:03
80.82.77.139	AS202425 IP Volume inc	NL	Unrecognised	2	2026-10-10 18:31
93.174.95.106	AS202425 IP Volume inc	NL	Unrecognised	2	2026-10-10 23:15
176.65.148.78	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	2	2026-10-11 06:10
176.65.149.233	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	2	2026-10-11 03:04

Latest datagrams

2026-10-11 08:47:59159.223.223.14to 1743/udpUnrecognisedNL

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-11 08:47:58159.223.223.14to 1742/udpUnrecognisedNL

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-11 08:47:57159.223.223.14to 1741/udpUnrecognisedNL

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-11 08:47:56159.223.223.14to 1740/udpUnrecognisedNL

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-11 08:47:54159.223.223.14to 500/udpUnrecognisedNL

~X"o·w·! "·"·0·,·(· ·[·_/wR@Ù·B·͓=Oq· r·Tr· ·{,·r·w·3·֞q|a ·6·V·=·a·

payload bytes

00000000  7e 58 22 6f e4 9c 77 17  00 00 00 00 00 00 00 00  |~X"o..w.........|
00000010  21 20 22 08 00 00 00 00  00 00 01 88 22 00 00 30  |! "........."..0|
00000020  00 00 00 2c 01 01 00 04  03 00 00 0c 01 00 00 0c  |...,............|
00000030  80 0e 01 00 03 00 00 08  02 00 00 05 03 00 00 08  |................|
00000040  03 00 00 0c 00 00 00 08  04 00 00 0e 28 00 01 08  |............(...|
00000050  00 0e 00 00 0a bd d2 e8  be 5b e0 b0 18 5f 2f 77  |.........[..._/w|
00000060  52 40 c3 99 19 42 1d cd  93 3d 4f 71 e3 20 72 18  |R@...B...=Oq. r.|
00000070  92 88 54 72 ef 09 e2 7b  2c fa b6 72 fc 77 e5 8f  |..Tr...{,..r.w..|
00000080  33 93 d6 9e 71 7c 61 09  de 36 96 56 e1 f1 3d 08  |3...q|a..6.V..=.|
00000090  61 fb a0 2e ba a2 1e 44  00 ef aa 88 6d 20 21 ee  |a......D....m !.|
000000a0  15 bc 76 18 32 fb df e7  c4 4a f2 c4 33 af 3f 22  |..v.2....J..3.?"|
000000b0  03 0f a6 58 06 4d ed 5e  cb a6 4c 6c cf fa c2 be  |...X.M.^..Ll....|
000000c0  d9 bf c8 89 f3 da 79 0c  ea ca 61 56 6e 70 6b 34  |......y...aVnpk4|
000000d0  72 be 7b 7d bc 93 d7 d7  f5 1a 1d d3 14 b4 5b dc  |r.{}..........[.|
000000e0  15 5e 83 44 d3 5e 72 3b  cf 69 b8 21 22 d2 9d ea  |.^.D.^r;.i.!"...|
000000f0  2f f6 60 9e 7f bd bf d8  2e 43 72 e2 29 6f 3f 06  |/.`......Cr.)o?.|
... 392 bytes shown in part

2026-10-11 08:47:53159.223.223.14to 3478/udpSTUNNL

·!·Bӧ_·B·W·4

payload bytes

00000000  00 01 00 00 21 12 a4 42  d3 a7 5f 1c 8b 06 42 9e  |....!..B.._...B.|
00000010  57 10 ce 34                                       |W..4|

2026-10-11 08:47:52159.223.223.14to 9600/udpRTPNL

payload bytes

00000000  80 00 02 00 00 00 00 00  00 00 05 01 00           |.............|

2026-10-11 08:47:51159.223.223.14to 3478/udpSTUNNL

·!·B000000000000

payload bytes

00000000  00 01 00 00 21 12 a4 42  30 30 30 30 30 30 30 30  |....!..B00000000|
00000010  30 30 30 30                                       |0000|

