UDP traffic

Datagrams matching asn:14061 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

722

Datagrams

Source addresses

Networks

Countries

160

Destination ports

Traffic by type

Service queries

80 datagrams from 27 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 34 DNS 16 SNMP 8 CLDAP 6 SSDP 5 mDNS 4 NetBIOS 3 Sun RPC 3 TFTP 1

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Other services

26 datagrams from 12 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 6 SIP 6 XDMCP 3 STUN 2 Redis 2 H323 2 RADIUS 2 OOKLA 2 RTP 1

Latest DTLS datagram, to 853/udp

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

QUIC

7 datagrams from 4 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 7

Latest QUIC datagram, to 443/udp

QUIC v1 Initial (ClientHello incomplete, 65 bytes)

Unrecognised

524 datagrams from 56 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 524

Latest Unrecognised datagram, to 1027/udp

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|

Peer-to-peer

85 datagrams from 16 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 85

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +1	16	11	28 to 54
mDNS	5353/udp	15	9	2 to 10
NTP	123/udp	34	8	556.9
SSDP	1900/udp	14	8	30.8
SNMPv2	161/udp	9	4	6.3
NetBIOS	137/udp	12	3	3.8
Portmap	111/udp	9	3	7 to 28
RIPv1	520/udp	6	3	131.24
CLDAP	389/udp	6	3	56 to 70
TFTP	69/udp	3	1	60
QOTD	17/udp	2	1	140.3
CharGEN	19/udp	1	1	358.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent62
443/udp QUIC34
123/udp NTP34
8080/udp23
5060/udp SIP21
6881/udp BitTorrent21
1194/udp OpenVPN20
53/udp DNS19
30301/udp17
500/udp IKE16
5353/udp mDNS15
1900/udp SSDP14

DNS questions

DNS record types

A7
TXT6

QUIC versions

0xbabababa4
13

Networks

AS14061 DigitalOcean, LLC from 85 sources722

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	135	2026-10-10 20:31
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	25	2026-10-09 17:23
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	25	2026-10-05 13:50
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	24	2026-10-07 00:19
159.203.67.164	AS14061 DigitalOcean, LLC	US	Unrecognised	23	2026-10-10 19:57
146.190.165.198	AS14061 DigitalOcean, LLC	US	BitTorrent	22	2026-10-09 19:41
201.79.2.46	AS14061 DigitalOcean, LLC	DE	Unrecognised	21	2026-10-05 16:48
146.190.72.24	AS14061 DigitalOcean, LLC	US	Unrecognised	20	2026-10-06 17:05
24.199.113.163	AS14061 DigitalOcean, LLC	US	BitTorrent	18	2026-10-11 03:01
165.232.89.6	AS14061 DigitalOcean, LLC	NL	Unrecognised	18	2026-10-10 00:08
64.226.83.235	AS14061 DigitalOcean, LLC	DE	Unrecognised	18	2026-10-10 22:04
68.183.18.163	AS14061 DigitalOcean, LLC	US	Unrecognised	18	2026-10-08 13:52
104.248.129.131	AS14061 DigitalOcean, LLC	DE	Unrecognised	14	2026-10-05 16:14
64.23.209.80	AS14061 DigitalOcean, LLC	US	BitTorrent	14	2026-10-10 06:52
104.236.229.227	AS14061 DigitalOcean, LLC	US	Unrecognised	14	2026-10-11 02:33
167.71.102.181	AS14061 DigitalOcean, LLC	US	Unrecognised	13	2026-10-07 13:57
134.199.209.2	AS14061 DigitalOcean, LLC	US	Unrecognised	12	2026-10-10 13:05
201.79.14.100	AS14061 DigitalOcean, LLC	DE	Unrecognised	11	2026-10-08 15:41
174.138.53.53	AS14061 DigitalOcean, LLC	US	NTP	11	2026-10-09 16:56
167.172.79.176	AS14061 DigitalOcean, LLC	SG	Unrecognised	10	2026-10-10 21:20

