HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams sent to HoneyLabs sensors over UDP in the last 30 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

19.2K

Datagrams

5.0K

Source addresses

937

Networks

98

Countries

3.8K

Destination ports

Traffic by type

Service queries

3,836 datagrams from 1.1K sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 967 DNS 892 NTP 523 SSDP 396 NetBIOS 328 Sun RPC 201 CoAP 195 TFTP 151 CLDAP 85 SOAP 72

Latest SNMP datagram, to 161/udp

0$·public·ɬ·Y·d0 0·+·

payload bytes
00000000  30 24 02 01 01 04 06 70  75 62 6c 69 63 a5 17 02  |0$.....public...|
00000010  04 c9 ac b7 59 02 01 00  02 01 64 30 09 30 07 06  |....Y.....d0.0..|
00000020  03 2b 06 01 05 00                                 |.+....|

Other services

5,122 datagrams from 1.7K sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 2,622 SOCKS5 870 DTLS 762 STUN 371 Redis 148 GTP-U 53 XDMCP 48 GTP-C 44 HTTP 31 RTSP 27

Latest SIP datagram, to 5060/udp

INVITE sip:80048525223031@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 77.110.115.168:51980;branch=z9hG4bK784180262 Max-Forwards: 70 From: <sip:1001@<HONEYPOT>>;tag=799950121 To: <sip:80048525223031@<HONEYPOT>> Call-ID: 1891530480-904677597-1959957642 CSeq: 1 INVITE Contact: <sip:1001@77.110.115.168:5

Payload bytes withheld: they contain the sensor's address.

QUIC

141 datagrams from 107 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 141

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

10,134 datagrams from 3.4K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 10,134

Latest Unrecognised datagram, to 389/udp

0%·c · · ·objectclass0·

payload bytes
00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

Peer-to-peer

62,166 datagrams from 1.0K sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 62,166

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
SNMPv2161/udp +19992686.3
DNS53/udp +376025328 to 54
NTP123/udp524222556.9
SSDP1900/udp +344017530.8
NetBIOS137/udp +33371663.8
mDNS5353/udp2051422 to 10
Memcached11211/udp +11549310,000 to 51,000
TFTP69/udp +31608160
Portmap111/udp179807 to 28
WS-Discovery3702/udp2297410 to 500
CLDAP389/udp +32026456 to 70
CharGEN19/udp8652358.8
QOTD17/udp5342140.3
RIPv1520/udp5434131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

DNS record types

QUIC clients (JA4)

QUIC transport parameters

QUIC versions

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
172.110.223.179AS23470 ReliableSite.Net LLCHKSIP7712026-10-11 03:21
77.110.115.168AS203273 NetCrafters OUUSSIP2972026-10-11 03:24
45.198.224.251AS215925 Vpsvault.host LtdUSSNMP2842026-10-11 03:20
141.98.83.48AS209588 Flyservers S.A.PAUnrecognised2722026-10-11 03:21
45.205.1.231AS215925 Vpsvault.host LtdBRUnrecognised2712026-10-11 03:13
151.243.11.230AS209630 LLC Vash Kredit BankAESNMP2612026-10-11 02:38
16.5.0.234AS401661 EMBNEX, LLCBRUnrecognised1552026-10-10 07:10
160.119.76.127AS49870 Alsycon B.V.SCSIP1532026-10-10 22:30
117.3.123.242AS7552 Viettel GroupVNUnrecognised1432026-10-11 01:49
46.101.133.66AS14061 DigitalOcean, LLCDEUnrecognised1352026-10-10 20:31
172.110.223.200AS23470 ReliableSite.Net LLCHKSIP1242026-10-11 02:45
27.68.152.94AS7552 Viettel GroupVNUnrecognised1202026-10-10 14:15
185.94.111.1AS51115 HLL LLCRUUnrecognised1152026-10-11 03:06
135.148.29.54AS16276 OVH SASUSSIP1112026-10-11 03:12
27.66.49.95AS7552 Viettel GroupVNUnrecognised892026-10-10 14:12
141.98.11.129AS209605 UAB Host BalticLTUnrecognised822026-10-11 03:24
27.67.72.112AS7552 Viettel GroupVNUnrecognised802026-10-10 13:56
45.135.193.115AS51396 Pfcloud UG (haftungsbeschrankt)DEUnrecognised752026-10-11 02:15
193.47.62.187AS216014 BestDC LimitedBGSun RPC752026-10-10 22:38
198.244.200.163AS16276 OVH SASGBSIP702026-10-11 03:05

Latest datagrams