UDP traffic

Datagrams sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

1.6K

Datagrams

424

Source addresses

191

Networks

Countries

335

Destination ports

Protocols

bittorrent from 84 sources746
raw from 223 sources391
sip from 18 sources90
dns from 31 sources82
ssdp from 7 sources77
redis from 4 sources64
socks5 from 43 sources43
snmp from 19 sources43
ntp from 9 sources13
coap from 4 sources12
stun from 6 sources9
rtsp from 1 source6
soap from 2 sources4
nfs from 3 sources3
gtp_u from 3 sources3
ldap from 1 source2
quic from 2 sources2
http from 2 sources2
xdmcp from 2 sources2
google from 1 source1
tftp from 1 source1
rtp from 1 source1

Destination ports

39131/udp from 80 sources738
5060/udp from 19 sources81
1900/udp from 8 sources78
161/udp from 19 sources44
623/udp from 1 source30
53/udp from 10 sources28
137/udp from 6 sources19
443/udp from 10 sources18
123/udp from 9 sources15
500/udp from 8 sources14
5353/udp from 7 sources12
1194/udp from 9 sources12

DNS questions

62 queries and 20 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

SRV17
ANY13
A12
TXT10
PTR8
TYPE02

QUIC versions

0xfa1a1a1a1
11

Networks

AS14061 DigitalOcean, LLC from 10 sources71
AS7303 Telecom Argentina S.A. from 7 sources69
AS403005 Blatant from 1 source69
AS24961 WIIT AG from 4 sources64
AS22927 Telefonica de Argentina from 4 sources58
AS23470 ReliableSite.Net LLC from 5 sources54
AS401661 EMBNEX, LLC from 1 source53
AS12479 Orange Espagne SA from 3 sources52
AS8075 Microsoft Corporation from 46 sources50
AS398324 Censys, Inc. from 25 sources49

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
31.56.19.21	AS403005 Blatant	AE	69	2026-10-05 15:49
16.5.0.234	AS401661 EMBNEX, LLC	BR	53	2026-10-05 17:19
190.93.52.71	AS28038 SAN LUIS CTV S.A.	AR	40	2026-10-05 17:18
190.226.255.101	AS7303 Telecom Argentina S.A.	AR	35	2026-10-05 17:15
179.238.47.62	AS14593 Space Exploration Technologies Corporati	AR	31	2026-10-05 14:01
104.237.240.112	AS16628 DedFiberCo	US	30	2026-10-05 17:01
152.173.47.19	AS7418 TELEFONICA CHILE S.A.	CL	29	2026-10-05 17:09
201.177.249.71	AS22927 Telefonica de Argentina	AR	28	2026-10-05 17:15
84.121.208.222	AS6739 Vodafone Ono, S.A.	ES	26	2026-10-05 16:43
87.222.98.3	AS12479 Orange Espagne SA	ES	25	2026-10-05 13:33
181.116.176.252	AS11664 Techtel LMDS Comunicaciones Interactivas	AR	25	2026-10-05 14:33
137.184.210.250	AS14061 DigitalOcean, LLC	US	25	2026-10-05 13:50
185.243.5.243	AS23470 ReliableSite.Net LLC	HK	25	2026-10-05 17:18
131.161.82.9	AS263694 MAYAVISION S. D R.L.	HN	23	2026-10-05 12:59
172.110.223.179	AS23470 ReliableSite.Net LLC	HK	23	2026-10-05 16:59
201.79.2.46	AS14061 DigitalOcean, LLC	DE	21	2026-10-05 16:48
90.94.58.32	AS12479 Orange Espagne SA	ES	17	2026-10-05 16:49
193.111.198.241	AS24961 WIIT AG	DE	16	2026-10-05 16:27
181.42.186.74	AS27651 ENTEL CHILE S.A.	CL	16	2026-10-05 16:42
201.254.10.253	AS22927 Telefonica de Argentina	AR	16	2026-10-05 17:17

Latest datagrams

2026-10-05 17:19:53198.244.200.163to 5060/udpsipGB
INVITE sip:100@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5118;branch=z9hG4bK-1378743462;rport Content-Length: 0 From: "sipvicious"<sip:100@1.1.1.1>;tag=30356166623738343133633401313938323839373
payload bytes

2026-10-05 17:19:2016.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:18:48190.93.52.71to 39131/udpbittorrentAR

A·y·

payload bytes

00000000  41 00 8d b2 79 0e 8c 9d  00 00 00 00 00 10 00 00  |A...y...........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:44190.143.186.71to 39131/udpbittorrentGT

A·*·G·

payload bytes

00000000  41 00 1e 82 2a bd 98 1a  00 00 00 00 00 10 00 00  |A...*...........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:42190.93.52.71to 39131/udpbittorrentAR

A·x·"·

payload bytes

00000000  41 00 8d b2 78 b2 fa 22  00 00 00 00 00 10 00 00  |A...x.."........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:39190.93.52.71to 39131/udpbittorrentAR

A·x~·

payload bytes

00000000  41 00 8d b2 78 7e d8 fc  00 00 00 00 00 10 00 00  |A...x~..........|
00000010  ef cd 00 00                                       |....|

2026-10-05 17:18:38190.143.186.71to 39131/udpbittorrentGT

A·*a·G·

payload bytes

00000000  41 00 1e 82 2a 61 8b c6  00 00 00 00 00 10 00 00  |A...*a..........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:3645.185.145.66to 34086/udprawBR

·肿>·f·G·h=ѝ·;&·

payload bytes

00000000  cb e8 82 bf 3e 84 fc cd  66 ab 47 ac 07 ee 68 3d  |....>...f.G...h=|
00000010  d1 9d 04 95 3b 26 f0 bc                           |....;&..|

