UDP traffic
Datagrams matching port:3702 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
242
Datagrams
80
Source addresses
25
Networks
13
Countries
1
Destination ports
Traffic by type
Service queries
54 datagrams from 41 sourcesRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest SOAP datagram, to 3702/udp
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x|
Unrecognised
188 datagrams from 41 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 3702/udp
payload bytes
00000000 3a 3c 3e 2f 0a |:<>/.|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| WS-Discovery | 3702/udp | 242 | 80 | 10 to 500 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
- 3702/udp WS-Discovery242
Networks
- AS215925 Vpsvault.host Ltd from 2 sources44
- AS209588 Flyservers S.A. from 1 source28
- AS209630 LLC Vash Kredit Bank from 1 source27
- AS51396 Pfcloud UG (haftungsbeschrankt) from 1 source26
- AS6939 Hurricane Electric LLC from 24 sources24
- AS209605 UAB Host Baltic from 1 source21
- AS398324 Censys, Inc. from 8 sources8
- AS213412 ONYPHE SAS from 6 sources8
- AS211298 Driftnet Ltd from 3 sources8
- AS20052 Arbor Networks, Inc. from 6 sources8
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 141.98.83.48 | AS209588 Flyservers S.A. | PA | Unrecognised | 28 | 2026-10-10 09:27 |
| 151.243.11.230 | AS209630 LLC Vash Kredit Bank | AE | Unrecognised | 27 | 2026-10-11 04:42 |
| 45.135.193.115 | AS51396 Pfcloud UG (haftungsbeschrankt) | DE | Unrecognised | 26 | 2026-10-11 06:44 |
| 45.198.224.251 | AS215925 Vpsvault.host Ltd | US | Unrecognised | 24 | 2026-10-10 19:13 |
| 141.98.11.129 | AS209605 UAB Host Baltic | LT | Unrecognised | 21 | 2026-10-10 22:56 |
| 45.205.1.231 | AS215925 Vpsvault.host Ltd | BR | Unrecognised | 20 | 2026-10-10 12:36 |
| 176.65.139.226 | AS219502 Storm Industries LLC | DE | Unrecognised | 4 | 2026-10-08 21:04 |
| 45.33.100.217 | AS63949 Akamai Connected Cloud | US | SOAP | 4 | 2026-10-08 12:28 |
| 170.231.237.214 | AS264617 GRUPO PANAGLOBAL 15 S.A | PA | SOAP | 4 | 2026-10-08 13:09 |
| 193.163.125.241 | AS211298 Driftnet Ltd | GB | SOAP | 3 | 2026-10-05 14:25 |
| 193.163.125.127 | AS211298 Driftnet Ltd | GB | SOAP | 3 | 2026-10-07 00:05 |
| 217.60.242.56 | AS218970 Amin NezhadKahnoji | AE | Unrecognised | 3 | 2026-10-08 21:49 |
| 193.163.125.166 | AS211298 Driftnet Ltd | GB | SOAP | 2 | 2026-10-09 04:06 |
| 91.231.89.160 | AS213412 ONYPHE SAS | FR | SOAP | 2 | 2026-10-09 02:12 |
| 146.88.241.160 | AS20052 Arbor Networks, Inc. | US | SOAP | 2 | 2026-10-10 13:08 |
| 91.230.168.112 | AS213412 ONYPHE SAS | US | SOAP | 2 | 2026-10-09 01:58 |
| 170.231.236.98 | AS264617 GRUPO PANAGLOBAL 15 S.A | PA | SOAP | 2 | 2026-10-06 16:10 |
| 146.88.241.140 | AS20052 Arbor Networks, Inc. | US | SOAP | 2 | 2026-10-08 05:04 |
| 2.27.154.34 | AS218877 Samuel Dierich | US | Unrecognised | 2 | 2026-10-08 21:32 |
| 64.62.197.190 | AS6939 Hurricane Electric LLC | US | Unrecognised | 1 | 2026-10-07 04:58 |
Latest datagrams
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x| ... 512 bytes shown in part
payload bytes
00000000 3a 3c 3e 2f 0a |:<>/.|
payload bytes
00000000 3a 3c 3e 2f 0a |:<>/.|
payload bytes
00000000 3a 3c 3e 2f 0a |:<>/.|
payload bytes
00000000 3c 3a 3e |<:>|
payload bytes
00000000 3c 3a 3e |<:>|
payload bytes
00000000 3a 3c 3e 2f 0a |:<>/.|
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x| ... 512 bytes shown in part
payload bytes
00000000 3c 74 64 73 3a 47 65 74 44 65 76 69 63 65 49 6e |<tds:GetDeviceIn| 00000010 66 6f 72 6d 61 74 69 6f 6e 20 2f 3e |formation />|
payload bytes
00000000 3c 3a 3e |<:>|
payload bytes
00000000 3c 74 64 73 3a 47 65 74 44 65 76 69 63 65 49 6e |<tds:GetDeviceIn| 00000010 66 6f 72 6d 61 74 69 6f 6e 20 2f 3e |formation />|
payload bytes
00000000 3c 74 64 73 3a 47 65 74 44 65 76 69 63 65 49 6e |<tds:GetDeviceIn| 00000010 66 6f 72 6d 61 74 69 6f 6e 20 2f 3e |formation />|
payload bytes
00000000 3c 74 64 73 3a 47 65 74 44 65 76 69 63 65 49 6e |<tds:GetDeviceIn| 00000010 66 6f 72 6d 61 74 69 6f 6e 20 2f 3e |formation />|
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x| ... 512 bytes shown in part
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 |.0" encoding="UT| 00000020 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 |F-8"?><s:Envelop| 00000030 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a |e xmlns:s="http:| 00000040 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 |//www.w3.org/200| 00000050 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f |3/05/soap-envelo| 00000060 70 65 22 20 78 6d 6c 6e 73 3a 61 3d 22 68 74 74 |pe" xmlns:a="htt| 00000070 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 |p://schemas.xmls| 00000080 6f 61 70 2e 6f 72 67 2f 77 73 2f 32 30 30 34 2f |oap.org/ws/2004/| 00000090 30 38 2f 61 64 64 72 65 73 73 69 6e 67 22 3e 3c |08/addressing"><| 000000a0 73 3a 48 65 61 64 65 72 3e 3c 61 3a 41 63 74 69 |s:Header><a:Acti| 000000b0 6f 6e 20 73 3a 6d 75 73 74 55 6e 64 65 72 73 74 |on s:mustUnderst| 000000c0 61 6e 64 3d 22 31 22 3e 68 74 74 70 3a 2f 2f 73 |and="1">http://s| 000000d0 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f |chemas.xmlsoap.o| 000000e0 72 67 2f 77 73 2f 32 30 30 35 2f 30 34 2f 64 69 |rg/ws/2005/04/di| 000000f0 73 63 6f 76 65 72 79 2f 50 72 6f 62 65 3c 2f 61 |scovery/Probe</a| ... 512 bytes shown in part