UDP traffic

Datagrams sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

1.2K

Datagrams

372

Source addresses

168

Networks

Countries

294

Destination ports

Protocols

bittorrent from 70 sources498
raw from 190 sources303
ssdp from 7 sources77
redis from 4 sources64
dns from 29 sources62
sip from 18 sources61
snmp from 16 sources39
socks5 from 36 sources36
coap from 3 sources11
ntp from 7 sources10
stun from 5 sources7
rtsp from 1 source4
soap from 2 sources4
nfs from 3 sources3
gtp_u from 3 sources3
ldap from 1 source2
quic from 2 sources2
xdmcp from 2 sources2
google from 1 source1
tftp from 1 source1
http from 1 source1

Destination ports

39131/udp from 67 sources491
1900/udp from 8 sources78
5060/udp from 19 sources52
161/udp from 16 sources39
53/udp from 10 sources27
137/udp from 6 sources18
443/udp from 9 sources17
623/udp from 1 source15
1194/udp from 8 sources10
123/udp from 7 sources10
3702/udp from 3 sources9
500/udp from 5 sources8

DNS questions

48 queries and 14 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

SRV16
TXT10
A10
ANY8
PTR4

QUIC versions

0xfa1a1a1a1
11

Networks

AS403005 Blatant from 1 source69
AS24961 WIIT AG from 4 sources64
AS14061 DigitalOcean, LLC from 8 sources48
AS8075 Microsoft Corporation from 45 sources47
AS14593 Space Exploration Technologies Corporati from 4 sources43
AS12479 Orange Espagne SA from 3 sources40
AS398324 Censys, Inc. from 22 sources38
AS7303 Telecom Argentina S.A. from 5 sources36
AS37963 Hangzhou Alibaba Advertising Co.,Ltd. from 4 sources32
AS6739 Vodafone Ono, S.A. from 2 sources30

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
31.56.19.21	AS403005 Blatant	AE	69	2026-10-05 15:49
179.238.47.62	AS14593 Space Exploration Technologies Corporati	AR	31	2026-10-05 14:01
16.5.0.234	AS401661 EMBNEX, LLC	BR	26	2026-10-05 16:26
87.222.98.3	AS12479 Orange Espagne SA	ES	25	2026-10-05 13:33
181.116.176.252	AS11664 Techtel LMDS Comunicaciones Interactivas	AR	25	2026-10-05 14:33
137.184.210.250	AS14061 DigitalOcean, LLC	US	25	2026-10-05 13:50
131.161.82.9	AS263694 MAYAVISION S. D R.L.	HN	23	2026-10-05 12:59
190.226.255.101	AS7303 Telecom Argentina S.A.	AR	20	2026-10-05 16:32
84.121.208.222	AS6739 Vodafone Ono, S.A.	ES	20	2026-10-05 16:34
152.173.47.19	AS7418 TELEFONICA CHILE S.A.	CL	20	2026-10-05 16:33
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	20	2026-10-05 16:17
193.111.198.241	AS24961 WIIT AG	DE	16	2026-10-05 16:27
193.111.198.244	AS24961 WIIT AG	DE	16	2026-10-05 16:28
89.163.212.86	AS24961 WIIT AG	DE	16	2026-10-05 16:28
89.163.239.201	AS24961 WIIT AG	DE	16	2026-10-05 16:27
177.200.149.189	AS52793 Kelvyn Sat Comercio e telecomunicacoes L	BR	16	2026-10-05 15:24
104.237.240.112	AS16628 DedFiberCo	US	15	2026-10-05 13:16
104.248.129.131	AS14061 DigitalOcean, LLC	DE	14	2026-10-05 16:14
201.177.249.71	AS22927 Telefonica de Argentina	AR	13	2026-10-05 16:33
45.198.224.251	AS215925 Vpsvault.host Ltd	US	11	2026-10-05 16:26

