UDP traffic

Datagrams sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

1.6K

Datagrams

426

Source addresses

192

Networks

Countries

336

Destination ports

Protocols

bittorrent from 84 sources749
raw from 225 sources393
sip from 18 sources91
dns from 31 sources83
ssdp from 7 sources77
redis from 4 sources64
socks5 from 43 sources43
snmp from 19 sources43
ntp from 9 sources13
coap from 4 sources12
stun from 6 sources9
rtsp from 1 source6
soap from 2 sources4
nfs from 3 sources3
gtp_u from 3 sources3
ldap from 1 source2
quic from 2 sources2
http from 2 sources2
xdmcp from 2 sources2
google from 1 source1
tftp from 1 source1
rtp from 1 source1

Destination ports

39131/udp from 80 sources741
5060/udp from 19 sources82
1900/udp from 8 sources78
161/udp from 19 sources44
623/udp from 1 source30
53/udp from 10 sources29
137/udp from 6 sources19
443/udp from 10 sources18
123/udp from 9 sources15
500/udp from 8 sources14
5353/udp from 7 sources12
1194/udp from 9 sources12

DNS questions

63 queries and 20 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

SRV17
ANY14
A12
TXT10
PTR8
TYPE02

QUIC versions

0xfa1a1a1a1
11

Networks

AS14061 DigitalOcean, LLC from 10 sources71
AS7303 Telecom Argentina S.A. from 7 sources69
AS403005 Blatant from 1 source69
AS24961 WIIT AG from 4 sources64
AS22927 Telefonica de Argentina from 4 sources61
AS23470 ReliableSite.Net LLC from 5 sources55
AS401661 EMBNEX, LLC from 1 source53
AS12479 Orange Espagne SA from 3 sources52
AS8075 Microsoft Corporation from 46 sources50
AS398324 Censys, Inc. from 25 sources49

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
31.56.19.21	AS403005 Blatant	AE	69	2026-10-05 15:49
16.5.0.234	AS401661 EMBNEX, LLC	BR	53	2026-10-05 17:19
190.93.52.71	AS28038 SAN LUIS CTV S.A.	AR	40	2026-10-05 17:18
190.226.255.101	AS7303 Telecom Argentina S.A.	AR	35	2026-10-05 17:15
179.238.47.62	AS14593 Space Exploration Technologies Corporati	AR	31	2026-10-05 14:01
104.237.240.112	AS16628 DedFiberCo	US	30	2026-10-05 17:01
152.173.47.19	AS7418 TELEFONICA CHILE S.A.	CL	29	2026-10-05 17:09
201.177.249.71	AS22927 Telefonica de Argentina	AR	28	2026-10-05 17:15
84.121.208.222	AS6739 Vodafone Ono, S.A.	ES	26	2026-10-05 16:43
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	26	2026-10-05 17:20
87.222.98.3	AS12479 Orange Espagne SA	ES	25	2026-10-05 13:33
181.116.176.252	AS11664 Techtel LMDS Comunicaciones Interactivas	AR	25	2026-10-05 14:33
137.184.210.250	AS14061 DigitalOcean, LLC	US	25	2026-10-05 13:50
131.161.82.9	AS263694 MAYAVISION S. D R.L.	HN	23	2026-10-05 12:59
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	23	2026-10-05 16:59
201.79.2.46	AS14061 DigitalOcean, LLC	DE	21	2026-10-05 16:48
90.94.58.32	AS12479 Orange Espagne SA	ES	17	2026-10-05 16:49
193.111.198.241	AS24961 WIIT AG	DE	16	2026-10-05 16:27
181.42.186.74	AS27651 ENTEL CHILE S.A.	CL	16	2026-10-05 16:42
201.254.10.253	AS22927 Telefonica de Argentina	AR	16	2026-10-05 17:17

Latest datagrams

2026-10-05 17:22:1086.129.237.184to 16214/udprawGB

·͈F·=]·4Vx҃·M·E

payload bytes

00000000  01 cd 88 46 1c 3d 5d a1  b7 00 ff ff 00 fe fe fe  |...F.=].........|
00000010  fe fd fd fd fd 12 34 56  78 d2 83 90 4d 9e 91 02  |......4Vx...M...|
00000020  45                                                |E|

2026-10-05 17:22:00205.210.31.110to 1967/udprawUS

·4·՝[·P·

payload bytes

00000000  01 0f 00 34 00 00 00 00  00 04 00 10 00 00 00 00  |...4............|
00000010  d5 9d 5b eb 10 93 14 50  00 01 00 1c 00 00 00 00  |..[....P........|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00                                       |....|

2026-10-05 17:20:58181.24.210.22to 39131/udpbittorrentAR

A·3|W·[·<·

payload bytes

00000000  41 00 9e 33 7c 57 8e 5b  00 00 00 00 00 10 00 00  |A..3|W.[........|
00000010  1c 3c 00 00                                       |.<..|

