UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

9.2K

Datagrams

2.4K

Source addresses

Networks

Countries

1.4K

Destination ports

Traffic by type

Service queries

1,907 datagrams from 868 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 523 SNMP 353 NTP 224 SSDP 191 NetBIOS 174 Sun RPC 105 CoAP 104 TFTP 93 CLDAP 68 SOAP 44

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

2,186 datagrams from 782 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 997 DTLS 746 STUN 134 GTP-U 41 XDMCP 39 GTP-C 36 HTTP 28 SOCKS5 28 RTSP 27 RTP 24

Latest SIP datagram, to 5060/udp

INVITE sip:00248818204112@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62169;branch=z9hG4bK395762656 Max-Forwards: 70 From: <sip:13216220427@<HONEYPOT>>;tag=452464028 To: <sip:00248818204112@<HONEYPOT>> Call-ID: 98007798-412565018-1383910515 CSeq: 1 INVITE Contact: <sip:13216220427@77.1

Payload bytes withheld: they contain the sensor's address.

QUIC

20 datagrams from 13 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 20

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

4,829 datagrams from 1.7K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4,829

Latest Unrecognised datagram, to 1027/udp

^.·I·z ·@$·%=o·0L_·5%mh·;gY

payload bytes

00000000  5e 2e 0f 49 13 7a 09 00  40 24 08 25 3d 6f 0f 30  |^..I.z..@$.%=o.0|
00000010  4c 5f 15 04 35 25 6d 68  1b 3b 67 59              |L_..5%mh.;gY|

Peer-to-peer

217 datagrams from 57 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 217

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp +1	383	189	6.3
DNS	53/udp +3	436	188	28 to 54
NTP	123/udp	224	156	556.9
SSDP	1900/udp +3	207	130	30.8
NetBIOS	137/udp +3	180	128	3.8
mDNS	5353/udp	117	99	2 to 10
TFTP	69/udp +3	99	65	60
Memcached	11211/udp +1	79	65	10,000 to 51,000
Portmap	111/udp	86	58	7 to 28
WS-Discovery	3702/udp	86	56	10 to 500
CLDAP	389/udp +3	87	45	56 to 70
CharGEN	19/udp	55	45	358.8
QOTD	17/udp	46	41	140.3
RIPv1	520/udp	21	16	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP963
161/udp SNMP382
53/udp DNS380
123/udp NTP224
500/udp IKE200
1900/udp SSDP167
137/udp NetBIOS156
1434/udp MSSQL Browser127
39131/udp BitTorrent123
47808/udp BACnet122
5353/udp DNS117
4500/udp IPsec NAT-T111

DNS questions

DNS record types

TXT239
PTR114
A97
ANY32

QUIC clients (JA4)

q13i0311dq_55b375c5d22e_c183556c78e2 from 1 source3
q13i0311h3_55b375c5d22e_c183556c78e2 from 1 source2

QUIC transport parameters

cde977acba33 from 1 source3
12d07494ae7c from 1 source2

QUIC versions

Networks

AS396982 Google LLC from 637 sources1,578
AS398324 Censys, Inc. from 97 sources1,570
AS6939 Hurricane Electric LLC from 617 sources1,260
AS8075 Microsoft Corporation from 625 sources949
AS20052 Arbor Networks, Inc. from 28 sources604
AS203273 NetCrafters OU from 1 source553
AS14061 DigitalOcean, LLC from 57 sources430
AS215925 Vpsvault.host Ltd from 1 source296
AS202425 IP Volume inc from 9 sources271
AS213412 ONYPHE SAS from 16 sources152

Countries

US United States9,159

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
77.110.115.168	AS203273 NetCrafters OU	US	SIP	553	2026-10-11 09:00
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SNMP	296	2026-10-11 08:44
135.148.29.54	AS16276 OVH SAS	US	SIP	115	2026-10-11 08:33
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	72	2026-10-11 06:41
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	70	2026-10-11 08:50
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	70	2026-10-11 04:44
66.132.172.246	AS398324 Censys, Inc.	US	Unrecognised	68	2026-10-11 03:51
66.132.172.254	AS398324 Censys, Inc.	US	DTLS	68	2026-10-11 07:31
66.132.172.248	AS398324 Censys, Inc.	US	Unrecognised	66	2026-10-11 07:37
66.132.172.250	AS398324 Censys, Inc.	US	Unrecognised	64	2026-10-11 08:20
66.132.172.251	AS398324 Censys, Inc.	US	Unrecognised	63	2026-10-11 06:04
66.132.172.252	AS398324 Censys, Inc.	US	RTSP	62	2026-10-11 02:13
66.132.172.244	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-11 07:42
66.132.172.253	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 22:36
206.171.40.106	AS7018 AT&T Enterprises, LLC	US	BitTorrent	60	2026-10-11 00:31
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	60	2026-10-11 08:26
66.132.172.243	AS398324 Censys, Inc.	US	Unrecognised	60	2026-10-11 08:18
66.132.172.241	AS398324 Censys, Inc.	US	Unrecognised	59	2026-10-11 08:52
66.132.172.245	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 08:40
66.132.172.240	AS398324 Censys, Inc.	US	Unrecognised	54	2026-10-11 06:45

