UDP traffic

Datagrams matching country:DE sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

133

Datagrams

Source addresses

Networks

Countries

111

Destination ports

Protocols

redis from 5 sources81
raw from 9 sources34
dns from 6 sources12
stun from 1 source2
snmp from 1 source2
rtp from 1 source1
ntp from 1 source1

Destination ports

53/udp from 2 sources5
500/udp from 1 source4
5353/udp from 2 sources4
123/udp from 2 sources4
161/udp from 1 source3
17185/udp from 1 source3
3401/udp from 1 source2
26198/udp from 1 source2
260/udp from 1 source2
10000/udp from 1 source2
3478/udp from 1 source2
5087/udp from 1 source1

DNS questions

11 queries and 1 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

Networks

AS24961 WIIT AG from 5 sources81
AS14061 DigitalOcean, LLC from 2 sources35
AS51396 Pfcloud UG (haftungsbeschrankt) from 2 sources6
AS63949 Akamai Connected Cloud from 2 sources4
AS45102 Alibaba (US) Technology Co., Ltd. from 3 sources4
AS8560 IONOS SE from 1 source1
AS3320 Deutsche Telekom AG from 1 source1
AS213877 U1 Digital Services Ltd from 1 source1

Countries

DE Germany133

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
201.79.2.46	AS14061 DigitalOcean, LLC	DE	21	2026-10-05 16:48
89.163.146.51	AS24961 WIIT AG	DE	17	2026-10-05 17:40
89.163.239.201	AS24961 WIIT AG	DE	16	2026-10-05 16:27
89.163.212.86	AS24961 WIIT AG	DE	16	2026-10-05 16:28
193.111.198.241	AS24961 WIIT AG	DE	16	2026-10-05 16:27
193.111.198.244	AS24961 WIIT AG	DE	16	2026-10-05 16:28
104.248.129.131	AS14061 DigitalOcean, LLC	DE	14	2026-10-05 16:14
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	3	2026-10-05 17:20
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	3	2026-10-05 13:31
172.104.155.101	AS63949 Akamai Connected Cloud	DE	3	2026-10-05 16:57
8.211.41.180	AS45102 Alibaba (US) Technology Co., Ltd.	DE	2	2026-10-05 14:48
217.239.14.187	AS3320 Deutsche Telekom AG	DE	1	2026-10-05 17:06
8.211.44.141	AS45102 Alibaba (US) Technology Co., Ltd.	DE	1	2026-10-05 17:39
217.160.190.176	AS8560 IONOS SE	DE	1	2026-10-05 14:59
144.31.73.73	AS213877 U1 Digital Services Ltd	DE	1	2026-10-05 16:57
8.211.45.42	AS45102 Alibaba (US) Technology Co., Ltd.	DE	1	2026-10-05 14:51
172.105.76.59	AS63949 Akamai Connected Cloud	DE	1	2026-10-05 14:19

Latest datagrams

2026-10-05 17:40:4189.163.146.51to 5085/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKa64f5545 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=81203aaf Call-ID: c3445de276d8470b CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 5080/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK11481d4d To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=9eaa7e37 Call-ID: ede40ecfc0bad2e8 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 5095/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK2bb3322a To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a0f19ece Call-ID: 3ae078b3665ec626 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 7060/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK44bc2ae4 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=6b016bb1 Call-ID: 2382f9d7a8784260 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 5070/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKe5b1b0f8 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=613bed99 Call-ID: 5f08da43d41e82bd CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 5075/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKf6d3f73a To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=d8cde54 Call-ID: 49ff3ebe72b5dc02 CSeq: 1 INFO Contact: <
payload bytes
2026-10-05 17:40:4189.163.146.51to 15090/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKb3858f14 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=c077c10a Call-ID: 57ab040b5af2ea81 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 1060/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKcc622af To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=7956e52a Call-ID: d6d184d65ee80e73 CSeq: 1 INFO Contact: <
payload bytes
2026-10-05 17:40:4189.163.146.51to 5060/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bKcd79fcdb To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=cec359e2 Call-ID: 89d0f05f18747ca2 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 35070/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK1b0bd6d1 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=856a553c Call-ID: 41bb88dd0ea3b67 CSeq: 1 INFO Contact: <
payload bytes
2026-10-05 17:40:4189.163.146.51to 5065/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK78d31e5e To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=64eaefe2 Call-ID: 6fb368e01d16e7d1 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 45060/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK83ef43ec To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=c193e66b Call-ID: 5b0ca95de6b7a526 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 25080/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK7f3d78b To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=d830b2e4 Call-ID: 858cb469ed7e4e96 CSeq: 1 INFO Contact: <
payload bytes
2026-10-05 17:40:4189.163.146.51to 1020/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK458a5fb7 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=31f046c8 Call-ID: 43b8da7f51f95f49 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 5090/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK5e78adf8 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=ec1622a3 Call-ID: d17b9092d54d311a CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 65090/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK564c4250 To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=18124ed4 Call-ID: 90616cb968362c08 CSeq: 1 INFO Contact:
payload bytes
2026-10-05 17:40:4189.163.146.51to 1029/udpredisDE
INFO sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK82e1072d To: <sip:100@1.1.1.1> From: <sip:100@1.1.1.1>;tag=a186ae63 Call-ID: 38ecc7c4d3d11445 CSeq: 1 INFO Contact:
payload bytes

2026-10-05 17:39:458.211.44.141to 123/udpdnsDE

DNS query TYPE0/CLASS0 .

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-05 17:20:5045.135.193.115to 53/udpdnsDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-05 17:06:21217.239.14.187to 4000/udprawDE
·.·mq1·
payload bytes
```
00000000  18 2e 17 6d 71 31 c0 09                           |...mq1..|
```

2026-10-05 16:57:28144.31.73.73to 8080/udprawDE

@.rYwv0C·&·J}·>_G<4> wz1u^FHs· · b·*·

payload bytes

00000000  40 2e 72 59 77 76 30 43  19 26 01 4a 7d 11 15 3e  |@.rYwv0C.&.J}..>|
00000010  5f 47 3c 34 3e 0a 77 7a  31 75 5e 46 48 73 1b 09  |_G<4>.wz1u^FHs..|
00000020  08 0d 62 00 04 12 2a 05                           |..b...*.|

2026-10-05 16:57:17172.104.155.101to 5353/udpdnsDE

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-05 16:48:53201.79.2.46to 1743/udprawDE

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-05 16:48:52201.79.2.46to 1742/udprawDE

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|

2026-10-05 16:48:51201.79.2.46to 1741/udprawDE

·t@·m·

payload bytes

00000000  c5 74 40 03 00 10 ce 6d  00 00 00 00 02 c2 00 04  |.t@....m........|
00000010  b4 84 00 00                                       |....|