UDP traffic

Datagrams matching country:RU sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

224

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

80 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 16 DNS 15 NetBIOS 12 SSDP 12 NTP 9 CoAP 8 Sun RPC 8

Latest SNMP datagram, to 161/udp

0·public·A·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 41 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |.A......0.0...+.|
00000020  00                                                |.|

Other services

3 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2 OpenVPN 1

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 81.22.193.161:5064;branch=z9hG4bK-3755875646;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340131323635333836313336 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

QUIC

3 datagrams from 3 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 3

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=smb

Unrecognised

102 datagrams from 20 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 102

Latest Unrecognised datagram, to 1434/udp

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

Peer-to-peer

36 datagrams from 9 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 36

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	11	7	2 to 10
Memcached	11211/udp	12	5	10,000 to 51,000
SSDP	1900/udp	14	3	30.8
SNMPv2	161/udp	16	2	6.3
DNS	53/udp	15	2	28 to 54
NetBIOS	137/udp	12	2	3.8
NTP	123/udp	9	1	556.9
Portmap	111/udp	8	1	7 to 28
RIPv1	520/udp	8	1	131.24
CLDAP	389/udp	7	1	56 to 70

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent31
161/udp SNMP16
53/udp DNS15
1900/udp SSDP14
11211/udp Memcached12
137/udp NetBIOS12
5353/udp mDNS11
123/udp NTP9
5683/udp CoAP8
111/udp Sun RPC8
427/udp SLP8
27015/udp Steam8

DNS questions

com ANY12
yandex.ru A3

DNS record types

ANY12
A3

QUIC clients (JA4)

q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 3 sources3

QUIC transport parameters

5826be32c2d4 from 2 sources2
24dc672a03ab from 1 source1

QUIC versions

Networks

AS51115 HLL LLC from 1 source117
AS201848 Trader soft LLC from 4 sources31
AS57044 JSC ER-Telecom Holding from 5 sources29
AS34267 Rostelecom from 4 sources11
AS12389 Rostelecom from 1 source7
AS8402 PVimpelCom from 1 source5
AS13238 YANDEX LLC from 1 source3
AS29182 JSC IOT from 1 source3
AS213182 CATV System Edver Ltd. from 1 source3
AS212913 Time-host Ltd from 1 source2

Countries

RU Russia224

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.94.111.1	AS51115 HLL LLC	RU	Unrecognised	117	2026-10-11 04:00
212.193.59.5	AS201848 Trader soft LLC	RU	BitTorrent	11	2026-10-10 02:22
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	10	2026-10-10 09:33
212.193.53.251	AS201848 Trader soft LLC	RU	BitTorrent	8	2026-10-07 18:09
31.132.169.138	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	8	2026-10-11 03:17
212.193.49.1	AS201848 Trader soft LLC	RU	BitTorrent	7	2026-10-10 01:16
178.44.106.19	AS12389 Rostelecom	RU	SNMP	7	2026-10-09 05:39
78.107.31.154	AS8402 PVimpelCom	RU	Unrecognised	5	2026-10-11 00:02
37.112.63.117	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	5	2026-10-08 07:22
212.193.60.41	AS201848 Trader soft LLC	RU	BitTorrent	5	2026-10-07 11:42
213.155.195.206	AS34267 Rostelecom	RU	Unrecognised	5	2026-10-10 19:36
37.112.57.95	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	4	2026-10-10 11:00
93.158.165.179	AS13238 YANDEX LLC	RU	DNS	3	2026-10-10 17:30
84.42.46.199	AS34267 Rostelecom	RU	Unrecognised	3	2026-10-09 03:48
93.170.12.102	AS213182 CATV System Edver Ltd.	RU	Unrecognised	3	2026-10-10 08:40
157.22.184.216	AS29182 JSC IOT	RU	Unrecognised	3	2026-10-10 03:10
89.109.253.239	AS25515 Rostelecom	RU	BitTorrent	2	2026-10-09 07:23
81.22.193.161	AS212913 Time-host Ltd	RU	SIP	2	2026-10-08 19:42
84.42.46.192	AS34267 Rostelecom	RU	Unrecognised	2	2026-10-09 15:11
91.215.190.141	AS49701 RIA Link Ltd	RU	Unrecognised	2	2026-10-08 00:53

