UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

8.6K

Datagrams

2.4K

Source addresses

Networks

Countries

1.3K

Destination ports

Traffic by type

Service queries

1,831 datagrams from 835 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 509 SNMP 345 NTP 210 SSDP 180 NetBIOS 167 Sun RPC 101 CoAP 96 TFTP 92 CLDAP 62 SOAP 43

Latest DNS datagram, to 53/udp

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

Other services

1,908 datagrams from 758 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 772 DTLS 710 STUN 129 GTP-U 40 XDMCP 38 GTP-C 35 SOCKS5 28 RTSP 27 HTTP 26 Kerberos 21

Latest SIP datagram, to 5060/udp

INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52637;branch=z9hG4bK923200204 Max-Forwards: 70 From: <sip:5001@<HONEYPOT>>;tag=1677100820 To: <sip:48525223031@<HONEYPOT>> Call-ID: 1637735542-1790809164-90868638 CSeq: 1 INVITE Contact: <sip:5001@77.110.115.168:52637>

Payload bytes withheld: they contain the sensor's address.

QUIC

20 datagrams from 13 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 20

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

4,603 datagrams from 1.7K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4,603

Latest Unrecognised datagram, to 3389/udp

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

Peer-to-peer

215 datagrams from 57 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 215

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	426	184	28 to 54
SNMPv2	161/udp +1	372	180	6.3
NTP	123/udp	210	148	556.9
SSDP	1900/udp +3	195	123	30.8
NetBIOS	137/udp +3	173	121	3.8
mDNS	5353/udp	112	95	2 to 10
TFTP	69/udp +3	96	63	60
Memcached	11211/udp +1	75	62	10,000 to 51,000
Portmap	111/udp	84	56	7 to 28
WS-Discovery	3702/udp	81	51	10 to 500
CLDAP	389/udp +3	78	40	56 to 70
CharGEN	19/udp	50	40	358.8
QOTD	17/udp	45	40	140.3
RIPv1	520/udp	21	16	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP737
161/udp SNMP371
53/udp DNS367
123/udp NTP210
500/udp IKE193
1900/udp SSDP157
137/udp NetBIOS149
39131/udp BitTorrent122
1434/udp MSSQL Browser122
47808/udp BACnet120
5353/udp DNS112
4500/udp IPsec NAT-T108

DNS questions

DNS record types

TXT239
PTR109
A91
ANY29

QUIC clients (JA4)

q13i0311dq_55b375c5d22e_c183556c78e2 from 1 source3
q13i0311h3_55b375c5d22e_c183556c78e2 from 1 source2

QUIC transport parameters

cde977acba33 from 1 source3
12d07494ae7c from 1 source2

QUIC versions

Networks

AS396982 Google LLC from 630 sources1,546
AS398324 Censys, Inc. from 97 sources1,508
AS6939 Hurricane Electric LLC from 590 sources1,148
AS8075 Microsoft Corporation from 604 sources910
AS20052 Arbor Networks, Inc. from 28 sources577
AS14061 DigitalOcean, LLC from 54 sources400
AS203273 NetCrafters OU from 1 source339
AS215925 Vpsvault.host Ltd from 1 source286
AS202425 IP Volume inc from 9 sources263
AS213412 ONYPHE SAS from 16 sources152

