UDP traffic

Datagrams matching asn:211298 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

raw from 4 sources6
dns from 5 sources5
soap from 1 source3
sip from 1 source1
ntp from 1 source1

Destination ports

3702/udp from 1 source3
1396/udp from 1 source2
4500/udp from 1 source2
53/udp from 1 source1
111/udp from 1 source1
123/udp from 1 source1
443/udp from 1 source1
1194/udp from 1 source1
1701/udp from 1 source1
3391/udp from 1 source1
5060/udp from 1 source1
10443/udp from 1 source1

DNS questions

1 queries and 4 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

example.com A1

DNS record types

Networks

AS211298 Driftnet Ltd from 12 sources16

Countries

GB United Kingdom16

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
193.163.125.241	AS211298 Driftnet Ltd	GB	3	2026-10-05 14:25
193.163.125.234	AS211298 Driftnet Ltd	GB	2	2026-10-05 12:24
193.163.125.240	AS211298 Driftnet Ltd	GB	2	2026-10-05 20:22
193.163.125.232	AS211298 Driftnet Ltd	GB	1	2026-10-05 19:15
193.163.125.208	AS211298 Driftnet Ltd	GB	1	2026-10-05 12:23
193.163.125.163	AS211298 Driftnet Ltd	GB	1	2026-10-05 14:34
193.163.125.219	AS211298 Driftnet Ltd	GB	1	2026-10-05 16:38
193.163.125.244	AS211298 Driftnet Ltd	GB	1	2026-10-05 12:09
193.163.125.144	AS211298 Driftnet Ltd	GB	1	2026-10-05 16:51
193.163.125.175	AS211298 Driftnet Ltd	GB	1	2026-10-05 20:03
193.163.125.164	AS211298 Driftnet Ltd	GB	1	2026-10-05 16:23
193.163.125.230	AS211298 Driftnet Ltd	GB	1	2026-10-05 14:05

Latest datagrams

2026-10-05 20:22:35193.163.125.240to 4500/udprawGB

·u·8 ·(·(·$·

payload bytes

00000000  00 00 00 00 9d a2 84 75  d0 ee 87 1f 00 00 00 00  |.......u........|
00000010  00 00 00 00 01 10 02 00  00 00 00 00 00 00 01 38  |...............8|
00000020  0d 00 01 08 00 00 00 01  00 00 00 01 00 00 00 fc  |................|
00000030  01 01 00 07 03 00 00 28  00 01 00 00 80 01 00 07  |.......(........|
00000040  00 0c 00 04 00 00 01 00  80 02 00 05 80 03 00 01  |................|
00000050  80 04 00 14 80 0b 00 01  80 0c ff ff 03 00 00 28  |...............(|
00000060  01 01 00 00 80 01 00 07  00 0c 00 04 00 00 01 00  |................|
00000070  80 02 00 04 80 03 00 01  80 04 00 0e 80 0b 00 01  |................|
00000080  80 0c ff ff 03 00 00 24  02 01 00 00 80 01 00 07  |.......$........|
00000090  80 0c 00 80 80 02 00 02  80 03 00 01 80 04 00 02  |................|
000000a0  80 0b 00 01 80 0c ff ff  03 00 00 20 03 01 00 00  |........... ....|
000000b0  80 01 00 05 80 02 00 02  80 03 00 01 80 04 00 02  |................|
000000c0  80 0b 00 01 80 0c ff ff  03 00 00 20 04 01 00 00  |........... ....|
000000d0  80 01 00 05 80 02 00 01  80 03 00 01 80 04 00 02  |................|
000000e0  80 0b 00 01 80 0c ff ff  03 00 00 20 05 01 00 00  |........... ....|
000000f0  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 01  |................|
... 316 bytes shown in part

2026-10-05 20:22:32193.163.125.240to 4500/udprawGB

·u·! "·D"·,· ·

payload bytes

00000000  00 00 00 00 9d a2 84 75  d0 ee 87 1f 00 00 00 00  |.......u........|
00000010  00 00 00 00 21 20 22 08  00 00 00 00 00 00 02 44  |....! "........D|
00000020  22 00 01 a8 02 00 00 2c  01 01 00 04 03 00 00 0c  |"......,........|
00000030  01 00 00 0c 80 0e 01 00  03 00 00 08 02 00 00 06  |................|
00000040  03 00 00 08 03 00 00 0d  00 00 00 08 04 00 00 14  |................|
00000050  02 00 00 f0 02 01 00 1c  03 00 00 08 01 00 00 02  |................|
00000060  03 00 00 08 01 00 00 03  03 00 00 08 01 00 00 04  |................|
00000070  03 00 00 08 01 00 00 06  03 00 00 08 01 00 00 07  |................|
00000080  03 00 00 08 01 00 00 08  03 00 00 08 01 00 00 0b  |................|
00000090  03 00 00 0c 01 00 00 0c  80 0e 00 80 03 00 00 0c  |................|
000000a0  01 00 00 0c 80 0e 01 00  03 00 00 08 01 00 00 0d  |................|
000000b0  03 00 00 08 02 00 00 01  03 00 00 08 02 00 00 02  |................|
000000c0  03 00 00 08 02 00 00 05  03 00 00 08 02 00 00 06  |................|
000000d0  03 00 00 08 02 00 00 07  03 00 00 08 03 00 00 00  |................|
000000e0  03 00 00 08 03 00 00 01  03 00 00 08 03 00 00 02  |................|
000000f0  03 00 00 08 03 00 00 0c  03 00 00 08 03 00 00 0d  |................|
... 512 bytes shown in part

