UDP traffic

Datagrams matching asn:10439 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

132

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

54 datagrams from 24 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 20 SNMP 8 DNS 7 NetBIOS 6 SOAP 5 Sun RPC 4 CLDAP 2 CoAP 2

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Other services

14 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

GTP-C 5 SIP 4 GTP-U 3 DTLS 1 RADIUS 1

Latest GTP-C datagram, to 2123/udp

2·=·

payload bytes

00000000  32 01 00 04 00 00 00 00  0c 3d 00 00              |2........=..|

QUIC

6 datagrams from 5 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 6

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

55 datagrams from 17 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 55

Latest Unrecognised datagram, to 5006/udp

W· ·

payload bytes

00000000  57 00 00 00 00 11 11 07  00 00 ff ff 03 00 00 fe  |W...............|
00000010  03 00 00 14 00 1c 08 0a  08 00 00 00 00 00 00 00  |................|
00000020  04 01 01 01 00 00 00 00  01                       |.........|

Peer-to-peer

3 datagrams from 3 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 3

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	20	12	556.9
DNS	53/udp +1	6	5	28 to 54
WS-Discovery	3702/udp	5	5	10 to 500
SNMPv2	161/udp	9	4	6.3
NetBIOS	137/udp	6	4	3.8
Portmap	111/udp	4	4	7 to 28
CLDAP	389/udp	2	2	56 to 70
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

123/udp NTP20
10161/udp10
161/udp SNMP9
2123/udp GTP-C7
443/udp QUIC7
2152/udp GTP-U7
137/udp NetBIOS6
53/udp DNS5
3702/udp SOAP5
111/udp Sun RPC4
5060/udp SIP4
80/udp4

DNS questions

DNS record types

A5
PTR1

QUIC versions

0xfa1a1a1a6

Networks

AS10439 CariNet, Inc. from 34 sources132

Countries

US United States132

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
71.6.199.23	AS10439 CariNet, Inc.	US	Unrecognised	14	2026-10-10 13:41
71.6.233.2	AS10439 CariNet, Inc.	US	NTP	13	2026-10-06 15:50
71.6.135.131	AS10439 CariNet, Inc.	US	Unrecognised	12	2026-10-10 20:18
71.6.134.232	AS10439 CariNet, Inc.	US	Unrecognised	9	2026-10-08 20:30
71.6.134.231	AS10439 CariNet, Inc.	US	Unrecognised	8	2026-10-10 14:59
71.6.134.234	AS10439 CariNet, Inc.	US	Unrecognised	7	2026-10-10 18:55
71.6.134.228	AS10439 CariNet, Inc.	US	GTP-C	7	2026-10-11 03:26
66.240.236.119	AS10439 CariNet, Inc.	US	Unrecognised	6	2026-10-11 01:20
66.240.192.138	AS10439 CariNet, Inc.	US	Unrecognised	5	2026-10-10 11:51
71.6.134.237	AS10439 CariNet, Inc.	US	BitTorrent	5	2026-10-08 22:57
71.6.232.30	AS10439 CariNet, Inc.	US	SNMP	4	2026-10-06 03:24
71.6.134.230	AS10439 CariNet, Inc.	US	Unrecognised	4	2026-10-09 19:42
71.6.232.20	AS10439 CariNet, Inc.	US	NetBIOS	4	2026-10-07 09:01
71.6.134.236	AS10439 CariNet, Inc.	US	Unrecognised	4	2026-10-08 03:30
71.6.134.235	AS10439 CariNet, Inc.	US	Unrecognised	3	2026-10-09 13:42
71.6.232.24	AS10439 CariNet, Inc.	US	NTP	3	2026-10-07 17:13
66.240.223.214	AS10439 CariNet, Inc.	US	NTP	2	2026-10-06 05:30
71.6.165.200	AS10439 CariNet, Inc.	US	Unrecognised	2	2026-10-10 15:23
71.6.232.27	AS10439 CariNet, Inc.	US	DNS	2	2026-10-05 16:49
71.6.142.213	AS10439 CariNet, Inc.	US	NTP	2	2026-10-06 06:29

Latest datagrams

2026-10-11 03:26:4971.6.134.228to 6881/udpBitTorrentUS

d1:ad2:id20:q·vr·Ӣ·dE·PF·3F6:target20:·\·[O·h·S·зe1:q9:find_node1:t1:a1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 71 88 80 c8  |d1:ad2:id20:q...|
00000010  76 72 f1 13 d3 a2 a4 f6  64 45 c7 50 46 0c 33 46  |vr......dE.PF.3F|
00000020  36 3a 74 61 72 67 65 74  32 30 3a be f6 01 d2 c0  |6:target20:.....|
00000030  f9 b2 5c 82 05 5b 4f c6  68 e3 53 94 d2 d0 b7 65  |..\..[O.h.S....e|
00000040  31 3a 71 39 3a 66 69 6e  64 5f 6e 6f 64 65 31 3a  |1:q9:find_node1:|
00000050  74 31 3a 61 31 3a 79 31  3a 71 65                 |t1:a1:y1:qe|

