UDP traffic

Datagrams matching asn:14618 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

29 datagrams from 13 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 10 SNMP 7 SSDP 6 NTP 4 NetBIOS 2

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

6 datagrams from 3 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 3 SIP 3

Latest HTTP datagram, to 19/udp

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

Unrecognised

24 datagrams from 24 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 24

Latest Unrecognised datagram, to 1701/udp

·-·! "·"·`·4·-·(·Ϩ·:·(·8· P·5·5·L·8·bh·G^#·^A·>U·I·Ll·G{ǂ·q·_·O·K+X·f·4+A-z·^·"·

payload bytes

00000000  0e a3 cc e7 b5 2d a8 8d  00 00 00 00 00 00 00 00  |.....-..........|
00000010  21 20 22 08 00 00 00 00  00 00 01 a8 22 00 00 60  |! "........."..`|
00000020  02 00 00 34 01 01 08 04  0e a3 cc e7 b5 2d a8 8d  |...4.........-..|
00000030  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000040  02 00 00 05 03 00 00 08  03 00 00 0c 00 00 00 08  |................|
00000050  04 00 00 0e 00 00 00 28  02 03 04 03 cf a8 05 3a  |.......(.......:|
00000060  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000070  05 00 00 01 00 00 00 08  03 00 00 0c 28 00 01 08  |............(...|
00000080  00 0e 00 00 e8 c8 1d 38  d5 09 50 a5 35 dc c2 8a  |.......8..P.5...|
00000090  88 35 eb 4c bc 38 11 62  68 9d c8 f3 47 5e 23 13  |.5.L.8.bh...G^#.|
000000a0  1e 5e 41 7f 3e 55 96 49  00 d7 4c 6c 8e ed 10 47  |.^A.>U.I..Ll...G|
000000b0  7b c7 82 87 d0 71 f7 5f  e8 a3 4f d6 f6 b7 4b 2b  |{....q._..O...K+|
000000c0  58 a1 b2 66 f1 87 34 2b  41 2d 7a 89 cd 5e b5 22  |X..f..4+A-z..^."|
000000d0  b2 6c 99 67 81 a0 96 27  d2 53 45 2b 41 36 16 70  |.l.g...'.SE+A6.p|
000000e0  d8 4f d8 65 cc 3d 07 21  51 9c 67 a4 77 f9 2d 97  |.O.e.=.!Q.g.w.-.|
000000f0  a6 8a 09 1f fe b7 8b 21  87 da b2 58 95 d9 cb f8  |.......!...X....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	7	5	28 to 54
Memcached	11211/udp	4	4	10,000 to 51,000
SSDP	1900/udp	6	3	30.8
mDNS	5353/udp	3	3	2 to 10
SNMPv2	161/udp	7	2	6.3
NetBIOS	137/udp	2	2	3.8
NTP	123/udp	4	1	556.9
CharGEN	19/udp	3	1	358.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS7
161/udp SNMP7
1900/udp SSDP6
123/udp NTP4
1701/udp L2TP4
2000/udp4
11211/udp Memcached4
19/udp HTTP3
1434/udp MSSQL Browser3
5353/udp DNS3
44818/udp EtherNet/IP3
137/udp NetBIOS2

DNS questions

DNS record types

TXT4
PTR3
A3

Networks

AS14618 Amazon.com, Inc. from 38 sources59

Countries

US United States59

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
52.73.169.169	AS14618 Amazon.com, Inc.	US	DNS	18	2026-10-08 07:04
100.29.192.43	AS14618 Amazon.com, Inc.	US	SNMP	3	2026-10-07 15:06
100.29.192.11	AS14618 Amazon.com, Inc.	US	DNS	2	2026-10-09 19:57
100.29.192.31	AS14618 Amazon.com, Inc.	US	SIP	2	2026-10-09 07:52
100.29.192.19	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-07 22:58
100.29.192.35	AS14618 Amazon.com, Inc.	US	SSDP	1	2026-10-06 03:48
100.29.192.120	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-05 19:16
100.29.192.92	AS14618 Amazon.com, Inc.	US	DNS	1	2026-10-07 23:06
100.29.192.122	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-10 04:59
100.29.192.28	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-06 22:20
100.29.192.2	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-06 02:19
100.29.192.78	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-08 21:03
100.29.192.124	AS14618 Amazon.com, Inc.	US	SSDP	1	2026-10-10 00:46
100.29.192.5	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-10 16:10
100.29.192.27	AS14618 Amazon.com, Inc.	US	DNS	1	2026-10-06 08:07
100.29.192.13	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-07 07:09
100.29.192.91	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-05 19:16
100.29.192.109	AS14618 Amazon.com, Inc.	US	NetBIOS	1	2026-10-09 12:21
44.220.185.156	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-05 19:19
44.220.188.56	AS14618 Amazon.com, Inc.	US	Unrecognised	1	2026-10-10 13:54

