UDP traffic

Datagrams matching asn:14061 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

735

Datagrams

Source addresses

Networks

Countries

160

Destination ports

Traffic by type

Service queries

81 datagrams from 28 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 34 DNS 17 SNMP 8 CLDAP 6 SSDP 5 mDNS 4 NetBIOS 3 Sun RPC 3 TFTP 1

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Other services

26 datagrams from 12 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 6 SIP 6 XDMCP 3 STUN 2 Redis 2 H323 2 RADIUS 2 OOKLA 2 RTP 1

Latest DTLS datagram, to 853/udp

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

QUIC

7 datagrams from 4 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 7

Latest QUIC datagram, to 443/udp

QUIC v1 Initial (ClientHello incomplete, 65 bytes)

Unrecognised

536 datagrams from 58 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 536

Latest Unrecognised datagram, to 443/udp

8·4'·nV·

payload bytes

00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|

Peer-to-peer

85 datagrams from 16 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 85

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +1	17	12	28 to 54
mDNS	5353/udp	15	9	2 to 10
NTP	123/udp	34	8	556.9
SSDP	1900/udp	14	8	30.8
SNMPv2	161/udp	9	4	6.3
NetBIOS	137/udp	12	3	3.8
Portmap	111/udp	9	3	7 to 28
RIPv1	520/udp	6	3	131.24
CLDAP	389/udp	6	3	56 to 70
TFTP	69/udp	3	1	60
QOTD	17/udp	2	1	140.3
CharGEN	19/udp	1	1	358.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent62
443/udp QUIC36
123/udp NTP34
8080/udp25
1194/udp OpenVPN22
5060/udp SIP21
53/udp DNS21
6881/udp BitTorrent21
30301/udp17
500/udp IKE16
5353/udp mDNS15
1900/udp SSDP14

DNS questions

DNS record types

A7
TXT6

QUIC versions

0xbabababa4
13

Networks

AS14061 DigitalOcean, LLC from 87 sources735

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	135	2026-10-10 20:31
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	25	2026-10-05 13:50
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	25	2026-10-09 17:23
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	24	2026-10-07 00:19
159.203.67.164	AS14061 DigitalOcean, LLC	US	Unrecognised	23	2026-10-10 19:57
146.190.165.198	AS14061 DigitalOcean, LLC	US	BitTorrent	22	2026-10-09 19:41
201.79.2.46	AS14061 DigitalOcean, LLC	DE	Unrecognised	21	2026-10-05 16:48
146.190.72.24	AS14061 DigitalOcean, LLC	US	Unrecognised	20	2026-10-06 17:05
24.199.113.163	AS14061 DigitalOcean, LLC	US	BitTorrent	18	2026-10-11 03:01
64.226.83.235	AS14061 DigitalOcean, LLC	DE	Unrecognised	18	2026-10-10 22:04
165.232.89.6	AS14061 DigitalOcean, LLC	NL	Unrecognised	18	2026-10-10 00:08
68.183.18.163	AS14061 DigitalOcean, LLC	US	Unrecognised	18	2026-10-08 13:52
104.248.129.131	AS14061 DigitalOcean, LLC	DE	Unrecognised	14	2026-10-05 16:14
104.236.229.227	AS14061 DigitalOcean, LLC	US	Unrecognised	14	2026-10-11 02:33
64.23.209.80	AS14061 DigitalOcean, LLC	US	BitTorrent	14	2026-10-10 06:52
167.71.102.181	AS14061 DigitalOcean, LLC	US	Unrecognised	13	2026-10-07 13:57
134.199.209.2	AS14061 DigitalOcean, LLC	US	Unrecognised	12	2026-10-10 13:05
137.184.226.118	AS14061 DigitalOcean, LLC	US	Unrecognised	11	2026-10-11 03:36
174.138.53.53	AS14061 DigitalOcean, LLC	US	NTP	11	2026-10-09 16:56
201.79.14.100	AS14061 DigitalOcean, LLC	DE	Unrecognised	11	2026-10-08 15:41

