UDP traffic

Datagrams matching country:SC sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

1 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 1

Latest SNMP datagram, to 162/udp

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

Other services

21 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 21

Latest SIP datagram, to 5060/udp

OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 160.119.76.127:5067;branch=z9hG4bK-398359096;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=6239653435316339313363340132373834363435373437 Accept: application/sdp User-Agent: friendly-scanner To: "sipvicious"<sip:100@1.1.1.1>

Payload bytes withheld: they contain the sensor's address.

Unrecognised

3 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 3

Latest Unrecognised datagram, to 32756/udp

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	162/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP3
162/udp2
5063/udp SIP2
5065/udp SIP2
5066/udp SIP2
15010/udp SIP2
15060/udp SIP2
25060/udp SIP2
1701/udp L2TP1
6010/udp SIP1
25040/udp SIP1
25070/udp SIP1

Networks

AS49870 Alsycon B.V. from 1 source21
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 3 sources4

Countries

SC Seychelles25

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
160.119.76.127	AS49870 Alsycon B.V.	SC	SIP	21	2026-10-11 07:00
45.194.70.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SC	Unrecognised	2	2026-10-11 04:26
154.197.56.163	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SC	Unrecognised	1	2026-10-11 10:38
45.194.70.248	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SC	Unrecognised	1	2026-10-11 04:22

Latest datagrams

2026-10-11 10:38:28154.197.56.163to 32756/udpUnrecognisedSC

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 07:00:40160.119.76.127to 5060/udpSIPSC
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 160.119.76.127:5067;branch=z9hG4bK-398359096;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336334013237383436
Payload bytes withheld: they contain the sensor's address.

2026-10-11 04:26:3845.194.70.251to 162/udpSNMPSC

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-11 04:22:5845.194.70.251to 162/udpUnrecognisedSC

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-11 04:22:1645.194.70.248to 1701/udpUnrecognisedSC

·<·nxn-spxn· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6e 78 6e 2d 73 70  78 6e 80 0a 00 00 00 03  |..nxn-spxn......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-10 22:30:12160.119.76.127to 5060/udpSIPSC
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 160.119.76.127:5064;branch=z9hG4bK-712336606;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=623965343531633931336334013338363835
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 5063/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5063 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257699 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257699;rport Call-ID: c312
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 5065/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5065 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257785 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257785;rport Call-ID: c312
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 35070/udpSIPSC
INVITE sip:10000@<HONEYPOT>:35070 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121258098 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121258098;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 15010/udpSIPSC
INVITE sip:10000@<HONEYPOT>:15010 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257625 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257625;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 25060/udpSIPSC
INVITE sip:10000@<HONEYPOT>:25060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257871 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257871;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 35040/udpSIPSC
INVITE sip:10000@<HONEYPOT>:35040 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121258061 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121258061;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 5066/udpSIPSC
INVITE sip:10000@<HONEYPOT>:5066 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257835 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257835;rport Call-ID: c312
Payload bytes withheld: they contain the sensor's address.
2026-10-10 19:21:19160.119.76.127to 15060/udpSIPSC
INVITE sip:10000@<HONEYPOT>:15060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t3121257743 Via: SIP/2.0/UDP 160.119.76.127:10016;branch=z9hG4bK-3121257743;rport Call-ID: c31
Payload bytes withheld: they contain the sensor's address.
2026-10-10 16:26:49160.119.76.127to 25060/udpSIPSC
INVITE sip:10000@<HONEYPOT>:25060 SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t2532446283 Via: SIP/2.0/UDP 160.119.76.127:10009;branch=z9hG4bK-2532446283;rport Call-ID: c25
Payload bytes withheld: they contain the sensor's address.