Latest datagrams

2026-10-11 04:00:58185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  d2 a8 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:25:53185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  f9 74 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.t.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:17:2131.132.169.138to 1434/udpUnrecognisedRU

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

2026-10-11 03:06:21185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  21 4d 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |!M.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 02:25:49185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:18:51185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:14:4031.132.169.138to 8080/udpUnrecognisedRU

;.:rub`h2|· n·ibNX)·l$·V c·U":G·(·N$·[·DtT·e9 A`·c·

payload bytes

00000000  3b 2e 3a 72 75 62 60 68  32 7c 01 0d 6e 05 69 62  |;.:rub`h2|..n.ib|
00000010  4e 58 29 11 1c 6c 24 08  56 09 63 1e 1a 15 00 55  |NX)..l$.V.c....U|
00000020  22 3a 47 17 1c 28 7f 4e  24 00 5b 12 06 44 74 54  |":G..(.N$.[..DtT|
00000030  1d 1e 65 39 0a 09 41 60  12 63 af                 |..e9..A`.c.|

2026-10-11 02:13:0431.132.169.138to 8081/udpUnrecognisedRU

V.;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·puym*·u28370tn99g·u·0d·

payload bytes

00000000  56 2e 3b 3e 3e 7b 0e 52  72 34 6f 61 7d 35 07 08  |V.;>>{.Rr4oa}5..|
00000010  08 38 3e 05 77 41 36 09  45 79 56 3b 1a 21 6f 70  |.8>.wA6.EyV;.!op|
00000020  76 2a 2e 34 26 3c 06 18  70 75 79 6d 2a 00 75 32  |v*.4&<..puym*.u2|
00000030  38 33 37 30 74 6e 39 39  67 0f 75 01 30 64 86 aa  |8370tn99g.u.0d..|

2026-10-11 01:07:07185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:02:08185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 00:02:5578.107.31.154to 1027/udpUnrecognisedRU

-.J9&IWl4;)E{r p·z-,·K·q^^F!^n7·"·EHJ·4·W]DROMCSGp·^<·P·y·<W·sc'u(o?D#>·m·

payload bytes

00000000  2d 2e 4a 39 26 49 57 6c  34 3b 29 45 7b 72 09 70  |-.J9&IWl4;)E{r.p|
00000010  03 7a 2d 2c 17 4b 1b 71  5e 5e 46 21 5e 6e 37 0b  |.z-,.K.q^^F!^n7.|
00000020  22 01 45 48 4a 1c 34 7f  57 5d 44 52 4f 4d 43 53  |".EHJ.4.W]DROMCS|
00000030  47 70 7f 5e 3c 1a 50 1a  79 16 3c 57 05 73 63 27  |Gp.^<.P.y.<W.sc'|
00000040  75 28 6f 3f 44 23 3e 1b  00 02 6d 8c b7           |u(o?D#>...m..|

2026-10-10 23:55:0437.32.101.141to 8082/udpUnrecognisedRU

<.·C|·`b=:·m2T·0J,i62HX^·&21=.·s·e3x c :l· (Bi·@b·6_·!

payload bytes

00000000  3c 2e 1f 43 7c 18 60 62  3d 3a 0b 6d 32 54 0e 30  |<..C|.`b=:.m2T.0|
00000010  4a 2c 69 36 32 48 58 5e  1b 26 32 31 3d 2e 11 73  |J,i62HX^.&21=..s|
00000020  1b 65 33 78 09 63 20 3a  6c 07 0d 28 42 69 01 40  |.e3x.c :l..(Bi.@|
00000030  62 10 36 5f 04 81 21                              |b.6_..!|

2026-10-10 23:18:36185.94.111.1to 161/udpSNMPRU

0·public·A·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 41 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |.A......0.0...+.|
00000020  00                                                |.|

2026-10-10 22:32:19185.94.111.1to 161/udpSNMPRU

0·public·E·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 45 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |.E......0.0...+.|
00000020  00                                                |.|

2026-10-10 22:14:28185.94.111.1to 161/udpSNMPRU

0·public·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 03 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |........0.0...+.|
00000020  00                                                |.|