2026-10-11 01:20:3466.240.236.119to 5006/udpUnrecognisedUS

W· ·

payload bytes

00000000  57 00 00 00 00 11 11 07  00 00 ff ff 03 00 00 fe  |W...............|
00000010  03 00 00 14 00 1c 08 0a  08 00 00 00 00 00 00 00  |................|
00000020  04 01 01 01 00 00 00 00  01                       |.........|

2026-10-10 20:18:3971.6.135.131to 123/udpNTPUS

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-10 18:55:4571.6.134.234to 4500/udpUnrecognisedUS

1'·8· ·\·P·$·$· ·+Qi·}|·a· ·@H·

payload bytes

00000000  31 27 fc b0 38 10 9e 89  00 00 00 00 00 00 00 00  |1'..8...........|
00000010  01 10 02 00 00 00 00 00  00 00 00 cc 0d 00 00 5c  |...............\|
00000020  00 00 00 01 00 00 00 01  00 00 00 50 01 01 00 02  |...........P....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 04 00 02 80 03 00 03  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 0e 10 00 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 04 00 02  80 03 00 03 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 0e 10  0d 00 00 18 1e 2b 51 69  |.............+Qi|
00000080  05 99 1c 7d 7c 96 fc bf  b5 87 e4 61 00 00 00 04  |...}|......a....|
00000090  0d 00 00 14 40 48 b7 d5  6e bc e8 85 25 e7 de 7f  |....@H..n...%...|
000000a0  00 d6 c2 d3 0d 00 00 14  90 cb 80 91 3e bb 69 6e  |............>.in|
000000b0  08 63 81 b5 ec 42 7b 1f  00 00 00 14 26 24 4d 38  |.c...B{.....&$M8|
000000c0  ed db 61 b3 17 2a 36 e3  d0 cf b8 19              |..a..*6.....|

2026-10-10 18:16:5671.6.134.229to 3702/udpSOAPUS

<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoa

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-10 17:59:1271.6.135.131to 389/udpCLDAPUS

0·-·c·$· · ·d·objectClass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  07 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 64 01 01 00  |............d...|
00000020  87 0b 6f 62 6a 65 63 74  43 6c 61 73 73 30 84 00  |..objectClass0..|
00000030  00 00 00                                          |...|

2026-10-10 15:23:0571.6.165.200to 626/udpUnrecognisedUS

SNQUERY: 127.0.0.1:AAAAAA:xsvr

payload bytes

00000000  53 4e 51 55 45 52 59 3a  20 31 32 37 2e 30 2e 30  |SNQUERY: 127.0.0|
00000010  2e 31 3a 41 41 41 41 41  41 3a 78 73 76 72        |.1:AAAAAA:xsvr|

2026-10-10 14:59:1871.6.134.231to 53/udpDNSUS

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

2026-10-10 13:45:2571.6.134.233to 10161/udpUnrecognisedUS

0&·public·c·0·0 ·+·

payload bytes

00000000  30 26 02 01 01 04 06 70  75 62 6c 69 63 a1 19 02  |0&.....public...|
00000010  04 dc 63 c2 9a 02 01 00  02 01 00 30 0b 30 09 06  |..c........0.0..|
00000020  05 2b 06 01 02 01 05 00                           |.+......|

2026-10-10 13:41:5571.6.199.23to 20002/udpUnrecognisedUS

·F<·

payload bytes

00000000  02 00 00 01 00 00 00 00  00 00 00 00 46 3c b5 d3  |............F<..|

2026-10-10 13:23:1971.6.134.233to 10161/udpUnrecognisedUS

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-10 11:51:0266.240.192.138to 1194/udpUnrecognisedUS
8·:·m·T
payload bytes
```
00000000  38 d9 ce 3a be f6 98 a5  6d 00 00 00 00 00 54     |8..:....m.....T|
```
2026-10-10 10:39:1366.240.205.34to 16464/udpUnrecognisedUS
·5·(·љ·o?
payload bytes
```
00000000  b8 14 35 fe 28 94 8d ab  c9 c0 d1 99 85 95 6f 3f  |..5.(.........o?|
```

2026-10-10 06:29:1966.240.192.138to 626/udpUnrecognisedUS

SNQUERY: 127.0.0.1:AAAAAA:xsvr

payload bytes

00000000  53 4e 51 55 45 52 59 3a  20 31 32 37 2e 30 2e 30  |SNQUERY: 127.0.0|
00000010  2e 31 3a 41 41 41 41 41  41 3a 78 73 76 72        |.1:AAAAAA:xsvr|

2026-10-10 05:59:2566.240.192.138to 80/udpUnrecognisedUS

·'·I%

payload bytes

00000000  00 00 04 17 27 10 19 80  00 00 00 00 00 03 49 25  |....'.........I%|