UDP traffic
Datagrams matching asn:13489 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
1.7K
Datagrams
18
Source addresses
1
Networks
1
Countries
5
Destination ports
Traffic by type
Service queries
1 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest NetBIOS datagram, to 137/udp
payload bytes
00000000 f5 d6 00 00 00 01 00 00 00 00 00 00 20 43 4b 41 |............ CKA| 00000010 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAAAAAA| 00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 |AAAAAAAAAAAAA..!| 00000030 00 01 |..|
Unrecognised
3 datagrams from 3 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 43570/udp
payload bytes
00000000 a3 40 78 53 f7 aa 8d be 21 2d f0 9d 51 cf a7 1c |.@xS....!-..Q...| 00000010 3e e9 4b 8d 72 30 42 5e be 87 c7 42 f0 15 38 60 |>.K.r0B^...B..8`| 00000020 d0 02 e8 b2 5f 75 66 fd 3a e7 e2 83 23 f5 d5 23 |...._uf.:...#..#| 00000030 0b 8d d9 d1 e2 d6 db 1f 14 39 94 8b a8 b9 64 07 |.........9....d.| 00000040 9a dd c8 1a e7 74 65 db 06 aa 13 f1 75 e4 98 d3 |.....te.....u...| 00000050 91 d7 e0 8f c6 48 d2 7f a0 9e fd 13 e6 6b 52 07 |.....H.......kR.| 00000060 c2 68 87 8e ac 95 fe 63 ed 0f 09 9c d1 4a 90 08 |.h.....c.....J..| 00000070 79 f2 e4 bd 9c 43 20 2a 52 57 82 fe 91 4c ce 74 |y....C *RW...L.t| 00000080 4b 0f 23 ee b0 8d 37 c6 e3 6a e3 2a ea 01 4f 2c |K.#...7..j.*..O,| 00000090 7f 0a e0 da 9e 46 c0 a0 17 94 45 91 84 97 51 c5 |.....F....E...Q.| 000000a0 a3 ce 38 1f 6c 8f 6e bd fa 51 36 00 cf 0b 92 49 |..8.l.n..Q6....I| 000000b0 88 99 06 90 0b 71 da 59 4b 42 d1 eb 8d e0 c4 32 |.....q.YKB.....2| 000000c0 84 f5 aa 96 73 9c 72 1c ac 46 d0 7d 13 01 05 68 |....s.r..F.}...h| 000000d0 42 df c2 a9 0d 5f db 21 bc 98 c1 de ee 17 8c 9e |B...._.!........| 000000e0 b2 f3 0b 21 a9 e3 d3 da 37 84 05 08 be d1 c8 f6 |...!....7.......| 000000f0 b6 3a 20 88 b0 4e ab cd 0e 4f ab e9 a4 36 5e 59 |.: ..N...O...6^Y|
Peer-to-peer
1,743 datagrams from 14 sourcesFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| NetBIOS | 137/udp | 1 | 1 | 3.8 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS13489 UNE EPM TELECOMUNICACIONES S.A. from 18 sources1,747
Countries
- CO Colombia1,747
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 191.95.130.237 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 716 | 2026-10-11 00:55 |
| 181.68.24.141 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 367 | 2026-10-11 04:57 |
| 190.128.98.78 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 208 | 2026-10-11 02:48 |
| 191.95.161.175 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 157 | 2026-10-10 20:59 |
| 191.95.166.77 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 106 | 2026-10-06 22:05 |
| 179.12.253.200 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 50 | 2026-10-09 15:07 |
| 179.12.190.175 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 44 | 2026-10-09 03:25 |
| 181.133.57.152 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 32 | 2026-10-09 09:09 |
| 177.255.199.91 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 29 | 2026-10-10 23:02 |
| 190.250.102.41 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 11 | 2026-10-09 02:30 |
| 181.138.13.120 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 10 | 2026-10-08 21:13 |