Latest datagrams

2026-10-05 16:35:31181.66.128.26to 39131/udpbittorrentPE

d1:ad2:id20:Y·D·@O·j·ӫ·9:info_hash20:Y·?·f1·h·M<·gn·6e1:q9:get_peers1:t2:])1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 59 05 f1 f5  |d1:ad2:id20:Y...|
00000010  11 44 8a bb ce 40 4f b0  6a a9 0b d3 ab 8f 87 e5  |.D...@O.j.......|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 59 05  |9:info_hash20:Y.|
00000030  f3 90 3f 03 9a 66 31 12  68 07 4d 3c ff 67 6e a1  |..?..f1.h.M<.gn.|
00000040  e6 36 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |.6e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 5d 29  31 3a 76 34 3a 4c 54 01  |s1:t2:])1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-05 16:35:19189.28.65.134to 39131/udpbittorrentBO

A·a·?·

payload bytes

00000000  41 00 87 1d 95 b1 fc 61  00 00 00 00 00 10 00 00  |A......a........|
00000010  3f 9f 00 00                                       |?...|

2026-10-05 16:35:1565.49.20.122to 47808/udprawUS

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  ab 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-05 16:35:13189.28.65.134to 39131/udpbittorrentBO

A·T·?·

payload bytes

00000000  41 00 87 1d 95 54 1e c2  00 00 00 00 00 10 00 00  |A....T..........|
00000010  3f 9f 00 00                                       |?...|

2026-10-05 16:35:10189.28.65.134to 39131/udpbittorrentBO

A·"·?·

payload bytes

00000000  41 00 87 1d 95 22 a5 a2  00 00 00 00 00 10 00 00  |A...."..........|
00000010  3f 9f 00 00                                       |?...|

2026-10-05 16:34:3566.132.172.252to 19820/udprtspUS

DESCRIBE / RTSP/1.0

payload bytes

00000000  44 45 53 43 52 49 42 45  20 2f 20 52 54 53 50 2f  |DESCRIBE / RTSP/|
00000010  31 2e 30 0d 0a 0d 0a                              |1.0....|

2026-10-05 16:34:1484.121.208.222to 39131/udpbittorrentES

A·Q·;ut·

payload bytes

00000000  41 00 51 87 3b 75 74 b1  00 00 00 00 00 10 00 00  |A.Q.;ut.........|
00000010  d8 e2 00 00                                       |....|

2026-10-05 16:34:12186.18.255.4to 39131/udpbittorrentAR

A·$·,·<·

payload bytes

00000000  41 00 f3 c0 24 b4 2c fb  00 00 00 00 00 10 00 00  |A...$.,.........|
00000010  a5 3c 00 00                                       |.<..|

2026-10-05 16:34:0884.121.208.222to 39131/udpbittorrentES

A·Q·;·

payload bytes

00000000  41 00 51 87 3b 18 7f a8  00 00 00 00 00 10 00 00  |A.Q.;...........|
00000010  d8 e2 00 00                                       |....|

2026-10-05 16:34:06186.18.255.4to 39131/udpbittorrentAR

A·$Xl3·<·

payload bytes

00000000  41 00 f3 c0 24 58 6c 33  00 00 00 00 00 10 00 00  |A...$Xl3........|
00000010  a5 3c 00 00                                       |.<..|

2026-10-05 16:34:0484.121.208.222to 39131/udpbittorrentES

A·Q·:·'·

payload bytes

00000000  41 00 51 87 3a e5 9b 27  00 00 00 00 00 10 00 00  |A.Q.:..'........|
00000010  d8 e2 00 00                                       |....|

2026-10-05 16:34:03186.18.255.4to 39131/udpbittorrentAR

A·$$·p·<·

payload bytes

00000000  41 00 f3 c0 24 24 b0 70  00 00 00 00 00 10 00 00  |A...$$.p........|
00000010  a5 3c 00 00                                       |.<..|

