UDP traffic

Datagrams matching port:37020 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

7 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SOAP 7

Latest SOAP datagram, to 37020/udp

<?xml version="1.0" encoding="utf-8"?><Probe><Uuid>58cea169-2391-4d2c-b259-9aff57242cd6</Uuid><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 3c 50  72 6f 62 65 3e 3c 55 75  |f-8"?><Probe><Uu|
00000030  69 64 3e 35 38 63 65 61  31 36 39 2d 32 33 39 31  |id>58cea169-2391|
00000040  2d 34 64 32 63 2d 62 32  35 39 2d 39 61 66 66 35  |-4d2c-b259-9aff5|
00000050  37 32 34 32 63 64 36 3c  2f 55 75 69 64 3e 3c 54  |7242cd6</Uuid><T|
00000060  79 70 65 73 3e 69 6e 71  75 69 72 79 3c 2f 54 79  |ypes>inquiry</Ty|
00000070  70 65 73 3e 3c 2f 50 72  6f 62 65 3e              |pes></Probe>|

Unrecognised

28 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 28

Latest Unrecognised datagram, to 37020/udp

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

Destination ports

37020/udp35

Networks

AS209588 Flyservers S.A. from 1 source28
AS401661 EMBNEX, LLC from 1 source5
AS211298 Driftnet Ltd from 2 sources2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
141.98.83.48	AS209588 Flyservers S.A.	PA	Unrecognised	28	2026-10-11 00:31
16.5.0.234	AS401661 EMBNEX, LLC	BR	SOAP	5	2026-10-05 19:24
193.163.125.165	AS211298 Driftnet Ltd	GB	SOAP	1	2026-10-05 21:51
193.163.125.153	AS211298 Driftnet Ltd	GB	SOAP	1	2026-10-08 15:08

Latest datagrams

2026-10-11 00:31:01141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-11 00:28:31141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-11 00:15:27141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-11 00:15:26141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-10 00:33:14141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-10 00:31:44141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-10 00:29:02141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-10 00:11:53141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-09 00:34:22141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-09 00:28:39141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-09 00:23:58141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-09 00:20:58141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-08 15:08:55193.163.125.153to 37020/udpSOAPGB

<?xml version="1.0" encoding="utf-8"?><Probe><Uuid>58cea169-2391-4d2c-b259-9aff57242cd6</Uuid><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 3c 50  72 6f 62 65 3e 3c 55 75  |f-8"?><Probe><Uu|
00000030  69 64 3e 35 38 63 65 61  31 36 39 2d 32 33 39 31  |id>58cea169-2391|
00000040  2d 34 64 32 63 2d 62 32  35 39 2d 39 61 66 66 35  |-4d2c-b259-9aff5|
00000050  37 32 34 32 63 64 36 3c  2f 55 75 69 64 3e 3c 54  |7242cd6</Uuid><T|
00000060  79 70 65 73 3e 69 6e 71  75 69 72 79 3c 2f 54 79  |ypes>inquiry</Ty|
00000070  70 65 73 3e 3c 2f 50 72  6f 62 65 3e              |pes></Probe>|

2026-10-08 00:16:52141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|

2026-10-08 00:10:11141.98.83.48to 37020/udpUnrecognisedPA

<?><Probe><Types>inquiry</Types></Probe>

payload bytes

00000000  3c 3f 3e 3c 50 72 6f 62  65 3e 3c 54 79 70 65 73  |<?><Probe><Types|
00000010  3e 69 6e 71 75 69 72 79  3c 2f 54 79 70 65 73 3e  |>inquiry</Types>|
00000020  3c 2f 50 72 6f 62 65 3e                           |</Probe>|