Latest datagrams

2026-10-11 04:25:13165.232.177.49to 443/udpUnrecognisedIN
8·4'·nV·
payload bytes
```
00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|
```
2026-10-11 04:24:57165.232.177.49to 8080/udpUnrecognisedIN
8·0·
payload bytes
```
00000000  38 fa 30 06 b6 8a a4 13  e6 00 00 00 00 00        |8.0...........|
```
2026-10-11 04:24:41165.232.177.49to 9201/udpUnrecognisedIN
8·>·U·]·{·
payload bytes
```
00000000  38 d2 3e c9 55 a7 5d a6  7b 00 00 00 00 00        |8.>.U.].{.....|
```
2026-10-11 04:24:32165.232.177.49to 1195/udpUnrecognisedIN
8·#·P·\·
payload bytes
```
00000000  38 ba 23 c3 50 db fc a4  5c 00 00 00 00 00        |8.#.P...\.....|
```
2026-10-11 04:24:16165.232.177.49to 53/udpUnrecognisedIN
8·9·}·
payload bytes
```
00000000  38 a8 39 e2 fe 7d 87 e3  88 00 00 00 00 00        |8.9..}........|
```
2026-10-11 04:24:00165.232.177.49to 1194/udpUnrecognisedIN
8·7·^)·
payload bytes
```
00000000  38 f6 37 db fe ee 5e 29  f8 00 00 00 00 00        |8.7...^)......|
```
2026-10-11 04:15:53161.35.230.3to 443/udpUnrecognisedUS
8·*·6·
payload bytes
```
00000000  38 c7 d2 07 12 2a b5 36  17 00 00 00 00 00        |8....*.6......|
```
2026-10-11 04:15:37161.35.230.3to 8080/udpUnrecognisedUS
8·Z8NA·
payload bytes
```
00000000  38 c2 d4 c5 5a 38 4e 41  a8 00 00 00 00 00        |8...Z8NA......|
```
2026-10-11 04:15:29161.35.230.3to 9201/udpUnrecognisedUS
8·M{Lr·2·
payload bytes
```
00000000  38 bc 15 4d 7b 4c 72 9c  32 00 00 00 00 00        |8..M{Lr.2.....|
```
2026-10-11 04:15:18161.35.230.3to 1195/udpUnrecognisedUS
8·_·B·
payload bytes
```
00000000  38 8b 5f c8 f1 ad c1 9c  42 00 00 00 00 00        |8._.....B.....|
```

2026-10-11 04:14:57161.35.230.3to 53/udpDNSUS

8·ˣ·

payload bytes

00000000  38 87 ba e6 fb cb a3 93  0c 00 00 00 00 00        |8.............|

2026-10-11 04:14:41161.35.230.3to 1194/udpUnrecognisedUS
8·CR6·
payload bytes
```
00000000  38 be e2 43 52 36 f4 98  a7 00 00 00 00 00        |8..CR6........|
```
2026-10-11 03:36:26137.184.226.118to 8081/udpUnrecognisedUS
5.·j#M·|jj·c·C
payload bytes
```
00000000  35 2e 0e 6a 23 4d 05 7c  6a 6a 11 0b 63 04 43     |5..j#M.|jj..c.C|
```

2026-10-11 03:01:1224.199.113.163to 39131/udpBitTorrentUS

A·t·@·z·

payload bytes

00000000  41 00 10 05 8f 74 df f7  00 00 00 00 00 0e 99 40  |A....t.........@|
00000010  97 7a 00 00                                       |.z..|

2026-10-11 02:59:07165.227.238.235to 1027/udpUnrecognisedGB

s.G·-ncl_·:88p'N·'GH·+_(2 4·

payload bytes

00000000  73 2e 47 10 2d 6e 63 6c  5f 10 3a 38 38 70 27 4e  |s.G.-ncl_.:88p'N|
00000010  0e 27 47 48 08 17 06 2b  5f 28 32 0d 34 f9        |.'GH...+_(2.4.|