UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

8.5K

Datagrams

2.4K

Source addresses

Networks

Countries

1.3K

Destination ports

Traffic by type

Service queries

1,817 datagrams from 831 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 504 SNMP 340 NTP 209 SSDP 180 NetBIOS 167 Sun RPC 100 CoAP 95 TFTP 92 CLDAP 62 SOAP 43

Latest DNS datagram, to 53/udp

DNS query A 00065d87e9839cd7.1059.<HONEYPOT>.asertdnsresearch.com

Payload bytes withheld: they contain the sensor's address.

Other services

1,859 datagrams from 753 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 730 DTLS 703 STUN 129 GTP-U 40 XDMCP 38 GTP-C 35 SOCKS5 28 RTSP 27 HTTP 26 Kerberos 21

Latest SIP datagram, to 5060/udp

INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5661;branch=z9hG4bK-3352974268;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=3035616662373834313363340133383038363933393939 User-Agent: friendly-scanner Call-ID: 102453939185568

Payload bytes withheld: they contain the sensor's address.

QUIC

20 datagrams from 13 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 20

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

4,571 datagrams from 1.7K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4,571

Latest Unrecognised datagram, to 47808/udp

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  e1 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

Peer-to-peer

215 datagrams from 57 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 215

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	422	181	28 to 54
SNMPv2	161/udp +1	367	180	6.3
NTP	123/udp	209	147	556.9
SSDP	1900/udp +3	195	123	30.8
NetBIOS	137/udp +3	173	121	3.8
mDNS	5353/udp	111	94	2 to 10
TFTP	69/udp +3	96	63	60
Memcached	11211/udp +1	71	59	10,000 to 51,000
Portmap	111/udp	84	56	7 to 28
WS-Discovery	3702/udp	81	51	10 to 500
CLDAP	389/udp +3	78	40	56 to 70
CharGEN	19/udp	50	40	358.8
QOTD	17/udp	44	39	140.3
RIPv1	520/udp	21	16	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP697
161/udp SNMP366
53/udp DNS364
123/udp NTP209
500/udp IKE193
1900/udp SSDP157
137/udp NetBIOS149
39131/udp BitTorrent122
47808/udp BACnet120
1434/udp MSSQL Browser120
5353/udp DNS111
4500/udp IPsec NAT-T108

DNS questions

DNS record types

TXT237
PTR108
A91
ANY28

QUIC clients (JA4)

q13i0311dq_55b375c5d22e_c183556c78e2 from 1 source3
q13i0311h3_55b375c5d22e_c183556c78e2 from 1 source2

QUIC transport parameters

cde977acba33 from 1 source3
12d07494ae7c from 1 source2

QUIC versions

Networks

AS396982 Google LLC from 628 sources1,538
AS398324 Censys, Inc. from 97 sources1,503
AS6939 Hurricane Electric LLC from 584 sources1,129
AS8075 Microsoft Corporation from 604 sources910
AS20052 Arbor Networks, Inc. from 28 sources572
AS14061 DigitalOcean, LLC from 53 sources393
AS203273 NetCrafters OU from 1 source301
AS215925 Vpsvault.host Ltd from 1 source285
AS202425 IP Volume inc from 9 sources261
AS213412 ONYPHE SAS from 16 sources152

Countries

US United States8,482

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
77.110.115.168	AS203273 NetCrafters OU	US	SIP	301	2026-10-11 03:29
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SNMP	285	2026-10-11 03:28
135.148.29.54	AS16276 OVH SAS	US	SIP	111	2026-10-11 03:12
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	68	2026-10-11 02:56
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	68	2026-10-11 02:26
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	68	2026-10-10 22:48
66.132.172.246	AS398324 Censys, Inc.	US	Unrecognised	67	2026-10-11 00:47
66.132.172.254	AS398324 Censys, Inc.	US	Unrecognised	64	2026-10-11 03:11
66.132.172.252	AS398324 Censys, Inc.	US	RTSP	62	2026-10-11 02:13
66.132.172.248	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 17:13
66.132.172.253	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 22:36
206.171.40.106	AS7018 AT&T Enterprises, LLC	US	BitTorrent	60	2026-10-11 00:31
66.132.172.251	AS398324 Censys, Inc.	US	Unrecognised	60	2026-10-10 23:34
66.132.172.250	AS398324 Censys, Inc.	US	Unrecognised	60	2026-10-11 03:23
66.132.172.241	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 01:51
66.132.172.244	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 03:22
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	57	2026-10-10 23:16
66.132.172.245	AS398324 Censys, Inc.	US	Unrecognised	55	2026-10-10 19:49
66.132.172.243	AS398324 Censys, Inc.	US	Unrecognised	55	2026-10-11 02:33
104.237.240.112	AS16628 DedFiberCo	US	Unrecognised	53	2026-10-07 16:25