| 179.14.176.164 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 8 | 2026-10-10 00:04 |
| 191.95.131.62 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 4 | 2026-10-09 04:16 |
| 191.95.52.36 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | NetBIOS | 1 | 2026-10-06 21:20 |
| 181.204.179.195 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | Unrecognised | 1 | 2026-10-07 13:32 |
| 177.253.158.104 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | Unrecognised | 1 | 2026-10-08 07:20 |
| 191.95.160.246 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | BitTorrent | 1 | 2026-10-10 23:45 |
| 181.129.101.50 | AS13489 UNE EPM TELECOMUNICACIONES S.A. | CO | Unrecognised | 1 | 2026-10-06 14:49 |
Latest datagrams
payload bytes
00000000 41 00 43 e5 34 6b 11 de 00 00 00 00 00 10 00 00 |A.C.4k..........| 00000010 59 41 00 00 |YA..|
payload bytes
00000000 41 00 43 e5 34 0d ee 9f 00 00 00 00 00 10 00 00 |A.C.4...........| 00000010 59 41 00 00 |YA..|
payload bytes
00000000 41 00 43 e5 33 dc 96 91 00 00 00 00 00 10 00 00 |A.C.3...........| 00000010 59 41 00 00 |YA..|
payload bytes
00000000 41 00 d9 66 22 e6 84 7b 00 00 00 00 00 10 00 00 |A..f"..{........| 00000010 9d 06 00 00 |....|payload bytes
00000000 41 00 d9 66 22 8a 3b be 00 00 00 00 00 10 00 00 |A..f".;.........| 00000010 9d 06 00 00 |....|
payload bytes
00000000 41 00 d9 66 22 56 72 c6 00 00 00 00 00 10 00 00 |A..f"Vr.........| 00000010 9d 06 00 00 |....|
payload bytes
00000000 41 00 56 d2 1b e0 0f 83 00 00 00 00 00 10 00 00 |A.V.............| 00000010 76 1c 00 00 |v...|
payload bytes
00000000 41 00 56 d2 1b 82 df 8a 00 00 00 00 00 10 00 00 |A.V.............| 00000010 76 1c 00 00 |v...|
payload bytes
00000000 41 00 56 d2 1b 4e 44 fd 00 00 00 00 00 10 00 00 |A.V..ND.........| 00000010 76 1c 00 00 |v...|
payload bytes
00000000 64 31 3a 61 64 32 3a 69 64 32 30 3a 94 f3 01 f1 |d1:ad2:id20:....| 00000010 f1 bb e9 eb b3 a6 db 3c 87 0c 3e 99 24 5e 0d 90 |.......<..>.$^..| 00000020 36 3a 74 61 72 67 65 74 32 30 3a 94 f3 01 f1 f1 |6:target20:.....| 00000030 bb e9 eb b3 a6 db 3c 87 0c 3e 99 24 5e 0d 90 65 |......<..>.$^..e| 00000040 31 3a 71 39 3a 66 69 6e 64 5f 6e 6f 64 65 31 3a |1:q9:find_node1:| 00000050 74 34 3a 87 0a 00 00 31 3a 76 34 3a 55 54 b8 64 |t4:....1:v4:UT.d| 00000060 31 3a 79 31 3a 71 65 |1:y1:qe|
payload bytes
00000000 41 00 63 ef 23 61 a9 6a 00 00 00 00 00 10 00 00 |A.c.#a.j........| 00000010 cf 68 00 00 |.h..|
payload bytes
00000000 41 00 63 ef 23 05 c4 1a 00 00 00 00 00 10 00 00 |A.c.#...........| 00000010 cf 68 00 00 |.h..|
payload bytes
00000000 41 00 63 ef 22 d4 cd 85 00 00 00 00 00 10 00 00 |A.c."...........| 00000010 cf 68 00 00 |.h..|
payload bytes
00000000 64 31 3a 61 64 32 3a 69 64 32 30 3a e9 6b 43 8b |d1:ad2:id20:.kC.| 00000010 bb 4d 20 3c 9e 0c f3 dc ba 02 70 86 91 3d c0 aa |.M <......p..=..| 00000020 36 3a 74 61 72 67 65 74 32 30 3a e9 6b 43 8b bb |6:target20:.kC..| 00000030 4d 20 3c 9e 0c f3 dc ba 02 70 86 91 3d c0 aa 65 |M <......p..=..e| 00000040 31 3a 71 39 3a 66 69 6e 64 5f 6e 6f 64 65 31 3a |1:q9:find_node1:| 00000050 74 34 3a ce 52 00 00 31 3a 76 34 3a 55 54 b9 1e |t4:.R..1:v4:UT..| 00000060 31 3a 79 31 3a 71 65 |1:y1:qe|
payload bytes
00000000 41 00 ef fc 1d e2 f9 a0 00 00 00 00 00 10 00 00 |A...............| 00000010 31 a1 00 00 |1...|