Countries

US United States8,577

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
77.110.115.168	AS203273 NetCrafters OU	US	SIP	339	2026-10-11 04:19
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SNMP	286	2026-10-11 04:18
135.148.29.54	AS16276 OVH SAS	US	SIP	112	2026-10-11 04:06
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	69	2026-10-11 03:42
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	69	2026-10-11 04:05
66.132.172.246	AS398324 Censys, Inc.	US	Unrecognised	68	2026-10-11 03:51
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	68	2026-10-11 02:56
66.132.172.254	AS398324 Censys, Inc.	US	DTLS	65	2026-10-11 04:11
66.132.172.252	AS398324 Censys, Inc.	US	TFTP	62	2026-10-11 02:13
66.132.172.248	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 17:13
66.132.172.251	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-11 03:34
66.132.172.253	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 22:36
206.171.40.106	AS7018 AT&T Enterprises, LLC	US	BitTorrent	60	2026-10-11 00:31
66.132.172.250	AS398324 Censys, Inc.	US	Unrecognised	60	2026-10-11 03:23
66.132.172.241	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 01:51
66.132.172.244	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 03:22
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	57	2026-10-10 23:16
66.132.172.243	AS398324 Censys, Inc.	US	Unrecognised	56	2026-10-11 04:08
66.132.172.245	AS398324 Censys, Inc.	US	Unrecognised	55	2026-10-10 19:49
104.237.240.112	AS16628 DedFiberCo	US	Unrecognised	53	2026-10-07 16:25

Latest datagrams

2026-10-11 04:19:2077.110.115.168to 5060/udpSIPUS
INVITE sip:48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:52637;branch=z9hG4bK923200204 Max-Forwards: 70 From: <sip:5001@<HONEYPOT>>;tag=1677100820 To: <sip:48525223031@<HONEYPOT>>
Payload bytes withheld: they contain the sensor's address.

2026-10-11 04:18:3845.198.224.251to 53/udpDNSUS

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 04:18:1365.49.1.177to 13046/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:17:5977.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:57011;branch=z9hG4bK1647680799 Max-Forwards: 70 From: <sip:5001@<HONEYPOT>>;tag=473507210 To: <sip:+48525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.

2026-10-11 04:17:0065.49.20.122to 3389/udpUnrecognisedUS

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:16:39216.226.77.30to 1701/udpUnrecognisedUS

·X·Vigor· · 陀 · ·Draytek

payload bytes

00000000  c8 02 00 58 00 00 00 00  00 00 00 01 80 08 00 00  |...X............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0b 00 00  |................|
00000020  00 07 56 69 67 6f 72 80  0a 00 00 00 03 00 00 00  |..Vigor.........|
00000030  03 80 08 00 00 00 09 e9  99 80 0a 00 00 00 04 00  |................|
00000040  00 00 03 00 08 00 00 00  06 00 01 00 0d 00 00 00  |................|
00000050  08 44 72 61 79 74 65 6b                           |.Draytek|

2026-10-11 04:16:3177.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62771;branch=z9hG4bK1221904888 Max-Forwards: 70 From: <sip:4001@<HONEYPOT>>;tag=283925533 To: <sip:80048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 04:16:1664.62.197.20to 53413/udpUnrecognisedUS
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 04:15:53161.35.230.3to 443/udpUnrecognisedUS
8·*·6·
payload bytes
```
00000000  38 c7 d2 07 12 2a b5 36  17 00 00 00 00 00        |8....*.6......|
```

2026-10-11 04:15:44205.210.31.109to 12546/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:15:37161.35.230.3to 8080/udpUnrecognisedUS
8·Z8NA·
payload bytes
```
00000000  38 c2 d4 c5 5a 38 4e 41  a8 00 00 00 00 00        |8...Z8NA......|
```
2026-10-11 04:15:29161.35.230.3to 9201/udpUnrecognisedUS
8·M{Lr·2·
payload bytes
```
00000000  38 bc 15 4d 7b 4c 72 9c  32 00 00 00 00 00        |8..M{Lr.2.....|
```
2026-10-11 04:15:18161.35.230.3to 1195/udpUnrecognisedUS
8·_·B·
payload bytes
```
00000000  38 8b 5f c8 f1 ad c1 9c  42 00 00 00 00 00        |8._.....B.....|
```
2026-10-11 04:15:1077.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53916;branch=z9hG4bK1016222435 Max-Forwards: 70 From: <sip:4001@<HONEYPOT>>;tag=1503173371 To: <sip:00148525223031@<HON
Payload bytes withheld: they contain the sensor's address.

2026-10-11 04:14:57161.35.230.3to 53/udpDNSUS

8·ˣ·

payload bytes

00000000  38 87 ba e6 fb cb a3 93  0c 00 00 00 00 00        |8.............|