Latest datagrams

2026-10-11 03:01:1224.199.113.163to 39131/udpBitTorrentUS

A·t·@·z·

payload bytes

00000000  41 00 10 05 8f 74 df f7  00 00 00 00 00 0e 99 40  |A....t.........@|
00000010  97 7a 00 00                                       |.z..|

2026-10-11 02:59:07165.227.238.235to 1027/udpUnrecognisedGB

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|

2026-10-11 02:50:44204.48.22.204to 1900/udpUnrecognisedUS

L.so·?·nYZ/Y·E·-·.·h%x_·qtL>·?-·E·X·31"x4?&OQTWb=}Z·^·*L jy5i?8A^T·

payload bytes

00000000  4c 2e 73 6f 01 3f 18 6e  59 5a 2f 59 03 45 02 1d  |L.so.?.nYZ/Y.E..|
00000010  2d 1b 12 2e 08 10 68 25  78 5f 1b 03 71 74 4c 3e  |-.....h%x_..qtL>|
00000020  13 3f 2d 15 7f 45 03 58  1f 33 31 22 78 34 3f 26  |.?-..E.X.31"x4?&|
00000030  4f 51 54 57 62 3d 7d 5a  1c 18 5e 0e 0c 2a 4c 20  |OQTWb=}Z..^..*L |
00000040  6a 79 35 69 3f 38 41 5e  54 99                    |jy5i?8A^T.|

2026-10-11 02:33:54104.236.229.227to 6881/udpBitTorrentUS

D.t. ^s·&Jo· ·]·^Anb)ir·}C·/Wxy·D·

payload bytes

00000000  44 2e 74 2e 0a 5e 73 0e  26 4a 6f 17 20 10 5d 11  |D.t..^s.&Jo. .].|
00000010  5e 41 6e 62 29 69 72 05  7d 43 14 2f 57 78 79 1b  |^Anb)ir.}C./Wxy.|
00000020  44 d8                                             |D.|

2026-10-11 02:10:16165.22.145.25to 4500/udpUnrecognisedUS

·b· Jw·! "·"· ·

payload bytes

00000000  00 00 00 00 b2 62 cc f4  01 0d 4a 77 00 00 00 00  |.....b....Jw....|
00000010  00 00 00 00 21 20 22 08  00 00 00 00 00 00 01 88  |....! ".........|
00000020  22 00 00 c8 00 00 00 c4  01 01 00 16 03 00 00 0c  |"...............|
00000030  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
00000040  80 0e 00 c0 03 00 00 0c  01 00 00 0c 80 0e 01 00  |................|
00000050  03 00 00 08 01 00 00 03  03 00 00 08 03 00 00 0c  |................|
00000060  03 00 00 08 03 00 00 0d  03 00 00 08 03 00 00 0e  |................|
00000070  03 00 00 08 03 00 00 05  03 00 00 08 03 00 00 08  |................|
00000080  03 00 00 08 03 00 00 02  03 00 00 08 02 00 00 04  |................|
00000090  03 00 00 08 02 00 00 08  03 00 00 08 02 00 00 05  |................|
000000a0  03 00 00 08 02 00 00 06  03 00 00 08 02 00 00 07  |................|
000000b0  03 00 00 08 02 00 00 02  03 00 00 08 04 00 00 1f  |................|
000000c0  03 00 00 08 04 00 00 0f  03 00 00 08 04 00 00 10  |................|
000000d0  03 00 00 08 04 00 00 11  03 00 00 08 04 00 00 12  |................|
000000e0  00 00 00 08 04 00 00 0e  28 00 00 28 00 1f 00 00  |........(..(....|
000000f0  b2 1e ff ac 56 fd 06 54  bc e1 11 f5 e6 ab 7e 30  |....V..T......~0|
... 396 bytes shown in part