Latest datagrams

2026-10-11 03:30:4065.49.20.70to 5683/udpCoAPUS

@·sj

payload bytes

00000000  40 01 73 6a                                       |@.sj|

2026-10-11 03:30:17162.217.103.70to 5060/udpSIPUS
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 162.217.103.68:5661;branch=z9hG4bK-3352974268;rport Max-Forwards: 70 To: "sipvicious"<sip:100@1.1.1.1> From: "sipvicious"<sip:100@1.1.1.1>;tag=30
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:29:5664.62.197.140to 177/udpXDMCPUS

payload bytes

00000000  00 01 00 02 00 01 00                              |.......|

2026-10-11 03:29:4177.110.115.168to 5060/udpSIPUS
INVITE sip:90048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62092;branch=z9hG4bK1774945115 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=733409178 To: <sip:90048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:29:03205.210.31.225to 12246/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:28:55172.86.125.231to 5060/udpSIPUS
INVITE sip:61420163737@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 172.86.125.231:33910;branch=z9hG4bK-524287-1---1f918c9b989108b2;rport Max-Forwards: 70 From: <sip:17376490500@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:28:3245.198.224.251to 161/udpSNMPUS

0$·public·ɬ·Y·d0 0·+·

payload bytes

00000000  30 24 02 01 01 04 06 70  75 62 6c 69 63 a5 17 02  |0$.....public...|
00000010  04 c9 ac b7 59 02 01 00  02 01 64 30 09 30 07 06  |....Y.....d0.0..|
00000020  03 2b 06 01 05 00                                 |.+....|

2026-10-11 03:28:1877.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:60285;branch=z9hG4bK1937115019 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1095873567 To: <sip:0048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:28:1466.132.172.229to 6969/udpTFTPUS
·/a·netascii·
payload bytes
```
00000000  00 01 2f 61 00 6e 65 74  61 73 63 69 69 00        |../a.netascii.|
```
2026-10-11 03:27:0077.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65049;branch=z9hG4bK901272499 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=1264474260 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:26:52205.210.31.170to 13146/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:26:4971.6.134.228to 6881/udpBitTorrentUS

d1:ad2:id20:q·vr·Ӣ·dE·PF·3F6:target20:·\·[O·h·S·зe1:q9:find_node1:t1:a1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 71 88 80 c8  |d1:ad2:id20:q...|
00000010  76 72 f1 13 d3 a2 a4 f6  64 45 c7 50 46 0c 33 46  |vr......dE.PF.3F|
00000020  36 3a 74 61 72 67 65 74  32 30 3a be f6 01 d2 c0  |6:target20:.....|
00000030  f9 b2 5c 82 05 5b 4f c6  68 e3 53 94 d2 d0 b7 65  |..\..[O.h.S....e|
00000040  31 3a 71 39 3a 66 69 6e  64 5f 6e 6f 64 65 31 3a  |1:q9:find_node1:|
00000050  74 31 3a 61 31 3a 79 31  3a 71 65                 |t1:a1:y1:qe|

2026-10-11 03:25:4465.49.20.85to 2123/udpGTP-CUS

2·

payload bytes

00000000  32 01 00 04 00 00 00 00  00 00 00 00              |2...........|

2026-10-11 03:25:3877.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52431;branch=z9hG4bK2078030923 Max-Forwards: 70 From: <sip:2001@<HONEYPOT>>;tag=400786037 To: <sip:+48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:24:1377.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51980;branch=z9hG4bK784180262 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=799950121 To: <sip:80048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.