UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.0K

Datagrams

751

Source addresses

Networks

Countries

378

Destination ports

Traffic by type

Service queries

315 datagrams from 174 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 109 SNMP 47 SSDP 39 NTP 26 NetBIOS 21 CoAP 19 TFTP 14 Sun RPC 14 CLDAP 11 SOAP 9

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

815 datagrams from 181 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 631 DTLS 119 STUN 14 XDMCP 7 GTP-C 6 HTTP 5 GTP-U 5 RTSP 5 RADIUS 5 Kerberos 5

Latest SIP datagram, to 5060/udp

INVITE sip:048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61450;branch=z9hG4bK1786838152 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=1992844005 To: <sip:048525223031@<HONEYPOT>> Call-ID: 1224768141-1749041910-1879456338 CSeq: 1 INVITE Contact: <sip:10001@77.110.115.168:

Payload bytes withheld: they contain the sensor's address.

Unrecognised

832 datagrams from 499 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 832

Latest Unrecognised datagram, to 18392/udp

payload bytes

00000000  ff                                                |.|

Peer-to-peer

75 datagrams from 12 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 75

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	95	37	28 to 54
SNMPv2	161/udp	53	37	6.3
SSDP	1900/udp +3	42	27	30.8
NTP	123/udp	26	21	556.9
NetBIOS	137/udp +2	21	19	3.8
mDNS	5353/udp	18	15	2 to 10
TFTP	69/udp +3	16	13	60
Memcached	11211/udp +1	16	13	10,000 to 51,000
WS-Discovery	3702/udp	16	12	10 to 500
CLDAP	389/udp +1	14	11	56 to 70
Portmap	111/udp	11	9	7 to 28
CharGEN	19/udp	9	8	358.8
QOTD	17/udp	5	4	140.3
RIPv1	520/udp	2	2	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP628
53/udp DNS95
39131/udp BitTorrent62
161/udp SNMP53
500/udp IKE30
1900/udp SSDP29
123/udp NTP26
1434/udp MSSQL Browser23
47808/udp BACnet21
5683/udp CoAP19
4500/udp IPsec NAT-T19
1194/udp OpenVPN19

DNS questions

DNS record types

TXT61
A22
PTR18
ANY7

Networks

AS203273 NetCrafters OU from 1 source558
AS396982 Google LLC from 212 sources293
AS398324 Censys, Inc. from 78 sources279
AS6939 Hurricane Electric LLC from 179 sources210
AS8075 Microsoft Corporation from 147 sources159
AS20052 Arbor Networks, Inc. from 16 sources98
AS14061 DigitalOcean, LLC from 18 sources75
AS7018 AT&T Enterprises, LLC from 1 source60
AS215925 Vpsvault.host Ltd from 1 source53
AS202425 IP Volume inc from 6 sources45

Countries

US United States2,037

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
77.110.115.168	AS203273 NetCrafters OU	US	SIP	558	2026-10-11 09:06
206.171.40.106	AS7018 AT&T Enterprises, LLC	US	BitTorrent	60	2026-10-11 00:31
45.198.224.251	AS215925 Vpsvault.host Ltd	US	Unrecognised	53	2026-10-11 08:44
135.148.29.54	AS16276 OVH SAS	US	SIP	18	2026-10-11 08:33
66.132.172.246	AS398324 Censys, Inc.	US	Unrecognised	18	2026-10-11 09:01
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
167.99.224.157	AS14061 DigitalOcean, LLC	US	Unrecognised	16	2026-10-11 04:32
66.132.172.254	AS398324 Censys, Inc.	US	Unrecognised	16	2026-10-11 07:31
66.132.172.250	AS398324 Censys, Inc.	US	Unrecognised	14	2026-10-11 08:20
66.132.172.243	AS398324 Censys, Inc.	US	Unrecognised	14	2026-10-11 08:18
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	13	2026-10-11 08:50
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	12	2026-10-11 04:44
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	12	2026-10-11 06:41
66.132.172.251	AS398324 Censys, Inc.	US	Unrecognised	12	2026-10-11 06:04
162.217.103.70	AS32475 Internap Holding LLC	US	SIP	11	2026-10-11 07:43
66.132.172.252	AS398324 Censys, Inc.	US	RTSP	11	2026-10-11 02:13
66.132.172.244	AS398324 Censys, Inc.	US	Unrecognised	10	2026-10-11 07:42
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	10	2026-10-11 08:26
66.132.172.245	AS398324 Censys, Inc.	US	Unrecognised	10	2026-10-11 08:40

Latest datagrams

2026-10-11 09:06:5077.110.115.168to 5060/udpSIPUS
INVITE sip:048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61450;branch=z9hG4bK1786838152 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=1992844005 To: <sip:048525223031@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:05:3077.110.115.168to 5060/udpSIPUS
INVITE sip:00048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51197;branch=z9hG4bK299126954 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=38900108 To: <sip:00048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:04:1077.110.115.168to 5060/udpSIPUS
INVITE sip:90048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:65169;branch=z9hG4bK508576580 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=1575127272 To: <sip:90048525223031@<HON
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:04:0466.132.172.240to 18392/udpUnrecognisedUS
·
payload bytes
```
00000000  ff                                                |.|
```
2026-10-11 09:02:52209.46.124.116to 5080/udpSIPUS
REGISTER sip:<HONEYPOT> SIP/2.0 To: <sip:10000@<HONEYPOT>> From: <sip:10000@<HONEYPOT>>;tag=t349959141 Via: SIP/2.0/UDP 209.46.124.116:10017;branch=z9hG4bK-349959141;rport Call-ID: c349959141 CSe
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:02:4777.110.115.168to 5060/udpSIPUS
INVITE sip:0048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:58489;branch=z9hG4bK687195406 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=1608572584 To: <sip:0048525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:01:2677.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61950;branch=z9hG4bK611600123 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=1009761561 To: <sip:48525223031@<HONEYPOT>
Payload bytes withheld: they contain the sensor's address.

2026-10-11 09:01:2166.132.172.246to 63240/udpUnrecognisedUS

·f· · ·censys.io·censys.io· hi· ·

payload bytes

00000000  c8 02 00 66 00 00 00 00  00 00 00 00 80 08 00 00  |...f............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 00  |................|
00000030  00 08 00 00 00 06 06 90  80 0f 00 00 00 07 63 65  |..............ce|
00000040  6e 73 79 73 2e 69 6f 00  0f 00 00 00 08 63 65 6e  |nsys.io......cen|
00000050  73 79 73 2e 69 6f 80 08  00 00 00 09 68 69 80 08  |sys.io......hi..|
00000060  00 00 00 0a 00 08                                 |......|

2026-10-11 09:00:2977.110.115.168to 5060/udpSIPUS
INVITE sip:00248818204112@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62169;branch=z9hG4bK395762656 Max-Forwards: 70 From: <sip:13216220427@<HONEYPOT>>;tag=452464028 To: <sip:00248818204112
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:00:0477.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53162;branch=z9hG4bK1973346886 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=839624755 To: <sip:+48525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.

2026-10-11 09:00:0366.132.186.216to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 08:58:3577.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61115;branch=z9hG4bK1638383398 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1603040033 To: <sip:80048525223031@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:57:5264.62.156.12to 10074/udpMemcachedUS
stats
payload bytes
```
00000000  73 74 61 74 73 0a                                 |stats.|
```
2026-10-11 08:57:1477.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53871;branch=z9hG4bK1391855151 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=885624544 To: <sip:00148525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:55:5377.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:57636;branch=z9hG4bK60705290 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1603541236 To: <sip:00948525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.