Latest datagrams

2026-10-11 09:00:2977.110.115.168to 5060/udpSIPUS
INVITE sip:00248818204112@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:62169;branch=z9hG4bK395762656 Max-Forwards: 70 From: <sip:13216220427@<HONEYPOT>>;tag=452464028 To: <sip:00248818204112
Payload bytes withheld: they contain the sensor's address.
2026-10-11 09:00:0477.110.115.168to 5060/udpSIPUS
INVITE sip:+48525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53162;branch=z9hG4bK1973346886 Max-Forwards: 70 From: <sip:10001@<HONEYPOT>>;tag=839624755 To: <sip:+48525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.

2026-10-11 09:00:0366.132.186.216to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 08:58:3577.110.115.168to 5060/udpSIPUS
INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:61115;branch=z9hG4bK1638383398 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1603040033 To: <sip:80048525223031@<HONEYP
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:57:5264.62.156.12to 10074/udpMemcachedUS
stats
payload bytes
```
00000000  73 74 61 74 73 0a                                 |stats.|
```
2026-10-11 08:57:1477.110.115.168to 5060/udpSIPUS
INVITE sip:00148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:53871;branch=z9hG4bK1391855151 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=885624544 To: <sip:00148525223031@<HONEYPO
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:55:5377.110.115.168to 5060/udpSIPUS
INVITE sip:00948525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:57636;branch=z9hG4bK60705290 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1603541236 To: <sip:00948525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.

2026-10-11 08:54:34144.225.8.33to 1027/udpUnrecognisedUS

^.·I·z ·@$·%=o·0L_·5%mh·;gY

payload bytes

00000000  5e 2e 0f 49 13 7a 09 00  40 24 08 25 3d 6f 0f 30  |^..I.z..@$.%=o.0|
00000010  4c 5f 15 04 35 25 6d 68  1b 3b 67 59              |L_..5%mh.;gY|

2026-10-11 08:54:3077.110.115.168to 5060/udpSIPUS
INVITE sip:981048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:63954;branch=z9hG4bK1626635102 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1447767226 To: <sip:981048525223031@<HONE
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:53:1077.110.115.168to 5060/udpSIPUS
INVITE sip:81048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51379;branch=z9hG4bK2018958211 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=1765567613 To: <sip:81048525223031@<HONEYP
Payload bytes withheld: they contain the sensor's address.

2026-10-11 08:52:44184.15.160.195to 48670/udpUnrecognisedUS

·j·Q·<·4Vx"·`·r·

payload bytes

00000000  01 82 6a c3 51 e9 c3 3c  81 00 ff ff 00 fe fe fe  |..j.Q..<........|
00000010  fe fd fd fd fd 12 34 56  78 22 ff 60 11 af f5 72  |......4Vx".`...r|
00000020  e3                                                |.|

2026-10-11 08:52:0266.132.172.241to 7490/udpUnrecognisedUS
·
payload bytes
```
00000000  00 00 00 00                                       |....|
```
2026-10-11 08:51:4977.110.115.168to 5060/udpSIPUS
INVITE sip:901148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51209;branch=z9hG4bK1894945054 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=690425571 To: <sip:901148525223031@<HONEY
Payload bytes withheld: they contain the sensor's address.
2026-10-11 08:50:56185.242.226.166to 41794/udpUnrecognisedUS
·
payload bytes
```
00000000  14 00 00 00 01 04 00 03  00 00                    |..........|
```
2026-10-11 08:50:2977.110.115.168to 5060/udpSIPUS
INVITE sip:01148525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:63634;branch=z9hG4bK626142094 Max-Forwards: 70 From: <sip:9@<HONEYPOT>>;tag=555524941 To: <sip:01148525223031@<HONEYPOT
Payload bytes withheld: they contain the sensor's address.