UDP traffic

Datagrams matching country:FR sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

raw from 12 sources15
sip from 1 source5
socks5 from 3 sources3
dns from 2 sources3
nfs from 1 source1
gtp_u from 1 source1

Destination ports

1194/udp from 2 sources2
1434/udp from 2 sources2
137/udp from 1 source2
53/udp from 1 source1
46737/udp from 1 source1
2123/udp from 1 source1
2152/udp from 1 source1
111/udp from 1 source1
4000/udp from 1 source1
5353/udp from 1 source1
6496/udp from 1 source1
6754/udp from 1 source1

DNS questions

3 queries and 0 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

SRV2
TXT1

Networks

AS213412 ONYPHE SAS from 7 sources9
AS16276 OVH SAS from 1 source5
AS3215 Orange from 4 sources5
AS12322 Free SAS from 4 sources5
AS12876 Scaleway SAS from 1 source2
AS198545 Flex Network Sarl from 1 source2

Countries

FR France28

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
5.39.125.103	AS16276 OVH SAS	FR	5	2026-10-05 16:23
91.231.89.165	AS213412 ONYPHE SAS	FR	2	2026-10-05 14:41
91.231.89.166	AS213412 ONYPHE SAS	FR	2	2026-10-05 18:10
83.204.12.141	AS3215 Orange	FR	2	2026-10-05 18:15
217.71.127.125	AS198545 Flex Network Sarl	FR	2	2026-10-05 16:28
62.210.90.215	AS12876 Scaleway SAS	FR	2	2026-10-05 16:54
88.171.16.122	AS12322 Free SAS	FR	2	2026-10-05 15:55
88.187.33.213	AS12322 Free SAS	FR	1	2026-10-05 11:34
82.235.240.140	AS12322 Free SAS	FR	1	2026-10-05 17:00
91.231.89.89	AS213412 ONYPHE SAS	FR	1	2026-10-05 18:07
91.231.89.92	AS213412 ONYPHE SAS	FR	1	2026-10-05 18:24
90.52.184.55	AS3215 Orange	FR	1	2026-10-05 17:06
91.231.89.88	AS213412 ONYPHE SAS	FR	1	2026-10-05 14:39
91.231.89.164	AS213412 ONYPHE SAS	FR	1	2026-10-05 11:13
91.231.89.91	AS213412 ONYPHE SAS	FR	1	2026-10-05 14:55
2.11.114.114	AS3215 Orange	FR	1	2026-10-05 13:46
92.140.237.95	AS3215 Orange	FR	1	2026-10-05 17:24
82.225.133.3	AS12322 Free SAS	FR	1	2026-10-05 11:10

Latest datagrams

2026-10-05 18:24:3891.231.89.92to 1434/udprawFR

payload bytes

00000000  02                                                |.|

2026-10-05 18:15:4983.204.12.141to 6754/udprawFR

·]·ȫ·4Vx·qݣPEv{

payload bytes

00000000  01 5d 05 14 dc c8 ab ec  f2 00 ff ff 00 fe fe fe  |.]..............|
00000010  fe fd fd fd fd 12 34 56  78 1c 71 dd a3 50 45 76  |......4Vx.q..PEv|
00000020  7b                                                |{|

2026-10-05 18:10:5891.231.89.166to 2361/udprawFR

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

2026-10-05 18:07:5491.231.89.89to 111/udpnfsFR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-05 17:24:4592.140.237.95to 27946/udprawFR

·p·1L·N·W·~·

payload bytes

00000000  a7 70 a5 31 4c 1b db 1b  87 a4 86 4e 1b a6 57 dc  |.p.1L......N..W.|
00000010  7e d5                                             |~.|

2026-10-05 17:06:3690.52.184.55to 14401/udprawFR

·+14·]p·4VxO1}x%7·

payload bytes

00000000  01 2b 31 34 f2 f0 5d 70  f2 00 ff ff 00 fe fe fe  |.+14..]p........|
00000010  fe fd fd fd fd 12 34 56  78 4f 31 7d 78 25 37 19  |......4VxO1}x%7.|
00000020  0f                                                |.|

