UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

292

Datagrams

151

Source addresses

Networks

Countries

117

Destination ports

Protocols

raw from 106 sources183
dns from 15 sources34
sip from 7 sources15
snmp from 9 sources11
ntp from 6 sources9
rtsp from 1 source6
bittorrent from 4 sources6
ssdp from 5 sources5
stun from 4 sources4
coap from 3 sources4
socks5 from 3 sources3
ldap from 1 source2
quic from 2 sources2
gtp_u from 2 sources2
http from 2 sources2
nfs from 1 source1
soap from 1 source1
tftp from 1 source1
xdmcp from 1 source1

Destination ports

623/udp from 1 source30
5060/udp from 9 sources16
53/udp from 3 sources14
443/udp from 5 sources13
161/udp from 10 sources12
123/udp from 6 sources9
137/udp from 3 sources7
1900/udp from 5 sources5
2152/udp from 2 sources4
8443/udp from 4 sources4
39131/udp from 2 sources4
500/udp from 4 sources4

DNS questions

23 queries and 11 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

TXT9
A7
SRV5
PTR2

QUIC versions

0xfa1a1a1a1
11

Networks

AS8075 Microsoft Corporation from 47 sources51
AS398324 Censys, Inc. from 25 sources49
AS14061 DigitalOcean, LLC from 6 sources34
AS16628 DedFiberCo from 1 source30
AS20052 Arbor Networks, Inc. from 9 sources15
AS396982 Google LLC from 13 sources13
AS202425 IP Volume inc from 5 sources12
AS215925 Vpsvault.host Ltd from 1 source12
AS10439 CariNet, Inc. from 8 sources11
AS16509 Amazon.com, Inc. from 1 source11

Countries

US United States292

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
104.237.240.112	AS16628 DedFiberCo	US	30	2026-10-05 17:01
137.184.210.250	AS14061 DigitalOcean, LLC	US	25	2026-10-05 13:50
45.198.224.251	AS215925 Vpsvault.host Ltd	US	12	2026-10-05 17:03
18.226.68.29	AS16509 Amazon.com, Inc.	US	11	2026-10-05 14:12
66.132.172.252	AS398324 Censys, Inc.	US	7	2026-10-05 17:06
66.132.172.254	AS398324 Censys, Inc.	US	6	2026-10-05 15:52
104.168.132.113	AS54290 Hostwinds LLC.	US	6	2026-10-05 12:07
135.148.29.54	AS16276 OVH SAS	US	5	2026-10-05 16:54
185.242.226.97	AS202425 IP Volume inc	US	4	2026-10-05 16:39
104.168.140.86	AS54290 Hostwinds LLC.	US	4	2026-10-05 15:34
66.132.172.243	AS398324 Censys, Inc.	US	3	2026-10-05 14:02
66.132.172.253	AS398324 Censys, Inc.	US	3	2026-10-05 17:13
66.132.172.249	AS398324 Censys, Inc.	US	3	2026-10-05 17:10
66.132.172.248	AS398324 Censys, Inc.	US	3	2026-10-05 16:48
185.242.226.68	AS202425 IP Volume inc	US	3	2026-10-05 17:01
146.88.240.43	AS20052 Arbor Networks, Inc.	US	3	2026-10-05 13:04
216.226.76.20	AS50219 Valence Technology Co.	US	3	2026-10-05 13:04
71.6.232.27	AS10439 CariNet, Inc.	US	2	2026-10-05 16:49
66.132.172.241	AS398324 Censys, Inc.	US	2	2026-10-05 16:39
66.132.186.218	AS398324 Censys, Inc.	US	2	2026-10-05 16:15

Latest datagrams

2026-10-05 17:24:4920.102.105.220to 161/udprawUS
MGLNDD_<HONEYPOT>_161
payload bytes

2026-10-05 17:22:17198.235.24.215to 520/udprawUS

payload bytes

00000000  01 01 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 10                           |........|

2026-10-05 17:22:00205.210.31.110to 1967/udprawUS

·4·՝[·P·

payload bytes

00000000  01 0f 00 34 00 00 00 00  00 04 00 10 00 00 00 00  |...4............|
00000010  d5 9d 5b eb 10 93 14 50  00 01 00 1c 00 00 00 00  |..[....P........|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00                                       |....|

