UDP traffic
Datagrams matching port:370 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
1
Datagrams
1
Source addresses
1
Networks
1
Countries
1
Destination ports
Traffic by type
Service queries
1 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest SOAP datagram, to 370/udp
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 |.0" encoding="UT| 00000020 46 2d 38 22 3f 3e 0a 3c 65 3a 45 6e 76 65 6c 6f |F-8"?>.<e:Envelo| 00000030 70 65 20 78 6d 6c 6e 73 3a 65 3d 22 68 74 74 70 |pe xmlns:e="http| 00000040 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 |://www.w3.org/20| 00000050 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c |03/05/soap-envel| 00000060 6f 70 65 22 0a 20 78 6d 6c 6e 73 3a 77 3d 22 68 |ope". xmlns:w="h| 00000070 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d |ttp://schemas.xm| 00000080 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 2f 32 30 30 |lsoap.org/ws/200| 00000090 34 2f 30 38 2f 61 64 64 72 65 73 73 69 6e 67 22 |4/08/addressing"| 000000a0 0a 20 78 6d 6c 6e 73 3a 64 3d 22 68 74 74 70 3a |. xmlns:d="http:| 000000b0 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 |//schemas.xmlsoa| 000000c0 70 2e 6f 72 67 2f 77 73 2f 32 30 30 35 2f 30 34 |p.org/ws/2005/04| 000000d0 2f 64 69 73 63 6f 76 65 72 79 22 0a 20 3c 65 3a |/discovery". <e:| 000000e0 48 65 61 64 65 72 3e 0a 20 3c 77 3a 4d 65 73 73 |Header>. <w:Mess| 000000f0 61 67 65 49 44 3e 75 75 69 64 3a 38 34 65 64 65 |ageID>uuid:84ede|
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 148.153.56.174 | AS63199 CDS Global Cloud Co., Ltd | US | SOAP | 1 | 2026-10-07 13:05 |
Latest datagrams
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 |.0" encoding="UT| 00000020 46 2d 38 22 3f 3e 0a 3c 65 3a 45 6e 76 65 6c 6f |F-8"?>.<e:Envelo| 00000030 70 65 20 78 6d 6c 6e 73 3a 65 3d 22 68 74 74 70 |pe xmlns:e="http| 00000040 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 |://www.w3.org/20| 00000050 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c |03/05/soap-envel| 00000060 6f 70 65 22 0a 20 78 6d 6c 6e 73 3a 77 3d 22 68 |ope". xmlns:w="h| 00000070 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d |ttp://schemas.xm| 00000080 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 2f 32 30 30 |lsoap.org/ws/200| 00000090 34 2f 30 38 2f 61 64 64 72 65 73 73 69 6e 67 22 |4/08/addressing"| 000000a0 0a 20 78 6d 6c 6e 73 3a 64 3d 22 68 74 74 70 3a |. xmlns:d="http:| 000000b0 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 |//schemas.xmlsoa| 000000c0 70 2e 6f 72 67 2f 77 73 2f 32 30 30 35 2f 30 34 |p.org/ws/2005/04| 000000d0 2f 64 69 73 63 6f 76 65 72 79 22 0a 20 3c 65 3a |/discovery". <e:| 000000e0 48 65 61 64 65 72 3e 0a 20 3c 77 3a 4d 65 73 73 |Header>. <w:Mess| 000000f0 61 67 65 49 44 3e 75 75 69 64 3a 38 34 65 64 65 |ageID>uuid:84ede| ... 512 bytes shown in part