UDP traffic

Datagrams matching asn:135377 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

CoAP 1 SNMP 1

Latest CoAP datagram, to 5683/udp

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

Other services

3 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 1 RADIUS 1 RTP 1

Latest DTLS datagram, to 3391/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

9 datagrams from 6 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 32800/udp

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	162/udp	1	1	6.3
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

162/udp2
1701/udp L2TP1
1812/udp RADIUS1
2362/udp1
3391/udp DTLS1
4500/udp IPsec NAT-T1
4569/udp RTP1
5683/udp CoAP1
6881/udp BitTorrent1
11211/udp Memcached1
32789/udp1
32790/udp1

Networks

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 11 sources15

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
150.107.36.236	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	4	2026-10-11 05:08
45.194.70.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SC	Unrecognised	2	2026-10-11 04:26
45.194.70.248	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	SC	Unrecognised	1	2026-10-11 04:22
165.154.41.232	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	BitTorrent	1	2026-10-10 15:53
150.107.38.251	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	Unrecognised	1	2026-10-10 14:37
165.154.43.179	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	CoAP	1	2026-10-11 04:59
165.154.41.182	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	RTP	1	2026-10-10 13:51
118.193.44.169	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	RADIUS	1	2026-10-10 09:53
101.36.97.205	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	GB	Unrecognised	1	2026-10-10 18:54
152.32.188.207	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	HK	DTLS	1	2026-10-10 13:55
152.32.141.40	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	NG	Unrecognised	1	2026-10-10 18:55

Latest datagrams

2026-10-11 05:08:53150.107.36.236to 32800/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 04:59:50165.154.43.179to 5683/udpCoAPHK

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

2026-10-11 04:26:3845.194.70.251to 162/udpSNMPSC

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-11 04:22:5845.194.70.251to 162/udpUnrecognisedSC

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-11 04:22:1645.194.70.248to 1701/udpUnrecognisedSC

·<·nxn-spxn· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6e 78 6e 2d 73 70  78 6e 80 0a 00 00 00 03  |..nxn-spxn......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-10 18:55:17152.32.141.40to 2362/udpUnrecognisedNG

DIGI·

payload bytes

00000000  44 49 47 49 00 01 00 06  ff ff ff ff ff ff        |DIGI..........|

2026-10-10 18:54:45101.36.97.205to 11211/udpUnrecognisedGB
·stats
payload bytes
```
00000000  00 01 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```

2026-10-10 15:53:03165.154.41.232to 6881/udpBitTorrentHK

d1:ad2:id20:*<· ·y·o·m ·ue1:q4:ping1:t19:16261691620679300011:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 2a 3c b7 f4  |d1:ad2:id20:*<..|
00000010  1c a5 97 09 de 79 d1 6f  02 8c 00 0c 6d 0d b6 75  |.....y.o....m..u|
00000020  65 31 3a 71 34 3a 70 69  6e 67 31 3a 74 31 39 3a  |e1:q4:ping1:t19:|
00000030  31 36 32 36 31 36 39 31  36 32 30 36 37 39 33 30  |1626169162067930|
00000040  30 30 31 31 3a 79 31 3a  71 65                    |0011:y1:qe|

2026-10-10 14:37:36150.107.38.251to 32789/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 13:55:01152.32.188.207to 3391/udpDTLSHK

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-10 13:51:33165.154.41.182to 4569/udpRTPHK

payload bytes

00000000  80 00 00 00 00 00 00 00  00 00 06 1e              |............|

2026-10-10 13:29:48150.107.36.236to 32802/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:35:47150.107.36.236to 4500/udpUnrecognisedHK

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-10 09:53:02118.193.44.169to 1812/udpRADIUSHK

payload bytes

00000000  01 00 00 14 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00                                       |....|

2026-10-10 06:39:18150.107.36.236to 32790/udpUnrecognisedHK

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|