2026-10-05 17:14:52185.242.226.65to 19/udphttpUS

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

2026-10-05 17:13:5466.132.172.253to 4826/udprawUS

xb·_?·O·! "·"· · ·

payload bytes

00000000  78 62 9a 0f 5f 3f 16 4f  00 00 00 00 00 00 00 00  |xb.._?.O........|
00000010  21 20 22 08 00 00 00 00  00 00 01 88 22 00 00 ec  |! "........."...|
00000020  00 00 00 e8 01 01 00 1c  03 00 00 08 01 00 00 01  |................|
00000030  03 00 00 08 01 00 00 02  03 00 00 08 01 00 00 03  |................|
00000040  03 00 00 08 01 00 00 04  03 00 00 08 01 00 00 06  |................|
00000050  03 00 00 08 01 00 00 07  03 00 00 08 01 00 00 08  |................|
00000060  03 00 00 08 01 00 00 09  03 00 00 08 01 00 00 0b  |................|
00000070  03 00 00 08 01 00 00 0c  03 00 00 08 01 00 00 0d  |................|
00000080  03 00 00 08 02 00 00 01  03 00 00 08 02 00 00 02  |................|
00000090  03 00 00 08 03 00 00 00  03 00 00 08 03 00 00 01  |................|
000000a0  03 00 00 08 03 00 00 02  03 00 00 08 03 00 00 03  |................|
000000b0  03 00 00 08 03 00 00 04  03 00 00 08 03 00 00 05  |................|
000000c0  03 00 00 08 04 00 00 00  03 00 00 08 04 00 00 01  |................|
000000d0  03 00 00 08 04 00 00 02  03 00 00 08 04 00 00 05  |................|
000000e0  03 00 00 08 04 00 00 0e  03 00 00 08 04 00 00 0f  |................|
000000f0  03 00 00 08 04 00 00 10  03 00 00 08 04 00 00 11  |................|
... 392 bytes shown in part

2026-10-05 17:10:1566.132.172.249to 21358/udprawUS

j·n0·k· ·^0\·P·CE·0·0·krbtgt·CE·19700101000000Z·0·

payload bytes

00000000  6a 81 6e 30 81 6b a1 03  02 01 05 a2 03 02 01 0a  |j.n0.k..........|
00000010  a4 81 5e 30 5c a0 07 03  05 00 50 00 80 00 a2 04  |..^0\.....P.....|
00000020  1b 02 43 45 a3 17 30 15  a0 03 02 01 00 a1 0e 30  |..CE..0........0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 43 45 a5 11 18  |...krbtgt..CE...|
00000040  0f 31 39 37 30 30 31 30  31 30 30 30 30 30 30 5a  |.19700101000000Z|
00000050  a7 06 02 04 03 fc f0 03  a8 17 30 15 02 01 12 02  |..........0.....|
00000060  01 11 02 01 10 02 01 17  02 01 01 02 01 03 02 01  |................|
00000070  02 0a                                             |..|

