UDP traffic

Datagrams matching country:NL sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

492

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

134 datagrams from 16 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 55 SNMP 42 NTP 23 TFTP 4 NetBIOS 3 SSDP 3 CLDAP 2 Sun RPC 2

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  e2 8c 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |... .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

Other services

195 datagrams from 19 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 137 Redis 40 STUN 7 DTLS 5 RADIUS 2 MINING 1 XDMCP 1 GTP-U 1 H323 1

Latest SIP datagram, to 5070/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5063;branch=z9hG4bK3b470ea1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=4ede08fc Call-ID: fc4d11f4ea6df60d CSeq: 1 OPTIONS Contact: <sip:a@127.0.0.1:5063> Content-Length: 0

Payload bytes withheld: they contain the sensor's address.

QUIC

1 datagrams from 1 source

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 1

Latest QUIC datagram, to 443/udp

QUIC v1 Initial (ClientHello incomplete, 65 bytes)

Unrecognised

107 datagrams from 21 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 107

Latest Unrecognised datagram, to 19/udp

payload bytes

00000000  0a                                                |.|

Peer-to-peer

55 datagrams from 4 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 55

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	54	5	28 to 54
SNMPv2	161/udp	42	4	6.3
NTP	123/udp	23	3	556.9
SSDP	1900/udp	7	3	30.8
NetBIOS	137/udp	6	3	3.8
CLDAP	389/udp	6	2	56 to 70
CharGEN	19/udp	6	2	358.8
Portmap	111/udp	4	2	7 to 28
Memcached	11211/udp	4	2	10,000 to 51,000
RIPv1	520/udp	3	2	131.24
TFTP	69/udp	4	1	60
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP70
53/udp DNS54
39131/udp BitTorrent54
161/udp SNMP42
123/udp NTP23
5080/udp SIP14
443/udp QUIC8
1900/udp SSDP7
1434/udp MSSQL Browser7
9034/udp6
3478/udp STUN6
137/udp NetBIOS6

DNS questions

DNS record types

ANY31
TXT20
A3
PTR1

QUIC versions

Networks

AS12876 Scaleway SAS from 6 sources164
AS219502 Storm Industries LLC from 10 sources114
AS14061 DigitalOcean, LLC from 3 sources47
AS202425 IP Volume inc from 5 sources43
AS1136 KPN B.V. from 1 source40
AS49870 Alsycon B.V. from 3 sources17
AS197170 TechTies Inc. from 2 sources14
AS51396 Pfcloud UG (haftungsbeschrankt) from 5 sources14
AS60781 LeaseWeb Netherlands B.V. from 1 source10
AS1103 SURF B.V. from 2 sources7

Countries

NL The Netherlands492

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
81.207.3.7	AS1136 KPN B.V.	NL	BitTorrent	40	2026-10-05 21:10
51.158.202.6	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.202.97	AS12876 Scaleway SAS	NL	SIP	30	2026-10-10 22:19
51.158.201.249	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.205.153	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
51.158.204.210	AS12876 Scaleway SAS	NL	SIP	28	2026-10-10 22:19
94.154.43.109	AS219502 Storm Industries LLC	NL	DNS	25	2026-10-09 08:45
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	24	2026-10-07 00:19
94.154.43.163	AS219502 Storm Industries LLC	NL	SNMP	20	2026-10-10 15:26
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	20	2026-10-11 00:48
165.232.89.6	AS14061 DigitalOcean, LLC	NL	Unrecognised	18	2026-10-10 00:08
94.154.43.51	AS219502 Storm Industries LLC	NL	NTP	16	2026-10-09 17:50
80.82.77.139	AS202425 IP Volume inc	NL	Unrecognised	15	2026-10-10 18:31
93.174.95.106	AS202425 IP Volume inc	NL	Unrecognised	13	2026-10-10 23:15
94.154.43.138	AS219502 Storm Industries LLC	NL	SNMP	12	2026-10-08 09:37
94.154.43.95	AS219502 Storm Industries LLC	NL	NTP	12	2026-10-09 07:03
94.154.43.251	AS219502 Storm Industries LLC	NL	STUN	11	2026-10-09 10:50
89.190.156.22	AS49870 Alsycon B.V.	NL	SIP	10	2026-10-10 20:43
94.75.213.36	AS60781 LeaseWeb Netherlands B.V.	NL	BitTorrent	10	2026-10-05 12:23
94.154.43.222	AS219502 Storm Industries LLC	NL	SIP	8	2026-10-07 02:35

Latest datagrams

2026-10-11 03:28:32176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 03:04:36176.65.149.233to 19/udpUnrecognisedNL
·
payload bytes
```
00000000  01                                                |.|
```
2026-10-11 02:53:45176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```

2026-10-11 02:49:4780.82.77.33to 987/udpUnrecognisedNL

SRCH * HTTP/1.1 device-discovery-protocol-version:00030010

payload bytes

00000000  53 52 43 48 20 2a 20 48  54 54 50 2f 31 2e 31 0a  |SRCH * HTTP/1.1.|
00000010  64 65 76 69 63 65 2d 64  69 73 63 6f 76 65 72 79  |device-discovery|
00000020  2d 70 72 6f 74 6f 63 6f  6c 2d 76 65 72 73 69 6f  |-protocol-versio|
00000030  6e 3a 30 30 30 33 30 30  31 30 0a                 |n:00030010.|

2026-10-11 02:34:12176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```

2026-10-11 01:06:21176.65.148.78to 47808/udpUnrecognisedNL

· ·?·KL

payload bytes

00000000  81 0a 00 11 01 04 00 05  d6 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b 4c                                             |KL|

2026-10-11 01:00:41146.190.30.184to 443/udpUnrecognisedNL
8̣·7V·m·
payload bytes
```
00000000  38 cc a3 ef 37 56 8d 6d  f3 00 00 00 00 00        |8...7V.m......|
```
2026-10-11 01:00:41146.190.30.184to 9201/udpUnrecognisedNL
8·ԕǇ4*·
payload bytes
```
00000000  38 91 8e d4 95 c7 87 34  2a 00 00 00 00 00        |8......4*.....|
```
2026-10-11 01:00:39146.190.30.184to 4443/udpUnrecognisedNL
8·G·7%·
payload bytes
```
00000000  38 ae 94 47 ef 37 25 bf  d5 00 00 00 00 00        |8..G.7%.......|
```
2026-10-11 01:00:37146.190.30.184to 1194/udpUnrecognisedNL
8· ·m·
payload bytes
```
00000000  38 ef e6 0d c2 88 cc 0c  6d 00 00 00 00 00        |8.......m.....|
```
2026-10-11 01:00:35146.190.30.184to 8080/udpUnrecognisedNL
8̰2·W·c·
payload bytes
```
00000000  38 cc b0 32 d4 57 9c c2  63 00 00 00 00 00        |8..2.W..c.....|
```

2026-10-11 00:48:3051.158.205.203to 53/udpDNSNL

DNS query TXT/CH version.bind

payload bytes

00000000  e2 8c 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |... .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-10 23:51:2451.158.205.203to 53/udpDNSNL

DNS query TXT/CH version.bind

payload bytes

00000000  d4 ab 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |... .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-10 23:42:06176.65.149.188to 3283/udpUnrecognisedNL
·
payload bytes
```
00000000  00 14 00 00                                       |....|
```

2026-10-10 23:15:1693.174.95.106to 44818/udpUnrecognisedNL

c·j·d·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  6a 0e be 64 00 00 00 00                           |j..d....|