UDP traffic

Datagrams matching country:RU sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

bittorrent from 4 sources6
sip from 1 source1
raw from 1 source1

Destination ports

39131/udp from 2 sources4
5060/udp from 2 sources2
6881/udp from 2 sources2

Networks

AS201848 Trader soft LLC from 2 sources4
AS57044 JSC ER-Telecom Holding from 1 source2
AS212913 Time-host Ltd from 1 source1
AS34267 Rostelecom from 1 source1

Countries

RU Russia8

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
212.193.59.5	AS201848 Trader soft LLC	RU	3	2026-10-05 18:27
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	2	2026-10-05 18:17
84.42.46.199	AS34267 Rostelecom	RU	1	2026-10-05 18:15
212.193.49.1	AS201848 Trader soft LLC	RU	1	2026-10-05 13:02
81.22.193.161	AS212913 Time-host Ltd	RU	1	2026-10-05 15:15

Latest datagrams

2026-10-05 18:27:06212.193.59.5to 39131/udpbittorrentRU

A·.·@i·

payload bytes

00000000  41 00 c3 11 2e 1a e7 92  00 00 00 00 00 0e 99 40  |A..............@|
00000010  69 16 00 00                                       |i...|

2026-10-05 18:17:00212.103.118.144to 6881/udpbittorrentRU
k.·I<core·
payload bytes
```
00000000  6b 2e 03 49 3c 63 6f 72  65 aa 96                 |k..I<core..|
```

2026-10-05 18:15:4984.42.46.199to 6881/udpbittorrentRU

.*C;(A)7vu ·OE·N$6@\c·H^·:1+v·8 ,|HU=q·3f->6r@·v·

payload bytes

00000000  0d 2e 2a 43 3b 28 41 29  37 76 75 20 0b 4f 45 01  |..*C;(A)7vu .OE.|
00000010  4e 24 36 40 5c 63 1e 48  5e 0f 3a 31 2b 76 02 38  |N$6@\c.H^.:1+v.8|
00000020  0d 2c 7c 48 55 3d 71 0c  33 66 2d 3e 36 72 40 04  |.,|HU=q.3f->6r@.|
00000030  17 76 11 ec                                       |.v..|

2026-10-05 17:29:34212.103.118.144to 5060/udprawRU

P.a)·x·

payload bytes

00000000  50 2e 61 29 0b 10 78 13  d4 ec                    |P.a)..x...|

2026-10-05 15:15:2381.22.193.161to 5060/udpsipRU
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 81.22.193.161:5063;branch=z9hG4bK-1071948196;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=303561666237383431336334013238383038
payload bytes

2026-10-05 13:15:48212.193.59.5to 39131/udpbittorrentRU

A·T<·@ʏ·

payload bytes

00000000  41 00 9e a0 c8 7f 54 3c  00 00 00 00 00 0e 99 40  |A.....T<.......@|
00000010  ca 8f 00 00                                       |....|

2026-10-05 13:02:24212.193.49.1to 39131/udpbittorrentRU

A·"·P'·@·

payload bytes

00000000  41 00 22 8b 50 27 e6 fa  00 00 00 00 00 0e 99 40  |A.".P'.........@|
00000010  b9 af 00 00                                       |....|

2026-10-05 12:08:13212.193.59.5to 39131/udpbittorrentRU

A·g·@·f·

payload bytes

00000000  41 00 95 b7 d6 67 e3 d3  00 00 00 00 00 0e 99 40  |A....g.........@|
00000010  0b 66 00 00                                       |.f..|