Latest datagrams

2026-10-10 18:52:52100.29.192.76to 5060/udpSIPUS

OPTIONS sip:0.0.0.0 SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:5555;rport;branch=z9hG4bKI4Wxk0fAW6JUdiIrinztjsRbl Max-Forwards: 70 From: <sip:user@0.0.0.0>;tag=2TD1HQEM18jnLslO6eJb To: <sip:user@0.0.0.0> C

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 30 2e 30 2e  |OPTIONS sip:0.0.|
00000010  30 2e 30 20 53 49 50 2f  32 2e 30 0d 0a 56 69 61  |0.0 SIP/2.0..Via|
00000020  3a 20 53 49 50 2f 32 2e  30 2f 55 44 50 20 30 2e  |: SIP/2.0/UDP 0.|
00000030  30 2e 30 2e 30 3a 35 35  35 35 3b 72 70 6f 72 74  |0.0.0:5555;rport|
00000040  3b 62 72 61 6e 63 68 3d  7a 39 68 47 34 62 4b 49  |;branch=z9hG4bKI|
00000050  34 57 78 6b 30 66 41 57  36 4a 55 64 69 49 72 69  |4Wxk0fAW6JUdiIri|
00000060  6e 7a 74 6a 73 52 62 6c  0d 0a 4d 61 78 2d 46 6f  |nztjsRbl..Max-Fo|
00000070  72 77 61 72 64 73 3a 20  37 30 0d 0a 46 72 6f 6d  |rwards: 70..From|
00000080  3a 20 3c 73 69 70 3a 75  73 65 72 40 30 2e 30 2e  |: <sip:user@0.0.|
00000090  30 2e 30 3e 3b 74 61 67  3d 32 54 44 31 48 51 45  |0.0>;tag=2TD1HQE|
000000a0  4d 31 38 6a 6e 4c 73 6c  4f 36 65 4a 62 0d 0a 54  |M18jnLslO6eJb..T|
000000b0  6f 3a 20 3c 73 69 70 3a  75 73 65 72 40 30 2e 30  |o: <sip:user@0.0|
000000c0  2e 30 2e 30 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |.0.0>..Call-ID: |
000000d0  41 78 42 59 4d 77 38 38  64 49 4c 74 4b 57 33 46  |AxBYMw88dILtKW3F|
000000e0  47 57 54 68 38 69 44 42  37 34 75 74 53 47 58 32  |GWTh8iDB74utSGX2|
000000f0  42 39 68 4b 38 31 33 4c  4d 65 36 39 52 47 69 73  |B9hK813LMe69RGis|
... 468 bytes shown in part