2026-10-11 01:23:17167.71.228.11to 4500/udpUnrecognisedIN

·FM·~a ·! "·"· ·

payload bytes

00000000  00 00 00 00 b5 99 46 4d  88 7e 61 0a 00 00 00 00  |......FM.~a.....|
00000010  00 00 00 00 21 20 22 08  00 00 00 00 00 00 01 88  |....! ".........|
00000020  22 00 00 c8 00 00 00 c4  01 01 00 16 03 00 00 0c  |"...............|
00000030  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
00000040  80 0e 00 c0 03 00 00 0c  01 00 00 0c 80 0e 01 00  |................|
00000050  03 00 00 08 01 00 00 03  03 00 00 08 03 00 00 0c  |................|
00000060  03 00 00 08 03 00 00 0d  03 00 00 08 03 00 00 0e  |................|
00000070  03 00 00 08 03 00 00 05  03 00 00 08 03 00 00 08  |................|
00000080  03 00 00 08 03 00 00 02  03 00 00 08 02 00 00 04  |................|
00000090  03 00 00 08 02 00 00 08  03 00 00 08 02 00 00 05  |................|
000000a0  03 00 00 08 02 00 00 06  03 00 00 08 02 00 00 07  |................|
000000b0  03 00 00 08 02 00 00 02  03 00 00 08 04 00 00 1f  |................|
000000c0  03 00 00 08 04 00 00 0f  03 00 00 08 04 00 00 10  |................|
000000d0  03 00 00 08 04 00 00 11  03 00 00 08 04 00 00 12  |................|
000000e0  00 00 00 08 04 00 00 0e  28 00 00 28 00 1f 00 00  |........(..(....|
000000f0  b2 1e ff ac 56 fd 06 54  bc e1 11 f5 e6 ab 7e 30  |....V..T......~0|
... 396 bytes shown in part

2026-10-11 01:07:58164.90.135.205to 8080/udpUnrecognisedUS
8·b!·+,$·
payload bytes
```
00000000  38 d1 62 21 0c 2b 2c 24  dd 00 00 00 00 00        |8.b!.+,$......|
```
2026-10-11 01:07:57164.90.135.205to 9201/udpUnrecognisedUS
8·X·X?&·
payload bytes
```
00000000  38 f6 58 0f ea 18 58 3f  26 00 00 00 00 00        |8.X...X?&.....|
```
2026-10-11 01:07:54164.90.135.205to 8443/udpUnrecognisedUS
8· ·d·
payload bytes
```
00000000  38 e8 0d f5 b3 64 de 01  fa 00 00 00 00 00        |8....d........|
```
2026-10-11 01:07:54164.90.135.205to 80/udpUnrecognisedUS
8·c·+O·N·
payload bytes
```
00000000  38 aa 63 c9 1d 2b 4f 1f  4e 00 00 00 00 00        |8.c..+O.N.....|
```
2026-10-11 01:07:52164.90.135.205to 443/udpUnrecognisedUS
8· |·
payload bytes
```
00000000  38 ca c5 d8 0a 7c ac cb  f0 00 00 00 00 00        |8....|........|
```
2026-10-11 01:07:52164.90.135.205to 1194/udpUnrecognisedUS
8·H·]·
payload bytes
```
00000000  38 f1 90 f7 ec 48 ba 5d  e8 00 00 00 00 00        |8....H.]......|
```
2026-10-11 01:07:51164.90.135.205to 8080/udpUnrecognisedUS
8·J·B·
payload bytes
```
00000000  38 cd 4a 93 19 11 42 b6  ca 00 00 00 00 00        |8.J...B.......|
```
2026-10-11 01:07:50164.90.135.205to 5555/udpUnrecognisedUS
8·Xce(!`·
payload bytes
```
00000000  38 aa 58 63 65 28 21 60  a1 00 00 00 00 00        |8.Xce(!`......|
```
2026-10-11 01:07:49164.90.135.205to 4443/udpUnrecognisedUS
8·cŃ·
payload bytes
```
00000000  38 eb 03 b6 bb 63 c5 83  aa 00 00 00 00 00        |8....c........|
```