2026-10-05 17:20:52181.24.210.22to 39131/udpbittorrentAR

A·3{· %·<·

payload bytes

00000000  41 00 9e 33 7b fb 0d 25  00 00 00 00 00 10 00 00  |A..3{..%........|
00000010  1c 3c 00 00                                       |.<..|

2026-10-05 17:20:5045.135.193.115to 53/udpdnsDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-05 17:20:49181.24.210.22to 39131/udpbittorrentAR

A·3{·&·<·

payload bytes

00000000  41 00 9e 33 7b cd 26 fa  00 00 00 00 00 10 00 00  |A..3{.&.........|
00000010  1c 3c 00 00                                       |.<..|

2026-10-05 17:20:38185.243.5.243to 5060/udpsipHK
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 To: <sip:100@<HONEYPOT>> From: <sip:100@<HONEYPOT>>;tag=e5f4a8561839e4f7a Via: SIP/2.0/UDP 185.243.5.243:64454;branch=z9hG4bK-d87543-869258213-1--d87543-;rport
payload bytes
2026-10-05 17:19:53198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5118;branch=z9hG4bK-1378743462;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313938323839373
payload bytes

2026-10-05 17:19:2016.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:18:48190.93.52.71to 39131/udpbittorrentAR

A·y·

payload bytes

00000000  41 00 8d b2 79 0e 8c 9d  00 00 00 00 00 10 00 00  |A...y...........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:44190.143.186.71to 39131/udpbittorrentGT

A·*·G·

payload bytes

00000000  41 00 1e 82 2a bd 98 1a  00 00 00 00 00 10 00 00  |A...*...........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:42190.93.52.71to 39131/udpbittorrentAR

A·x·"·

payload bytes

00000000  41 00 8d b2 78 b2 fa 22  00 00 00 00 00 10 00 00  |A...x.."........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:39190.93.52.71to 39131/udpbittorrentAR

A·x~·

payload bytes

00000000  41 00 8d b2 78 7e d8 fc  00 00 00 00 00 10 00 00  |A...x~..........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:38190.143.186.71to 39131/udpbittorrentGT

A·*a·G·

payload bytes

00000000  41 00 1e 82 2a 61 8b c6  00 00 00 00 00 10 00 00  |A...*a..........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:3645.185.145.66to 34086/udprawBR

·肿>·f·G·h=ѝ·;&·

payload bytes

00000000  cb e8 82 bf 3e 84 fc cd  66 ab 47 ac 07 ee 68 3d  |....>...f.G...h=|
00000010  d1 9d 04 95 3b 26 f0 bc                           |....;&..|

2026-10-05 17:18:35190.143.186.71to 39131/udpbittorrentGT

A·*3·@·G·

payload bytes

00000000  41 00 1e 82 2a 33 85 40  00 00 00 00 00 10 00 00  |A...*3.@........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:23185.243.5.243to 5060/udpsipHK
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 To: <sip:100@<HONEYPOT>> From: <sip:100@<HONEYPOT>>;tag=e5f4a7981595e4f7a Via: SIP/2.0/UDP 185.243.5.243:51335;branch=z9hG4bK-d87543-816508758-1--d87543-;rport
payload bytes

2026-10-05 17:18:12190.113.88.74to 39131/udpbittorrentGT

A·(·+i·

payload bytes

00000000  41 00 e1 c5 02 7f e8 28  00 00 00 00 00 00 00 00  |A......(........|
00000010  2b 69 00 00                                       |+i..|

2026-10-05 17:17:59201.254.10.253to 39131/udpbittorrentAR

A·*W·,·

payload bytes

00000000  41 00 c6 2a 57 1e d5 de  00 00 00 00 00 10 00 00  |A..*W...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:53201.254.10.253to 39131/udpbittorrentAR

A·*V·,·

payload bytes

00000000  41 00 c6 2a 56 c2 eb ed  00 00 00 00 00 10 00 00  |A..*V...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:5116.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:17:50201.254.10.253to 39131/udpbittorrentAR

A·*V·,·

payload bytes

00000000  41 00 c6 2a 56 92 88 8a  00 00 00 00 00 10 00 00  |A..*V...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:29190.189.32.222to 39131/udpbittorrentAR

A·;·

payload bytes

00000000  41 00 b5 b9 e2 3b eb 1a  00 00 00 00 00 10 00 00  |A....;..........|
00000010  da 1b 00 00                                       |....|

2026-10-05 17:17:23190.189.32.222to 39131/udpbittorrentAR

A·޲h·

payload bytes

00000000  41 00 b5 b9 e1 de b2 68  00 00 00 00 00 10 00 00  |A......h........|
00000010  da 1b 00 00                                       |....|

2026-10-05 17:17:20190.189.32.222to 39131/udpbittorrentAR

A·]·

payload bytes

00000000  41 00 b5 b9 e1 ac 5d b8  00 00 00 00 00 10 00 00  |A.....].........|
00000010  da 1b 00 00                                       |....|