2026-10-10 16:10:12100.29.192.88to 1701/udpUnrecognisedUS

·-·! "·"·`·4·-·(·Ϩ·:·(·8· P·5·5·L·8·bh·

payload bytes

00000000  0e a3 cc e7 b5 2d a8 8d  00 00 00 00 00 00 00 00  |.....-..........|
00000010  21 20 22 08 00 00 00 00  00 00 01 a8 22 00 00 60  |! "........."..`|
00000020  02 00 00 34 01 01 08 04  0e a3 cc e7 b5 2d a8 8d  |...4.........-..|
00000030  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000040  02 00 00 05 03 00 00 08  03 00 00 0c 00 00 00 08  |................|
00000050  04 00 00 0e 00 00 00 28  02 03 04 03 cf a8 05 3a  |.......(.......:|
00000060  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000070  05 00 00 01 00 00 00 08  03 00 00 0c 28 00 01 08  |............(...|
00000080  00 0e 00 00 e8 c8 1d 38  d5 09 50 a5 35 dc c2 8a  |.......8..P.5...|
00000090  88 35 eb 4c bc 38 11 62  68 9d c8 f3 47 5e 23 13  |.5.L.8.bh...G^#.|
000000a0  1e 5e 41 7f 3e 55 96 49  00 d7 4c 6c 8e ed 10 47  |.^A.>U.I..Ll...G|
000000b0  7b c7 82 87 d0 71 f7 5f  e8 a3 4f d6 f6 b7 4b 2b  |{....q._..O...K+|
000000c0  58 a1 b2 66 f1 87 34 2b  41 2d 7a 89 cd 5e b5 22  |X..f..4+A-z..^."|
000000d0  b2 6c 99 67 81 a0 96 27  d2 53 45 2b 41 36 16 70  |.l.g...'.SE+A6.p|
000000e0  d8 4f d8 65 cc 3d 07 21  51 9c 67 a4 77 f9 2d 97  |.O.e.=.!Q.g.w.-.|
000000f0  a6 8a 09 1f fe b7 8b 21  87 da b2 58 95 d9 cb f8  |.......!...X....|
... 424 bytes shown in part

2026-10-10 16:10:10100.29.192.5to 1701/udpUnrecognisedUS

·`· · · ·wfU·Microsoft· · ·

payload bytes

00000000  c8 02 00 60 00 00 00 00  00 00 00 00 80 08 00 00  |...`............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 01 80 0a  00 00 00 04 00 00 00 00  |................|
00000030  00 08 00 00 00 06 05 00  80 09 00 00 00 07 77 66  |..............wf|
00000040  55 00 0f 00 00 00 08 4d  69 63 72 6f 73 6f 66 74  |U......Microsoft|
00000050  80 08 00 00 00 09 00 01  80 08 00 00 00 0a 00 08  |................|

2026-10-10 14:49:1444.220.185.189to 11211/udpUnrecognisedUS
·stats
payload bytes
```
00000000  00 03 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```
2026-10-10 13:54:5544.220.188.56to 11211/udpUnrecognisedUS
·stats
payload bytes
```
00000000  00 06 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```
2026-10-10 04:59:25100.29.192.122to 1434/udpUnrecognisedUS
·
payload bytes
```
00000000  03                                                |.|
```

2026-10-10 01:06:05100.29.192.32to 44818/udpUnrecognisedUS

c·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  00 00 00 00 00 00 00 00                           |........|

2026-10-10 00:46:45100.29.192.124to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 HOST: 239.255.255.250:1900 MAN: "ssdp:discover" ST: ssdp:all MX: 3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 20 32 33 39 2e 32  |1.1..HOST: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 41 4e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.MAN: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 53  54 3a 20 73 73 64 70 3a  |over"..ST: ssdp:|
00000050  61 6c 6c 0d 0a 4d 58 3a  20 33 0d 0a 0d 0a        |all..MX: 3....|

