UDP traffic

Datagrams matching asn:135377 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

110

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

36 datagrams from 12 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 23 CoAP 4 SSDP 3 NTP 2 DNS 2 CLDAP 1 SNMP 1

Latest NetBIOS datagram, to 137/udp

NetBIOS node status query *

payload bytes

00000000  6e 5d 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |n].......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Other services

15 datagrams from 15 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 3 GTP-U 3 MGCP 2 RADIUS 2 RTP 2 XDMCP 1 STUN 1 GTP-C 1

Latest DTLS datagram, to 3391/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

58 datagrams from 30 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 58

Latest Unrecognised datagram, to 162/udp

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	23	4	3.8
SSDP	1900/udp +1	3	3	30.8
Memcached	11211/udp	2	2	10,000 to 51,000
DNS	53/udp	2	1	28 to 54
NTP	123/udp	2	1	556.9
SNMPv2	161/udp	2	1	6.3
Portmap	111/udp	1	1	7 to 28
RIPv1	520/udp	1	1	131.24
CLDAP	389/udp	1	1	56 to 70

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

137/udp NetBIOS23
5683/udp CoAP4
1701/udp L2TP4
2427/udp MGCP4
443/udp QUIC3
5351/udp NAT-PMP3
53/udp DNS3
1812/udp RADIUS3
2152/udp GTP-U3
2362/udp2
44818/udp EtherNet/IP2
88/udp2

DNS questions

DNS record types

TXT1
A1

Networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 48 sources110

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
165.154.164.21	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	DE	NetBIOS	13	2026-10-08 08:08
150.107.38.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	12	2026-10-10 14:37
150.107.36.236	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	11	2026-10-10 13:29
165.154.163.10	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	8	2026-10-10 04:08
165.154.29.202	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SG	NTP	7	2026-10-05 18:58
165.154.36.245	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	NetBIOS	5	2026-10-08 08:29
165.154.162.212	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	4	2026-10-09 16:04
165.154.182.223	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	3	2026-10-07 05:01
152.32.156.136	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	IN	NetBIOS	3	2026-10-08 08:06
118.26.104.19	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	GB	CoAP	2	2026-10-06 21:40
152.32.151.121	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	2	2026-10-07 22:56
165.154.135.161	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	MGCP	2	2026-10-06 01:49
165.154.173.226	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	2	2026-10-06 13:58
165.154.40.205	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	MGCP	2	2026-10-09 07:53
118.193.57.218	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	TH	GTP-C	1	2026-10-06 09:47
152.32.207.179	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	RADIUS	1	2026-10-09 11:56
152.32.206.83	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	1	2026-10-09 17:53
118.193.39.117	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	CLDAP	1	2026-10-09 18:03
152.32.209.62	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	1	2026-10-07 03:55
152.32.235.36	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	1	2026-10-06 16:51

Latest datagrams

2026-10-11 04:22:5845.194.70.251to 162/udpUnrecognisedSC

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-11 04:22:1645.194.70.248to 1701/udpUnrecognisedSC

·<·nxn-spxn· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6e 78 6e 2d 73 70  78 6e 80 0a 00 00 00 03  |..nxn-spxn......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-10 18:55:17152.32.141.40to 2362/udpUnrecognisedNG

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

2026-10-10 18:54:45101.36.97.205to 11211/udpUnrecognisedGB
·stats
payload bytes
```
00000000  00 01 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```

2026-10-10 15:53:03165.154.41.232to 6881/udpBitTorrentHK

d1:ad2:id20:*<· ·y·o·m ·ue1:q4:ping1:t19:16261691620679300011:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 2a 3c b7 f4  |d1:ad2:id20:*<..|
00000010  1c a5 97 09 de 79 d1 6f  02 8c 00 0c 6d 0d b6 75  |.....y.o....m..u|
00000020  65 31 3a 71 34 3a 70 69  6e 67 31 3a 74 31 39 3a  |e1:q4:ping1:t19:|
00000030  31 36 32 36 31 36 39 31  36 32 30 36 37 39 33 30  |1626169162067930|
00000040  30 30 31 31 3a 79 31 3a  71 65                    |0011:y1:qe|

2026-10-10 14:37:36150.107.38.251to 32789/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 13:55:01152.32.188.207to 3391/udpDTLSHK

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-10 13:51:33165.154.41.182to 4569/udpRTPHK

payload bytes

00000000  80 00 00 00 00 00 00 00  00 00 06 1e              |............|

2026-10-10 13:29:48150.107.36.236to 32802/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:35:47150.107.36.236to 4500/udpUnrecognisedHK

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-10 09:53:02118.193.44.169to 1812/udpRADIUSHK

payload bytes

00000000  01 00 00 14 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00                                       |....|

2026-10-10 06:39:18150.107.36.236to 32790/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 04:11:18150.107.38.251to 32753/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 04:08:18165.154.163.10to 1419/udpUnrecognisedUS

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 04:05:58165.154.163.10to 32778/udpUnrecognisedUS

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|