UDP traffic

Datagrams matching country:CH sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

10 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 4 NetBIOS 2 NTP 2 CLDAP 2

Latest DNS datagram, to 53/udp

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

Other services

11 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SIP 11

Latest SIP datagram, to 5060/udp

INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---c21ef9fd43737445 From: <sip:x+13977481030@0.0.0.0>;tag=3133bd76 To: <sip:90113908351673002@<HONEYPOT>:5060> Call-ID: sLRTlROFScojmA6fSCncy3.. CSeq: 15 INVITE Contact: <si

payload bytes

Unrecognised

4 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 3389/udp

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	4	2	28 to 54
NTP	123/udp	2	1	556.9
NetBIOS	139/udp	2	1	3.8
CLDAP	389/udp	2	1	56 to 70
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5060/udp SIP8
53/udp DNS4
3389/udp3
5090/udp SIP3
123/udp NTP2
139/udp NetBIOS2
389/udp CLDAP2
11211/udp Memcached1

DNS questions

www.stage TXT4

DNS record types

TXT4

Networks

AS51852 Private Layer INC from 2 sources11
AS264617 GRUPO PANAGLOBAL 15 S.A from 1 source10
AS396982 Google LLC from 2 sources4

Countries

CH Switzerland25

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.191.236.38	AS264617 GRUPO PANAGLOBAL 15 S.A	CH	NetBIOS	10	2026-10-06 16:30
179.43.167.3	AS51852 Private Layer INC	CH	SIP	8	2026-10-06 16:56
179.43.134.194	AS51852 Private Layer INC	CH	SIP	3	2026-10-06 14:05
34.65.23.20	AS396982 Google LLC	CH	DNS	2	2026-10-06 08:08
34.65.203.85	AS396982 Google LLC	CH	DNS	2	2026-10-06 08:42

Latest datagrams

2026-10-06 16:56:19179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---c21ef9fd43737445 From: <sip:x+13977481030@0.0.0.0>;tag=3133bd76 To: <sip:
payload bytes

2026-10-06 16:30:55185.191.236.38to 389/udpCLDAPCH

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 16:22:29185.191.236.38to 389/udpCLDAPCH

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 15:46:11179.43.167.3to 5060/udpSIPCH
INVITE sip:90113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:28023;branch=z9hG4bK-524287-1---02e862582da79026 From: <sip:x+13493984677@0.0.0.0>;tag=3ff17ba0 To: <sip:
payload bytes

2026-10-06 15:43:38185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 15:28:11185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 15:27:38185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 14:05:59179.43.134.194to 5090/udpSIPCH
INVITE sip:694951898964@<HONEYPOT>:5090 SIP/2.0 Via: SIP/2.0/UDP 179.43.134.194:5745;rport=5745;branch=z9hG4bK0mmYcwLfdbgfk Contact: <sip:460006170083@179.43.134.194:5745> From: "460006170083"<sip:
payload bytes
2026-10-06 13:58:09179.43.167.3to 5060/udpSIPCH
INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---999e219e64021c2f From: <sip:x+16147230292@0.0.0.0>;tag=ac6a35ad To: <sip:0
payload bytes

2026-10-06 08:42:2134.65.203.85to 53/udpDNSCH

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

2026-10-06 08:42:2134.65.203.85to 53/udpDNSCH

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

2026-10-06 08:08:4234.65.23.20to 53/udpDNSCH

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

2026-10-06 08:08:4234.65.23.20to 53/udpDNSCH

DNS query TXT/CH www.stage

payload bytes

00000000  be ef 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  05 73 74 61 67 65 00 00  10 00 03                 |.stage.....|

2026-10-06 07:33:40179.43.167.3to 5060/udpSIPCH
INVITE sip:0113908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:31620;branch=z9hG4bK-524287-1---28c38fd9e6c4b21f From: <sip:x+13493984677@0.0.0.0>;tag=4b3a893d To: <sip:0
payload bytes
2026-10-06 05:45:03179.43.167.3to 5060/udpSIPCH
INVITE sip:+3908351673002@<HONEYPOT>:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:31681;branch=z9hG4bK-524287-1---ae9b6b62c5fba465 From: <sip:x+16147230292@0.0.0.0>;tag=4224d476 To: <sip:+39
payload bytes