2026-10-09 20:32:07100.29.192.103to 500/udpUnrecognisedUS

·-·! "·"·`·4·-·(·Ϩ·:·(·8· P·5·5·L·8·bh·

payload bytes

00000000  0e a3 cc e7 b5 2d a8 8d  00 00 00 00 00 00 00 00  |.....-..........|
00000010  21 20 22 08 00 00 00 00  00 00 01 a8 22 00 00 60  |! "........."..`|
00000020  02 00 00 34 01 01 08 04  0e a3 cc e7 b5 2d a8 8d  |...4.........-..|
00000030  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000040  02 00 00 05 03 00 00 08  03 00 00 0c 00 00 00 08  |................|
00000050  04 00 00 0e 00 00 00 28  02 03 04 03 cf a8 05 3a  |.......(.......:|
00000060  03 00 00 0c 01 00 00 17  80 0e 01 00 03 00 00 08  |................|
00000070  05 00 00 01 00 00 00 08  03 00 00 0c 28 00 01 08  |............(...|
00000080  00 0e 00 00 e8 c8 1d 38  d5 09 50 a5 35 dc c2 8a  |.......8..P.5...|
00000090  88 35 eb 4c bc 38 11 62  68 9d c8 f3 47 5e 23 13  |.5.L.8.bh...G^#.|
000000a0  1e 5e 41 7f 3e 55 96 49  00 d7 4c 6c 8e ed 10 47  |.^A.>U.I..Ll...G|
000000b0  7b c7 82 87 d0 71 f7 5f  e8 a3 4f d6 f6 b7 4b 2b  |{....q._..O...K+|
000000c0  58 a1 b2 66 f1 87 34 2b  41 2d 7a 89 cd 5e b5 22  |X..f..4+A-z..^."|
000000d0  b2 6c 99 67 81 a0 96 27  d2 53 45 2b 41 36 16 70  |.l.g...'.SE+A6.p|
000000e0  d8 4f d8 65 cc 3d 07 21  51 9c 67 a4 77 f9 2d 97  |.O.e.=.!Q.g.w.-.|
000000f0  a6 8a 09 1f fe b7 8b 21  87 da b2 58 95 d9 cb f8  |.......!...X....|
... 424 bytes shown in part

2026-10-09 20:08:26100.29.192.3to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-09 19:57:37100.29.192.11to 47808/udpUnrecognisedUS

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-09 12:21:26100.29.192.109to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-09 07:52:48100.29.192.31to 5060/udpSIPUS

OPTIONS sip:0.0.0.0 SIP/2.0 Via: SIP/2.0/UDP 0.0.0.0:5555;rport;branch=z9hG4bKI4Wxk0fAW6JUdiIrinztjsRbl Max-Forwards: 70 From: <sip:user@0.0.0.0>;tag=2TD1HQEM18jnLslO6eJb To: <sip:user@0.0.0.0> C

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 30 2e 30 2e  |OPTIONS sip:0.0.|
00000010  30 2e 30 20 53 49 50 2f  32 2e 30 0d 0a 56 69 61  |0.0 SIP/2.0..Via|
00000020  3a 20 53 49 50 2f 32 2e  30 2f 55 44 50 20 30 2e  |: SIP/2.0/UDP 0.|
00000030  30 2e 30 2e 30 3a 35 35  35 35 3b 72 70 6f 72 74  |0.0.0:5555;rport|
00000040  3b 62 72 61 6e 63 68 3d  7a 39 68 47 34 62 4b 49  |;branch=z9hG4bKI|
00000050  34 57 78 6b 30 66 41 57  36 4a 55 64 69 49 72 69  |4Wxk0fAW6JUdiIri|
00000060  6e 7a 74 6a 73 52 62 6c  0d 0a 4d 61 78 2d 46 6f  |nztjsRbl..Max-Fo|
00000070  72 77 61 72 64 73 3a 20  37 30 0d 0a 46 72 6f 6d  |rwards: 70..From|
00000080  3a 20 3c 73 69 70 3a 75  73 65 72 40 30 2e 30 2e  |: <sip:user@0.0.|
00000090  30 2e 30 3e 3b 74 61 67  3d 32 54 44 31 48 51 45  |0.0>;tag=2TD1HQE|
000000a0  4d 31 38 6a 6e 4c 73 6c  4f 36 65 4a 62 0d 0a 54  |M18jnLslO6eJb..T|
000000b0  6f 3a 20 3c 73 69 70 3a  75 73 65 72 40 30 2e 30  |o: <sip:user@0.0|
000000c0  2e 30 2e 30 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |.0.0>..Call-ID: |
000000d0  41 78 42 59 4d 77 38 38  64 49 4c 74 4b 57 33 46  |AxBYMw88dILtKW3F|
000000e0  47 57 54 68 38 69 44 42  37 34 75 74 53 47 58 32  |GWTh8iDB74utSGX2|
000000f0  42 39 68 4b 38 31 33 4c  4d 65 36 39 52 47 69 73  |B9hK813LMe69RGis|
... 468 bytes shown in part

2026-10-09 00:05:35100.29.192.11to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 01 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-08 21:03:01100.29.192.78to 44818/udpUnrecognisedUS

c·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  00 00 00 00 00 00 00 00                           |........|