2026-10-05 20:03:51193.163.125.175to 1701/udprawGB

·d· · ·#·l2tpscan·driftnet· · ·

payload bytes

00000000  c8 02 00 64 00 00 00 00  00 00 00 00 80 08 00 00  |...d............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 03  |................|
00000030  80 08 00 00 00 06 01 23  80 0e 00 00 00 07 6c 32  |.......#......l2|
00000040  74 70 73 63 61 6e 80 0e  00 00 00 08 64 72 69 66  |tpscan......drif|
00000050  74 6e 65 74 80 08 00 00  00 09 0b e3 80 08 00 00  |tnet............|
00000060  00 0a 00 01                                       |....|

2026-10-05 19:15:39193.163.125.232to 3391/udpdnsGB

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd c1 25 4b d9 17  |y.......y...%K..|
00000020  62 d1 4e f5 16 e9 28 af  8f 7a ce 0f 5e 1d ed 93  |b.N...(..z..^...|
00000030  f9 97 35 c2 b4 9a 94 5a  20 c4 d2 00 00 00 18 c0  |..5....Z .......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-05 16:51:45193.163.125.144to 443/udpdnsGB

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 1d 12 8f a2 8d  |y.......y.......|
00000020  71 3e 5f 1a 7d bd 07 8b  78 fc cf 3e 08 95 de 25  |q>_.}...x..>...%|
00000030  60 95 66 bd ed a2 36 b7  e9 6f dd 00 00 00 18 c0  |`.f...6..o......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-05 16:38:45193.163.125.219to 123/udpntpGB

payload bytes

00000000  e3 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-05 16:23:20193.163.125.164to 1194/udprawGB

8ꇧ·c·p·

payload bytes

00000000  38 ea 87 a7 c4 63 0e 7f  70 00 00 00 00 00        |8....c..p.....|

2026-10-05 14:34:27193.163.125.163to 53/udpdnsGB

DNS query A example.com

payload bytes

00000000  c0 68 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.h. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

2026-10-05 14:25:30193.163.125.241to 3702/udpsoapGB

<?xml version="1.0" encoding="UTF-8"?><e:Envelope xmlns:e="http://www.w3.org/2003/05/soap-envelope" xmlns:w="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:d="http://schemas.xmlsoap.org/ws/20

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 55 54  |.0" encoding="UT|
00000020  46 2d 38 22 3f 3e 3c 65  3a 45 6e 76 65 6c 6f 70  |F-8"?><e:Envelop|
00000030  65 20 78 6d 6c 6e 73 3a  65 3d 22 68 74 74 70 3a  |e xmlns:e="http:|
00000040  2f 2f 77 77 77 2e 77 33  2e 6f 72 67 2f 32 30 30  |//www.w3.org/200|
00000050  33 2f 30 35 2f 73 6f 61  70 2d 65 6e 76 65 6c 6f  |3/05/soap-envelo|
00000060  70 65 22 20 78 6d 6c 6e  73 3a 77 3d 22 68 74 74  |pe" xmlns:w="htt|
00000070  70 3a 2f 2f 73 63 68 65  6d 61 73 2e 78 6d 6c 73  |p://schemas.xmls|
00000080  6f 61 70 2e 6f 72 67 2f  77 73 2f 32 30 30 34 2f  |oap.org/ws/2004/|
00000090  30 38 2f 61 64 64 72 65  73 73 69 6e 67 22 20 78  |08/addressing" x|
000000a0  6d 6c 6e 73 3a 64 3d 22  68 74 74 70 3a 2f 2f 73  |mlns:d="http://s|
000000b0  63 68 65 6d 61 73 2e 78  6d 6c 73 6f 61 70 2e 6f  |chemas.xmlsoap.o|
000000c0  72 67 2f 77 73 2f 32 30  30 35 2f 30 34 2f 64 69  |rg/ws/2005/04/di|
000000d0  73 63 6f 76 65 72 79 22  20 78 6d 6c 6e 73 3a 64  |scovery" xmlns:d|
000000e0  6e 3d 22 68 74 74 70 3a  2f 2f 77 77 77 2e 6f 6e  |n="http://www.on|
000000f0  76 69 66 2e 6f 72 67 2f  76 65 72 31 30 2f 6e 65  |vif.org/ver10/ne|
... 512 bytes shown in part