2026-10-11 08:47:50159.223.223.14to 500/udpUnrecognisedNL

1'·8·00000000·00000000· 00\000·000·000P·0·00$·00·0·0·0·0·0·0·0·00·000$·00·0·0·0·0·0·0·0·00· 00·+Qi·}|·a000· 00·@H·

payload bytes

00000000  31 27 fc b0 38 10 9e 89  30 30 30 30 30 30 30 30  |1'..8...00000000|
00000010  01 10 02 30 30 30 30 30  30 30 30 cc 0d 30 30 5c  |...00000000..00\|
00000020  30 30 30 01 30 30 30 01  30 30 30 50 01 01 30 02  |000.000.000P..0.|
00000030  03 30 30 24 01 01 30 30  80 01 30 05 80 02 30 02  |.00$..00..0...0.|
00000040  80 04 30 02 80 03 30 03  80 0b 30 01 30 0c 30 04  |..0...0...0.0.0.|
00000050  30 30 0e 10 30 30 30 24  02 01 30 30 80 01 30 05  |00..000$..00..0.|
00000060  80 02 30 01 80 04 30 02  80 03 30 03 80 0b 30 01  |..0...0...0...0.|
00000070  30 0c 30 04 30 30 0e 10  0d 30 30 18 1e 2b 51 69  |0.0.00...00..+Qi|
00000080  05 99 1c 7d 7c 96 fc bf  b5 87 e4 61 30 30 30 04  |...}|......a000.|
00000090  0d 30 30 14 40 48 b7 d5  6e bc e8 85 25 e7 de 7f  |.00.@H..n...%...|
000000a0  30 d6 c2 d3 0d 30 30 14  90 cb 80 91 3e bb 69 6e  |0....00.....>.in|
000000b0  08 63 81 b5 ec 42 7b 1f  30 30 30 14 26 24 4d 38  |.c...B{.000.&$M8|
000000c0  ed db 61 b3 17 2a 36 e3  d0 cf b8 19              |..a..*6.....|

2026-10-11 08:47:49159.223.223.14to 123/udpNTPNL

·0 ·00000·00000000000000000000000000000·^·x000

payload bytes

00000000  d9 30 0a fa 30 30 30 30  30 01 04 30 30 30 30 30  |.0..00000..00000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000020  30 30 30 30 30 30 30 30  c6 f1 5e db 78 30 30 30  |00000000..^.x000|

2026-10-11 08:47:48159.223.223.14to 500/udpUnrecognisedNL
8d·x·ˏ00000
payload bytes
```
00000000  38 64 c1 78 01 b8 9b cb  8f 30 30 30 30 30        |8d.x.....00000|
```

2026-10-11 08:47:47159.223.223.14to 3401/udpUnrecognisedNL

0:·0·Ji·0·0·0·0·0·0·0·00·0·0·7·0·000

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 30 ff e3  |0:...0...Ji..0..|
00000010  04 01 04 02 01 03 04 10  30 0e 04 30 02 01 30 02  |........0..0..0.|
00000020  01 30 04 30 04 30 04 30  30 12 04 30 04 30 a0 0c  |.0.0.0.00..0.0..|
00000030  02 02 37 f0 02 01 30 02  01 30 30 30              |..7...0..000|

2026-10-11 08:47:46159.223.223.14to 260/udpUnrecognisedNL

0:·0·Ji·0·0·0·0·0·0·0·00·0·0·7·0·000

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 30 ff e3  |0:...0...Ji..0..|
00000010  04 01 04 02 01 03 04 10  30 0e 04 30 02 01 30 02  |........0..0..0.|
00000020  01 30 04 30 04 30 04 30  30 12 04 30 04 30 a0 0c  |.0.0.0.00..0.0..|
00000030  02 02 37 f0 02 01 30 02  01 30 30 30              |..7...0..000|

2026-10-11 08:47:45159.223.223.14to 161/udpSNMPNL

0:·0·Ji·0·0·0·0·0·0·0·00·0·0·7·0·000

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 30 ff e3  |0:...0...Ji..0..|
00000010  04 01 04 02 01 03 04 10  30 0e 04 30 02 01 30 02  |........0..0..0.|
00000020  01 30 04 30 04 30 04 30  30 12 04 30 04 30 a0 0c  |.0.0.0.00..0.0..|
00000030  02 02 37 f0 02 01 30 02  01 30 30 30              |..7...0..000|

2026-10-11 08:47:44159.223.223.14to 3401/udpUnrecognisedNL

0·0/·0·public·0 ·L3·V·0·00·0·0·0·+·0·0

payload bytes

00000000  30 82 30 2f 02 01 30 04  06 70 75 62 6c 69 63 a0  |0.0/..0..public.|
00000010  82 30 20 02 04 4c 33 a7  56 02 01 30 02 01 30 30  |.0 ..L3.V..0..00|
00000020  82 30 10 30 82 30 0c 06  08 2b 06 01 02 01 01 05  |.0.0.0...+......|
00000030  30 05 30                                          |0.0|