UDP traffic

Datagrams matching country:US sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

320

Datagrams

170

Source addresses

Networks

Countries

127

Destination ports

Protocols

raw from 115 sources197
dns from 19 sources39
sip from 7 sources17
snmp from 9 sources11
ntp from 7 sources10
bittorrent from 5 sources7
ssdp from 6 sources6
rtsp from 1 source6
stun from 5 sources5
coap from 3 sources4
ldap from 2 sources3
quic from 3 sources3
socks5 from 3 sources3
nfs from 2 sources2
gtp_u from 2 sources2
http from 2 sources2
soap from 1 source1
tftp from 1 source1
xdmcp from 1 source1

Destination ports

623/udp from 1 source30
5060/udp from 9 sources18
53/udp from 3 sources14
443/udp from 6 sources14
161/udp from 11 sources13
123/udp from 7 sources10
137/udp from 3 sources7
1900/udp from 6 sources6
389/udp from 2 sources6
2152/udp from 2 sources4
111/udp from 2 sources4
8443/udp from 4 sources4

DNS questions

23 queries and 16 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

TXT9
A7
SRV5
PTR2

QUIC versions

0xfa1a1a1a2
11

Networks

AS398324 Censys, Inc. from 33 sources60
AS8075 Microsoft Corporation from 48 sources52
AS14061 DigitalOcean, LLC from 6 sources34
AS16628 DedFiberCo from 1 source30
AS396982 Google LLC from 19 sources19
AS20052 Arbor Networks, Inc. from 9 sources15
AS215925 Vpsvault.host Ltd from 1 source15
AS202425 IP Volume inc from 6 sources14
AS10439 CariNet, Inc. from 8 sources11
AS16509 Amazon.com, Inc. from 1 source11

Countries

US United States320

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
104.237.240.112	AS16628 DedFiberCo	US	30	2026-10-05 17:01
137.184.210.250	AS14061 DigitalOcean, LLC	US	25	2026-10-05 13:50
45.198.224.251	AS215925 Vpsvault.host Ltd	US	15	2026-10-05 17:57
18.226.68.29	AS16509 Amazon.com, Inc.	US	11	2026-10-05 14:12
66.132.172.252	AS398324 Censys, Inc.	US	7	2026-10-05 17:06
66.132.172.254	AS398324 Censys, Inc.	US	7	2026-10-05 17:32
104.168.132.113	AS54290 Hostwinds LLC.	US	6	2026-10-05 12:07
135.148.29.54	AS16276 OVH SAS	US	5	2026-10-05 16:54
66.132.172.248	AS398324 Censys, Inc.	US	5	2026-10-05 18:03
185.242.226.97	AS202425 IP Volume inc	US	4	2026-10-05 16:39
185.242.226.68	AS202425 IP Volume inc	US	4	2026-10-05 18:03
104.168.140.86	AS54290 Hostwinds LLC.	US	4	2026-10-05 15:34
216.226.76.20	AS50219 Valence Technology Co.	US	3	2026-10-05 13:04
66.132.172.243	AS398324 Censys, Inc.	US	3	2026-10-05 14:02
66.132.172.249	AS398324 Censys, Inc.	US	3	2026-10-05 17:10
66.132.172.253	AS398324 Censys, Inc.	US	3	2026-10-05 17:13
146.88.240.43	AS20052 Arbor Networks, Inc.	US	3	2026-10-05 13:04
104.243.40.207	AS23470 ReliableSite.Net LLC	US	3	2026-10-05 17:40
64.23.209.80	AS14061 DigitalOcean, LLC	US	2	2026-10-05 16:38
66.132.186.239	AS398324 Censys, Inc.	US	2	2026-10-05 16:57

Latest datagrams

2026-10-05 18:05:5591.230.168.217to 111/udpnfsUS

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-05 18:05:0466.132.186.214to 17184/udpdnsUS

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 18:03:39216.25.89.113to 5351/udprawUS

·M)w'· ·+·N·

payload bytes

00000000  02 01 00 00 00 00 0e 10  00 00 00 00 00 00 00 00  |................|
00000010  00 00 ff ff 00 00 00 00  dd 4d 29 77 27 9f 09 81  |.........M)w'...|
00000020  2b e8 b6 4e 11 00 00 00  00 00 00 00 00 00 00 00  |+..N............|
00000030  00 00 00 00 00 00 ff ff  00 00 00 00              |............|

2026-10-05 18:03:27185.242.226.68to 3800/udprawUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-05 18:03:2166.132.172.248to 31212/udpldapUS

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-05 18:00:57185.242.226.62to 6881/udpbittorrentUS