2026-10-05 17:18:35190.143.186.71to 39131/udpbittorrentGT

A·*3·@·G·

payload bytes

00000000  41 00 1e 82 2a 33 85 40  00 00 00 00 00 10 00 00  |A...*3.@........|
00000010  47 e2 00 00                                       |G...|

2026-10-05 17:18:23185.243.5.243to 5060/udpsipHK
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 To: <sip:100@<HONEYPOT>> From: <sip:100@<HONEYPOT>>;tag=e5f4a7981595e4f7a Via: SIP/2.0/UDP 185.243.5.243:51335;branch=z9hG4bK-d87543-816508758-1--d87543-;rport
payload bytes

2026-10-05 17:18:12190.113.88.74to 39131/udpbittorrentGT

A·(·+i·

payload bytes

00000000  41 00 e1 c5 02 7f e8 28  00 00 00 00 00 00 00 00  |A......(........|
00000010  2b 69 00 00                                       |+i..|

2026-10-05 17:17:59201.254.10.253to 39131/udpbittorrentAR

A·*W·,·

payload bytes

00000000  41 00 c6 2a 57 1e d5 de  00 00 00 00 00 10 00 00  |A..*W...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:53201.254.10.253to 39131/udpbittorrentAR

A·*V·,·

payload bytes

00000000  41 00 c6 2a 56 c2 eb ed  00 00 00 00 00 10 00 00  |A..*V...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:5116.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:17:50201.254.10.253to 39131/udpbittorrentAR

A·*V·,·

payload bytes

00000000  41 00 c6 2a 56 92 88 8a  00 00 00 00 00 10 00 00  |A..*V...........|
00000010  99 2c 00 00                                       |.,..|

2026-10-05 17:17:29190.189.32.222to 39131/udpbittorrentAR

A·;·

payload bytes

00000000  41 00 b5 b9 e2 3b eb 1a  00 00 00 00 00 10 00 00  |A....;..........|
00000010  da 1b 00 00                                       |....|

2026-10-05 17:17:23190.189.32.222to 39131/udpbittorrentAR

A·޲h·

payload bytes

00000000  41 00 b5 b9 e1 de b2 68  00 00 00 00 00 10 00 00  |A......h........|
00000010  da 1b 00 00                                       |....|

2026-10-05 17:17:20190.189.32.222to 39131/udpbittorrentAR

A·]·

payload bytes

00000000  41 00 b5 b9 e1 ac 5d b8  00 00 00 00 00 10 00 00  |A.....].........|
00000010  da 1b 00 00                                       |....|

2026-10-05 17:17:13185.243.5.243to 5060/udpsipHK
REGISTER sip:<HONEYPOT>:5060 SIP/2.0 To: <sip:100@<HONEYPOT>> From: <sip:100@<HONEYPOT>>;tag=e5f4a4721674e4f7a Via: SIP/2.0/UDP 185.243.5.243:59004;branch=z9hG4bK-d87543-520152277-1--d87543-;rport
payload bytes

2026-10-05 17:17:02190.93.52.71to 39131/udpbittorrentAR

A·r·, ·=·

payload bytes

00000000  41 00 db 0b 72 bd 2c 0a  00 00 00 00 00 10 00 00  |A...r.,.........|
00000010  dd 3d 00 00                                       |.=..|

2026-10-05 17:16:5716.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:16:56190.189.32.222to 39131/udpbittorrentAR

d1:ad2:id20:·볦·<·>·$^ ·6:target20:·볦·<·>·$^ ·e1:q9:find_node1:t4:·V·1:v4:UT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a f4 ee dc f1  |d1:ad2:id20:....|
00000010  f1 bb e9 eb b3 a6 db 3c  87 0c 3e 99 24 5e 0d 90  |.......<..>.$^..|
00000020  36 3a 74 61 72 67 65 74  32 30 3a f4 ee dc f1 f1  |6:target20:.....|
00000030  bb e9 eb b3 a6 db 3c 87  0c 3e 99 24 5e 0d 90 65  |......<..>.$^..e|
00000040  31 3a 71 39 3a 66 69 6e  64 5f 6e 6f 64 65 31 3a  |1:q9:find_node1:|
00000050  74 34 3a 11 56 00 00 31  3a 76 34 3a 55 54 b9 1f  |t4:.V..1:v4:UT..|
00000060  31 3a 79 31 3a 71 65                              |1:y1:qe|

2026-10-05 17:16:56190.93.52.71to 39131/udpbittorrentAR

A·ra·M·=·

payload bytes

00000000  41 00 db 0b 72 61 9e 4d  00 00 00 00 00 10 00 00  |A...ra.M........|
00000010  dd 3d 00 00                                       |.=..|

2026-10-05 17:16:5345.190.252.207to 39131/udpbittorrentBR

d1:ad2:id20:r·L·g·4ND·9:info_hash20:r·Jh·B·G,"· %~·e1:q9:get_peers1:t2:>·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 72 8c 80 85  |d1:ad2:id20:r...|
00000010  9c ef 80 4c a5 67 7f ee  88 14 f7 34 4e 44 a8 c8  |...L.g.....4ND..|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 72 8c  |9:info_hash20:r.|
00000030  4a 68 1b ba f4 f9 f1 42  1f 47 2c 22 8d ea 0d 25  |Jh.....B.G,"...%|
00000040  7e 92 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |~.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 3e 07  31 3a 76 34 3a 4c 54 01  |s1:t2:>.1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-05 17:16:53190.93.52.71to 39131/udpbittorrentAR

A·r-r·=·

payload bytes

00000000  41 00 db 0b 72 2d 72 bd  00 00 00 00 00 10 00 00  |A...r-r.........|
00000010  dd 3d 00 00                                       |.=..|