2026-10-05 17:00:4482.235.240.140to 39163/udprawFR

·(iR·4Vxg1·<·

payload bytes

00000000  01 8c c1 bc db 28 69 52  ad 00 ff ff 00 fe fe fe  |.....(iR........|
00000010  fe fd fd fd fd 12 34 56  78 67 31 f8 e3 f0 3c 13  |......4Vxg1...<.|
00000020  ba                                                |.|

2026-10-05 16:54:0162.210.90.215to 137/udpdnsFR

DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

payload bytes

00000000  b3 2d 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.-.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-05 16:28:50217.71.127.125to 4000/udprawFR

v.$ ;·

payload bytes

00000000  76 2e 24 0a 3b f1 d5                              |v.$.;..|

2026-10-05 16:23:055.39.125.103to 48769/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-856909545;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653362653831013933303333353
payload bytes
2026-10-05 16:23:055.39.125.103to 49930/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-802416268;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=313735653235653363333061013336303239393
payload bytes
2026-10-05 16:23:055.39.125.103to 50307/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-2993799883;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336334383301313435343932
payload bytes
2026-10-05 16:23:055.39.125.103to 6496/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3059551696;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565333139363001343139353732
payload bytes
2026-10-05 16:23:055.39.125.103to 50051/udpsipFR
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 5.39.125.103:5061;branch=z9hG4bK-3260274920;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=31373565323565336333383301323939303936
payload bytes

2026-10-05 15:55:5588.171.16.122to 10151/udprawFR

·p·\·<Q·4Vx·Z·%·

payload bytes

00000000  01 70 dc 5c 98 3c 51 12  bb 00 ff ff 00 fe fe fe  |.p.\.<Q.........|
00000010  fe fd fd fd fd 12 34 56  78 be d3 5a d9 f8 25 d4  |......4Vx..Z..%.|
00000020  16                                                |.|

2026-10-05 15:53:4988.171.16.122to 53686/udpsocks5FR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-05 15:43:45217.71.127.125to 5353/udprawFR

X...~·h|YU ·u3S·JnmR+49·F·Y·n·M·~Q·:·l·;r·n·

payload bytes

00000000  58 2e 2e 2e 7e 04 02 14  68 7c 59 55 20 06 75 33  |X...~...h|YU .u3|
00000010  53 13 11 4a 6e 6d 52 2b  34 39 1f 46 16 59 1f 6e  |S..JnmR+49.F.Y.n|
00000020  00 4d 1c 7e 51 1e 13 3a  1b 6c 0f 3b 72 04 6e 9b  |.M.~Q..:.l.;r.n.|
00000030  cb                                                |.|

2026-10-05 15:34:3291.231.89.166to 1434/udprawFR

payload bytes

00000000  02                                                |.|

2026-10-05 15:26:0383.204.12.141to 46565/udprawFR

·aǡ w·F·4Vx·;· ·

payload bytes

00000000  01 de 61 c7 a1 0a 77 b1  46 00 ff ff 00 fe fe fe  |..a...w.F.......|
00000010  fe fd fd fd fd 12 34 56  78 cd 3b c6 10 0d ee ee  |......4Vx.;.....|
00000020  83                                                |.|

2026-10-05 14:55:4391.231.89.91to 1194/udprawFR

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|

2026-10-05 14:41:5791.231.89.165to 2152/udpgtp_uFR

2·

payload bytes

00000000  32 01 00 02 00 00 00 00  00 00                    |2.........|

2026-10-05 14:39:1991.231.89.88to 53/udpdnsFR

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-05 13:46:552.11.114.114to 22566/udprawFR

·e·E·0·;·!

payload bytes

00000000  f0 a0 0f a7 65 a8 d5 f6  c4 c3 45 cd 30 0e ee 3b  |....e.....E.0..;|
00000010  9d 21                                             |.!|

2026-10-05 12:39:5162.210.90.215to 137/udpdnsFR

DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

payload bytes

00000000  58 8d 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |X........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-05 12:05:5391.231.89.165to 1194/udprawFR

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|