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

2026-10-05 18:00:47147.185.132.84to 1604/udprawUS

·0·

payload bytes

00000000  1e 00 01 30 02 fd a8 e3  00 00 00 00 00 00 00 00  |...0............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-05 17:58:40198.235.24.202to 5351/udprawUS

payload bytes

00000000  00 00                                             |..|

2026-10-05 17:57:2145.198.224.251to 389/udprawUS

0%·c · · ·objectclass0·

payload bytes

00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

2026-10-05 17:54:50199.165.159.36to 123/udpntpUS

payload bytes

00000000  16 02 00 01 00 00 00 00  00 00 00 00              |............|

2026-10-05 17:52:02216.226.76.10to 443/udpquicUS
QUIC version 0xfa1a1a1a probe

2026-10-05 17:49:5366.132.172.236to 17186/udpdnsUS

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:46:1366.132.186.252to 523/udprawUS

DB2GETADDR·SQL09010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 39  |DB2GETADDR.SQL09|
00000010  30 31 30 00                                       |010.|

2026-10-05 17:45:0266.132.172.246to 33668/udpdnsUS

DNS response 15

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 66 01 00 00  |............f...|
00000010  5a 00 00 00 00 00 00 00  5a fe fd 29 35 2b f9 c7  |Z.......Z..)5+..|
00000020  74 a8 9a 12 bf 07 b2 7b  fd d2 b9 77 63 1f 9e 9b  |t......{...wc...|
00000030  88 94 18 18 8a 1b 64 60  61 e4 38 00 00 00 32 c0  |......d`a.8...2.|
00000040  2c cc a9 c0 ad c0 0a c0  2b c0 ac c0 09 c0 30 cc  |,.......+.....0.|
00000050  a8 c0 14 c0 2f c0 13 00  9d c0 9d 00 35 00 9c c0  |..../.......5...|
00000060  9c 00 2f 00 9f cc aa c0  9f 00 39 00 9e c0 9e 00  |../.......9.....|
00000070  33 01 00                                          |3..|

2026-10-05 17:40:48104.243.40.207to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 104.243.40.207:5083;branch=z9hG4bK-1921913984;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=63303033373639323133633401313837323
payload bytes

2026-10-05 17:40:46147.185.132.201to 64738/udprawUS

·abcdefgh

payload bytes

00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|

2026-10-05 17:36:2466.132.172.240to 38360/udprawUS
·
payload bytes
```
00000000  ff                                                |.|
```

2026-10-05 17:34:5945.198.224.251to 389/udprawUS

0%·c · · ·objectclass0·

payload bytes

00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

2026-10-05 17:34:5848.217.83.204to 161/udprawUS
MGLNDD_<HONEYPOT>_161
payload bytes

2026-10-05 17:34:2666.132.172.234to 1701/udprawUS

·f· · ·censys.io·censys.io· hi· ·

payload bytes

00000000  c8 02 00 66 00 00 00 00  00 00 00 00 80 08 00 00  |...f............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0a  00 00 00 04 00 00 00 00  |................|
00000030  00 08 00 00 00 06 06 90  80 0f 00 00 00 07 63 65  |..............ce|
00000040  6e 73 79 73 2e 69 6f 00  0f 00 00 00 08 63 65 6e  |nsys.io......cen|
00000050  73 79 73 2e 69 6f 80 08  00 00 00 09 68 69 80 08  |sys.io......hi..|
00000060  00 00 00 0a 00 08                                 |......|

2026-10-05 17:33:42104.243.40.207to 5060/udpsipUS
OPTIONS sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 104.243.40.207:5370;branch=z9hG4bK-1008862420;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=62396534353163393133633401343233393
payload bytes

2026-10-05 17:32:5466.132.172.254to 42795/udpdnsUS

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|

2026-10-05 17:32:50147.185.132.19to 1967/udprawUS

·4·՝[·P·

payload bytes

00000000  01 0f 00 34 00 00 00 00  00 04 00 10 00 00 00 00  |...4............|
00000010  d5 9d 5b eb 10 93 14 50  00 01 00 1c 00 00 00 00  |..[....P........|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00                                       |....|

2026-10-05 17:32:4445.198.224.251to 389/udprawUS

0%·c · · ·objectclass0·

payload bytes

00000000  30 25 02 01 01 63 20 04  00 0a 01 00 0a 01 00 02  |0%...c .........|
00000010  01 00 02 01 00 01 01 00  87 0b 6f 62 6a 65 63 74  |..........object|
00000020  63 6c 61 73 73 30 00                              |class0.|

2026-10-05 17:32:0966.132.224.23to 19302/udpstunUS

·!·B"d?9·(·

payload bytes

00000000  00 01 00 00 21 12 a4 42  22 64 3f 39 ba 85 0f b5  |....!..B"d?9....|
00000010  f4 28 d7 fa                                       |.(..|