UDP traffic

Datagrams matching asn:12989 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

7 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

CLDAP 2 DNS 2 NTP 1 SNMP 1 SOAP 1

Latest CLDAP datagram, to 389/udp

0·-·c·$· · ·d·objectClass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  07 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 64 01 01 00  |............d...|
00000020  87 0b 6f 62 6a 65 63 74  43 6c 61 73 73 30 84 00  |..objectClass0..|
00000030  00 00 00                                          |...|

Other services

3 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 2 Redis 1

Latest DTLS datagram, to 5684/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

14 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 14

Latest Unrecognised datagram, to 44818/udp

c·j·d·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  6a 0e be 64 00 00 00 00                           |j..d....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	2	2	2 to 10
CLDAP	389/udp	2	2	56 to 70
SNMPv2	161/udp	2	2	6.3
NTP	123/udp	1	1	556.9
CharGEN	19/udp	1	1	358.8
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP2
389/udp CLDAP2
5353/udp DNS2
5684/udp DTLS2
19/udp CharGEN1
80/udp1
88/udp1
123/udp NTP1
523/udp1
623/udp IPMI1
987/udp1
1604/udp Redis1

DNS questions

_services._dns-sd._udp.local PTR2

DNS record types

PTR2

Networks

AS12989 Black HOST Ltd from 4 sources24

Countries

CA Canada24

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
86.54.31.38	AS12989 Black HOST Ltd	CA	Unrecognised	9	2026-10-10 23:38
86.54.31.32	AS12989 Black HOST Ltd	CA	Unrecognised	9	2026-10-10 05:50
86.54.31.34	AS12989 Black HOST Ltd	CA	Unrecognised	5	2026-10-10 16:20
86.54.31.40	AS12989 Black HOST Ltd	CA	CLDAP	1	2026-10-07 20:58

Latest datagrams

2026-10-10 23:38:4786.54.31.38to 3702/udpSOAPCA

<?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"><s:Header><a:Action s:mustUnderstand="1">

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 55 54  |.0" encoding="UT|
00000020  46 2d 38 22 3f 3e 3c 73  3a 45 6e 76 65 6c 6f 70  |F-8"?><s:Envelop|
00000030  65 20 78 6d 6c 6e 73 3a  73 3d 22 68 74 74 70 3a  |e xmlns:s="http:|
00000040  2f 2f 77 77 77 2e 77 33  2e 6f 72 67 2f 32 30 30  |//www.w3.org/200|
00000050  33 2f 30 35 2f 73 6f 61  70 2d 65 6e 76 65 6c 6f  |3/05/soap-envelo|
00000060  70 65 22 20 78 6d 6c 6e  73 3a 61 3d 22 68 74 74  |pe" xmlns:a="htt|
00000070  70 3a 2f 2f 73 63 68 65  6d 61 73 2e 78 6d 6c 73  |p://schemas.xmls|
00000080  6f 61 70 2e 6f 72 67 2f  77 73 2f 32 30 30 34 2f  |oap.org/ws/2004/|
00000090  30 38 2f 61 64 64 72 65  73 73 69 6e 67 22 3e 3c  |08/addressing"><|
000000a0  73 3a 48 65 61 64 65 72  3e 3c 61 3a 41 63 74 69  |s:Header><a:Acti|
000000b0  6f 6e 20 73 3a 6d 75 73  74 55 6e 64 65 72 73 74  |on s:mustUnderst|
000000c0  61 6e 64 3d 22 31 22 3e  68 74 74 70 3a 2f 2f 73  |and="1">http://s|
000000d0  63 68 65 6d 61 73 2e 78  6d 6c 73 6f 61 70 2e 6f  |chemas.xmlsoap.o|
000000e0  72 67 2f 77 73 2f 32 30  30 35 2f 30 34 2f 64 69  |rg/ws/2005/04/di|
000000f0  73 63 6f 76 65 72 79 2f  50 72 6f 62 65 3c 2f 61  |scovery/Probe</a|
... 512 bytes shown in part

2026-10-10 16:20:0886.54.31.34to 161/udpSNMPCA

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-10 05:50:2086.54.31.32to 123/udpNTPCA

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-10 02:43:5786.54.31.34to 44818/udpUnrecognisedCA

c·j·d·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  6a 0e be 64 00 00 00 00                           |j..d....|

2026-10-09 14:01:4486.54.31.32to 523/udpUnrecognisedCA

DB2GETADDR·SQL08010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 38  |DB2GETADDR.SQL08|
00000010  30 31 30 00                                       |010.|

2026-10-09 13:35:3986.54.31.38to 389/udpCLDAPCA

0·-·c·$· · ·d·objectClass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  07 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 64 01 01 00  |............d...|
00000020  87 0b 6f 62 6a 65 63 74  43 6c 61 73 73 30 84 00  |..objectClass0..|
00000030  00 00 00                                          |...|

2026-10-08 22:49:4086.54.31.38to 1604/udpRedisCA

*·2·!·

payload bytes

00000000  2a 00 01 32 02 fd a8 e3  00 00 00 00 00 00 00 00  |*..2............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 21 00 02 00  |............!...|
00000020  00 00 00 00 00 00 00 00  00 00                    |..........|

2026-10-08 21:24:2786.54.31.38to 8888/udpUnrecognisedCA
AMSNIFF
payload bytes
```
00000000  41 4d 53 4e 49 46 46                              |AMSNIFF|
```

2026-10-08 15:39:4786.54.31.34to 5353/udpDNSCA

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-08 07:11:0886.54.31.38to 161/udpUnrecognisedCA

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-08 04:15:5286.54.31.32to 623/udpUnrecognisedCA

· ·ȁ·8·

payload bytes

00000000  06 00 ff 07 00 00 00 00  00 00 00 00 00 09 20 18  |.............. .|
00000010  c8 81 00 38 8e 04 b5                              |...8...|

2026-10-08 04:11:4286.54.31.32to 80/udpUnrecognisedCA

·'·I%

payload bytes

00000000  00 00 04 17 27 10 19 80  00 00 00 00 00 03 49 25  |....'.........I%|

2026-10-08 02:12:5586.54.31.34to 2362/udpUnrecognisedCA

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

2026-10-08 00:05:5586.54.31.32to 5684/udpDTLSCA

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-07 22:31:0086.54.31.32to 5353/udpDNSCA

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|