2026-10-05 17:10:15147.185.132.231to 3702/udprawUS

<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/discovery"><env:Header><

payload bytes

00000000  3c 65 6e 76 3a 45 6e 76  65 6c 6f 70 65 20 78 6d  |<env:Envelope xm|
00000010  6c 6e 73 3a 65 6e 76 3d  22 68 74 74 70 3a 2f 2f  |lns:env="http://|
00000020  77 77 77 2e 77 33 2e 6f  72 67 2f 32 30 30 33 2f  |www.w3.org/2003/|
00000030  30 35 2f 73 6f 61 70 2d  65 6e 76 65 6c 6f 70 65  |05/soap-envelope|
00000040  22 20 78 6d 6c 6e 73 3a  77 73 61 3d 22 68 74 74  |" xmlns:wsa="htt|
00000050  70 3a 2f 2f 73 63 68 65  6d 61 73 2e 78 6d 6c 73  |p://schemas.xmls|
00000060  6f 61 70 2e 6f 72 67 2f  77 73 2f 32 30 30 34 2f  |oap.org/ws/2004/|
00000070  30 38 2f 61 64 64 72 65  73 73 69 6e 67 22 20 78  |08/addressing" x|
00000080  6d 6c 6e 73 3a 77 73 64  3d 22 68 74 74 70 3a 2f  |mlns:wsd="http:/|
00000090  2f 73 63 68 65 6d 61 73  2e 78 6d 6c 73 6f 61 70  |/schemas.xmlsoap|
000000a0  2e 6f 72 67 2f 77 73 2f  32 30 30 35 2f 30 34 2f  |.org/ws/2005/04/|
000000b0  64 69 73 63 6f 76 65 72  79 22 3e 3c 65 6e 76 3a  |discovery"><env:|
000000c0  48 65 61 64 65 72 3e 3c  77 73 64 3a 41 70 70 53  |Header><wsd:AppS|
000000d0  65 71 75 65 6e 63 65 20  49 6e 73 74 61 6e 63 65  |equence Instance|
000000e0  49 64 3d 22 31 32 38 35  36 32 34 39 35 38 37 33  |Id="128562495873|
000000f0  37 22 20 4d 65 73 73 61  67 65 4e 75 6d 62 65 72  |7" MessageNumber|
... 512 bytes shown in part

2026-10-05 17:09:06147.185.132.13to 1967/udprawUS

·4·՝[·P·

payload bytes

00000000  01 0f 00 34 00 00 00 00  00 04 00 10 00 00 00 00  |...4............|
00000010  d5 9d 5b eb 10 93 14 50  00 01 00 1c 00 00 00 00  |..[....P........|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00                                       |....|

2026-10-05 17:08:1866.132.224.19to 2361/udprawUS

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

2026-10-05 17:07:1964.89.163.247to 500/udprawUS

!·

payload bytes

00000000  21 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |!...............|
00000010  01                                                |.|

2026-10-05 17:06:37199.45.154.177to 37810/udprawUS
·
payload bytes
```
00000000  ff                                                |.|
```

2026-10-05 17:06:2466.132.172.252to 41346/udprtspUS

DESCRIBE / RTSP/1.0

payload bytes

00000000  44 45 53 43 52 49 42 45  20 2f 20 52 54 53 50 2f  |DESCRIBE / RTSP/|
00000010  31 2e 30 0d 0a 0d 0a                              |1.0....|

2026-10-05 17:04:2066.132.172.249to 6301/udpdnsUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-05 17:03:3745.198.224.251to 389/udprawUS

0%·c · · ·objectclass0·

payload bytes

00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

2026-10-05 17:03:28100.29.192.4to 47808/udprawUS

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-05 17:03:1120.55.92.10to 8009/udprawUS
MGLNDD_<HONEYPOT>_8009
payload bytes

2026-10-05 17:02:0466.132.172.245to 47993/udprawUS

payload bytes

00000000  00 14 00 01 03                                    |.....|

2026-10-05 17:01:33104.237.240.112to 623/udprawUS

· ·%h·%·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 25 68 b1 25  00 00 00 08 01 00 00 00  |....%h.%........|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:28104.237.240.112to 623/udprawUS

· ·%h·%·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 25 68 b1 25  00 00 00 08 01 00 00 00  |....%h.%........|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:23104.237.240.112to 623/udprawUS

· ·%h·%·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 25 68 b1 25  00 00 00 08 01 00 00 00  |....%h.%........|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:18104.237.240.112to 623/udprawUS

· ·Ϧ·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 cf a6 a2 e1  00 00 00 08 01 00 00 00  |................|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:13104.237.240.112to 623/udprawUS

· ·Ϧ·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 cf a6 a2 e1  00 00 00 08 01 00 00 00  |................|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:09185.242.226.68to 3800/udprawUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-05 17:01:08104.237.240.112to 623/udprawUS

· ·Ϧ·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 cf a6 a2 e1  00 00 00 08 01 00 00 00  |................|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|

2026-10-05 17:01:03104.237.240.112to 623/udprawUS

· ·e·h·

payload bytes

00000000  06 00 ff 07 06 10 00 00  00 00 00 00 00 00 20 00  |.............. .|
00000010  00 00 00 00 65 19 ad 68  00 00 00 08 01 00 00 00  |....e..h........|
00000020  01 00 00 08 01 00 00 00  02 00 00 08 01 00 00 00  |................|