2026-10-05 14:25:27193.163.125.241to 3702/udpsoapGB

<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 3c 73  6f 61 70 3a 45 6e 76 65  |f-8"?><soap:Enve|
00000030  6c 6f 70 65 20 78 6d 6c  6e 73 3a 73 6f 61 70 3d  |lope xmlns:soap=|
00000040  22 68 74 74 70 3a 2f 2f  77 77 77 2e 77 33 2e 6f  |"http://www.w3.o|
00000050  72 67 2f 32 30 30 33 2f  30 35 2f 73 6f 61 70 2d  |rg/2003/05/soap-|
00000060  65 6e 76 65 6c 6f 70 65  22 20 78 6d 6c 6e 73 3a  |envelope" xmlns:|
00000070  77 73 61 3d 22 68 74 74  70 3a 2f 2f 73 63 68 65  |wsa="http://sche|
00000080  6d 61 73 2e 78 6d 6c 73  6f 61 70 2e 6f 72 67 2f  |mas.xmlsoap.org/|
00000090  77 73 2f 32 30 30 34 2f  30 38 2f 61 64 64 72 65  |ws/2004/08/addre|
000000a0  73 73 69 6e 67 22 20 78  6d 6c 6e 73 3a 77 73 64  |ssing" xmlns:wsd|
000000b0  3d 22 68 74 74 70 3a 2f  2f 73 63 68 65 6d 61 73  |="http://schemas|
000000c0  2e 78 6d 6c 73 6f 61 70  2e 6f 72 67 2f 77 73 2f  |.xmlsoap.org/ws/|
000000d0  32 30 30 35 2f 30 34 2f  64 69 73 63 6f 76 65 72  |2005/04/discover|
000000e0  79 22 20 78 6d 6c 6e 73  3a 77 73 64 70 3d 22 68  |y" xmlns:wsdp="h|
000000f0  74 74 70 3a 2f 2f 73 63  68 65 6d 61 73 2e 78 6d  |ttp://schemas.xm|
... 512 bytes shown in part

2026-10-05 14:25:24193.163.125.241to 3702/udpsoapGB

<?xml version="1.0" encoding="UTF-8"?><env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.o

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 55 54  |.0" encoding="UT|
00000020  46 2d 38 22 3f 3e 3c 65  6e 76 3a 45 6e 76 65 6c  |F-8"?><env:Envel|
00000030  6f 70 65 20 78 6d 6c 6e  73 3a 65 6e 76 3d 22 68  |ope xmlns:env="h|
00000040  74 74 70 3a 2f 2f 77 77  77 2e 77 33 2e 6f 72 67  |ttp://www.w3.org|
00000050  2f 32 30 30 33 2f 30 35  2f 73 6f 61 70 2d 65 6e  |/2003/05/soap-en|
00000060  76 65 6c 6f 70 65 22 20  78 6d 6c 6e 73 3a 77 73  |velope" xmlns:ws|
00000070  61 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |a="http://schema|
00000080  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
00000090  2f 32 30 30 34 2f 30 38  2f 61 64 64 72 65 73 73  |/2004/08/address|
000000a0  69 6e 67 22 20 78 6d 6c  6e 73 3a 77 73 64 3d 22  |ing" xmlns:wsd="|
000000b0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
000000c0  6d 6c 73 6f 61 70 2e 6f  72 67 2f 77 73 2f 32 30  |mlsoap.org/ws/20|
000000d0  30 35 2f 30 34 2f 64 69  73 63 6f 76 65 72 79 22  |05/04/discovery"|
000000e0  3e 3c 65 6e 76 3a 48 65  61 64 65 72 3e 3c 77 73  |><env:Header><ws|
000000f0  61 3a 54 6f 3e 75 72 6e  3a 73 63 68 65 6d 61 73  |a:To>urn:schemas|
... 512 bytes shown in part

2026-10-05 14:05:02193.163.125.230to 10443/udpdnsGB

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 33 2f 78 3b f6  |y.......y..3/x;.|
00000020  b4 bf fe 5f 75 ee c0 f4  78 43 33 03 f0 b2 19 9f  |..._u...xC3.....|
00000030  ed 34 b1 d8 bc 8c d2 d0  22 eb 86 00 00 00 18 c0  |.4......".......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-05 12:24:57193.163.125.234to 1396/udprawGB

payload bytes

00000000  02 08 00 00                                       |....|

2026-10-05 12:24:54193.163.125.234to 1396/udprawGB

payload bytes

00000000  01 00 00 00                                       |....|

2026-10-05 12:23:48193.163.125.208to 111/udpdnsGB

DNS response 8

payload bytes

00000000  44 d2 c7 db 00 00 00 00  00 00 00 02 00 01 86 a0  |D...............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-05 12:09:17193.163.125.244to 5060/udpsipGB
OPTIONS sip:<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 193.163.125.244:5060;rport;branch=z9hG4bKucwzzbdk Max-Forwards: 0 To: sip:<HONEYPOT> From: sip:193.163.125.244;tag=ucwzzbdk Call-ID: ucwzzbdk CSeq
payload bytes