2026-10-05 16:34:03172.174.115.124to 8443/udprawUS
MGLNDD_<HONEYPOT>_8443
payload bytes

2026-10-05 16:33:58151.243.11.230to 123/udpntpAE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00                           |...*....|

2026-10-05 16:33:52199.45.154.191to 1900/udpssdpUS

M-SEARCH * HTTP/1.1 HOST:239.255.255.250:1900 ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 32 33 39 2e 32 35  |1.1..HOST:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 41 4e  |ST:ssdp:all..MAN|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 0d 0a                                       |....|

2026-10-05 16:33:47213.37.11.189to 39131/udpbittorrentES

A·j·A5·K·

payload bytes

00000000  41 00 7f 6a 98 41 35 b2  00 00 00 00 00 10 00 00  |A..j.A5.........|
00000010  02 4b 00 00                                       |.K..|

2026-10-05 16:33:43152.173.47.19to 39131/udpbittorrentCL

A·(·)·

payload bytes

00000000  41 00 28 a2 db 29 d6 1e  00 00 00 00 00 10 00 00  |A.(..)..........|
00000010  0f 02 00 00                                       |....|

2026-10-05 16:33:41213.37.11.189to 39131/udpbittorrentES

A·j·#·K·

payload bytes

00000000  41 00 7f 6a 97 e5 23 ca  00 00 00 00 00 10 00 00  |A..j..#.........|
00000010  02 4b 00 00                                       |.K..|

2026-10-05 16:33:38213.37.11.189to 39131/udpbittorrentES

A·j·z·K·

payload bytes

00000000  41 00 7f 6a 97 b5 7a e8  00 00 00 00 00 10 00 00  |A..j..z.........|
00000010  02 4b 00 00                                       |.K..|

2026-10-05 16:33:3838.25.25.58to 39131/udpbittorrentPE

A·g·>·R9·

payload bytes

00000000  41 00 67 c5 0f 8c 3e 02  00 00 00 00 00 10 00 00  |A.g...>.........|
00000010  52 39 00 00                                       |R9..|

2026-10-05 16:33:37152.173.47.19to 39131/udpbittorrentCL

A·(·kJ·

payload bytes

00000000  41 00 28 a2 da cd 6b 4a  00 00 00 00 00 10 00 00  |A.(...kJ........|
00000010  0f 02 00 00                                       |....|

2026-10-05 16:33:35181.81.184.227to 39131/udpbittorrentAR

d1:ad2:id20:·\D·\gcl·B·*9:info_hash20:·Tt·xeZ·5·Gv2Ü*e1:q9:get_peers1:t2:C·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a b6 ff a2 95  |d1:ad2:id20:....|
00000010  5c 44 1b 9e fd e9 5c 67  63 6c a0 42 ba bd d8 2a  |\D....\gcl.B...*|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a b6 ff  |9:info_hash20:..|
00000030  a5 98 fd 54 74 ec 78 65  5a e9 35 d1 47 76 32 c3  |...Tt.xeZ.5.Gv2.|
00000040  9c 2a 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |.*e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 43 a6  31 3a 76 34 3a 4c 54 01  |s1:t2:C.1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-05 16:33:34152.173.47.19to 39131/udpbittorrentCL

A·(·ڙz·

payload bytes

00000000  41 00 28 a2 da 99 7a 9e  00 00 00 00 00 10 00 00  |A.(...z.........|
00000010  0f 02 00 00                                       |....|

2026-10-05 16:33:3238.25.25.58to 39131/udpbittorrentPE

A·g·0·=·R9·

payload bytes

00000000  41 00 67 c5 0f 30 c9 3d  00 00 00 00 00 10 00 00  |A.g..0.=........|
00000010  52 39 00 00                                       |R9..|

2026-10-05 16:33:32134.33.65.46to 8443/udprawUS
MGLNDD_<HONEYPOT>_8443
payload bytes