UDP traffic
Datagrams matching country:SC sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
156
Datagrams
3
Source addresses
2
Networks
1
Countries
35
Destination ports
Traffic by type
Service queries
1 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest SNMP datagram, to 162/udp
payload bytes
00000000 30 3a 02 01 03 30 0f 02 02 4a 69 02 03 00 ff e3 |0:...0...Ji.....| 00000010 04 01 04 02 01 03 04 10 30 0e 04 00 02 01 00 02 |........0.......| 00000020 01 00 04 00 04 00 04 00 30 12 04 00 04 00 a0 0c |........0.......| 00000030 02 02 37 f0 02 01 00 02 01 00 30 00 |..7.......0.|
Other services
153 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
2 datagrams from 2 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 162/udp
payload bytes
00000000 30 82 00 2f 02 01 00 04 06 70 75 62 6c 69 63 a0 |0../.....public.| 00000010 82 00 20 02 04 4c 33 a7 56 02 01 00 02 01 00 30 |.. ..L3.V......0| 00000020 82 00 10 30 82 00 0c 06 08 2b 06 01 02 01 01 05 |...0.....+......| 00000030 00 05 00 |...|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| SNMPv2 | 162/udp | 1 | 1 | 6.3 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS49870 Alsycon B.V. from 1 source153
- AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 2 sources3
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 160.119.76.127 | AS49870 Alsycon B.V. | SC | SIP | 153 | 2026-10-10 22:30 |
| 45.194.70.251 | AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT | SC | Unrecognised | 2 | 2026-10-11 04:26 |
| 45.194.70.248 | AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT | SC | Unrecognised | 1 | 2026-10-11 04:22 |
Latest datagrams
payload bytes
00000000 30 3a 02 01 03 30 0f 02 02 4a 69 02 03 00 ff e3 |0:...0...Ji.....| 00000010 04 01 04 02 01 03 04 10 30 0e 04 00 02 01 00 02 |........0.......| 00000020 01 00 04 00 04 00 04 00 30 12 04 00 04 00 a0 0c |........0.......| 00000030 02 02 37 f0 02 01 00 02 01 00 30 00 |..7.......0.|
payload bytes
00000000 30 82 00 2f 02 01 00 04 06 70 75 62 6c 69 63 a0 |0../.....public.| 00000010 82 00 20 02 04 4c 33 a7 56 02 01 00 02 01 00 30 |.. ..L3.V......0| 00000020 82 00 10 30 82 00 0c 06 08 2b 06 01 02 01 01 05 |...0.....+......| 00000030 00 05 00 |...|
payload bytes
00000000 c8 02 00 3c 00 00 00 00 00 00 00 00 80 08 00 00 |...<............| 00000010 00 00 00 01 80 08 00 00 00 02 01 00 80 0e 00 00 |................| 00000020 00 07 6e 78 6e 2d 73 70 78 6e 80 0a 00 00 00 03 |..nxn-spxn......| 00000030 00 00 00 03 80 08 00 00 00 09 00 00 |............|
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.
Payload bytes withheld: they contain the sensor's address.