UDP traffic
Datagrams matching asn:15964 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
41
Datagrams
3
Source addresses
1
Networks
1
Countries
10
Destination ports
Traffic by type
Other services
1 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest Redis datagram, to 8081/udp
payload bytes
00000000 2a 2e 15 02 1b 45 3d 13 25 6c 6f 1c 2d 06 67 70 |*....E=.%lo.-.gp|
00000010 7e 7f 2e 17 66 56 3f 2a 68 21 6c 3b 08 0e 17 32 |~...fV?*h!l;...2|
00000020 41 2c 34 5c 71 72 6f 16 5e 5e 32 0b 64 1a 7b 62 |A,4\qro.^^2.d.{b|
00000030 19 2a 7a 7f 00 39 2a 68 5a 16 23 62 24 3a 14 65 |.*z..9*hZ.#b$:.e|
00000040 67 49 41 58 3b 30 6f 19 0e 21 24 72 3b 20 54 55 |gIAX;0o..!$r; TU|
00000050 4a 4e 54 4a 07 7e 32 62 13 9f |JNTJ.~2b..|Unrecognised
12 datagrams from 1 sourceDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 8081/udp
payload bytes
00000000 6f 2e 64 5b 64 1a 1f 67 33 33 2f 48 08 50 09 7e |o.d[d..g33/H.P.~|
00000010 2f 56 50 55 0d 34 07 78 12 4e 0f 26 64 2f 78 53 |/VPU.4.x.N.&d/xS|
00000020 4c 5c 2e 30 76 4d 17 29 01 47 72 09 17 7b 07 47 |L\.0vM.).Gr..{.G|
00000030 51 57 1c 5f 0c 23 57 1e 72 66 44 56 16 3c 2a 62 |QW._.#W.rfDV.<*b|
00000040 19 58 12 0f 26 2a 39 27 71 2b 30 08 26 37 4f 78 |.X..&*9'q+0.&7Ox|
00000050 0f 6b 57 1b 0f 2e 39 01 14 7e 57 2a 3a 07 12 |.kW...9..~W*:..|Peer-to-peer
28 datagrams from 3 sourcesFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 2 | 1 | 2 to 10 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 154.72.161.186 | AS15964 CAMTEL | CM | BitTorrent | 26 | 2026-10-11 14:11 |
| 195.24.207.184 | AS15964 CAMTEL | CM | Unrecognised | 14 | 2026-10-12 04:17 |
| 154.72.161.206 | AS15964 CAMTEL | CM | BitTorrent | 1 | 2026-10-10 21:03 |
Latest datagrams
payload bytes
00000000 6f 2e 64 5b 64 1a 1f 67 33 33 2f 48 08 50 09 7e |o.d[d..g33/H.P.~| 00000010 2f 56 50 55 0d 34 07 78 12 4e 0f 26 64 2f 78 53 |/VPU.4.x.N.&d/xS| 00000020 4c 5c 2e 30 76 4d 17 29 01 47 72 09 17 7b 07 47 |L\.0vM.).Gr..{.G| 00000030 51 57 1c 5f 0c 23 57 1e 72 66 44 56 16 3c 2a 62 |QW._.#W.rfDV.<*b| 00000040 19 58 12 0f 26 2a 39 27 71 2b 30 08 26 37 4f 78 |.X..&*9'q+0.&7Ox| 00000050 0f 6b 57 1b 0f 2e 39 01 14 7e 57 2a 3a 07 12 |.kW...9..~W*:..|payload bytes
00000000 64 31 3a 61 64 32 3a 69 64 32 30 3a d1 29 2b 4d |d1:ad2:id20:.)+M| 00000010 cc 37 af ce c7 0e 15 17 bb 06 f2 72 19 da e4 0a |.7.........r....| 00000020 36 3a 74 61 72 67 65 74 32 30 3a d1 29 2b 4d cc |6:target20:.)+M.| 00000030 37 af ce c7 0e 15 17 bb 06 f2 72 19 da e4 0a 65 |7.........r....e| 00000040 31 3a 71 39 3a 66 69 6e 64 5f 6e 6f 64 65 31 3a |1:q9:find_node1:| 00000050 74 34 3a 6d 0a 00 00 31 3a 76 34 3a 55 54 b9 1e |t4:m...1:v4:UT..| 00000060 31 3a 79 31 3a 71 65 |1:y1:qe|
payload bytes
00000000 41 00 ce f5 1f 2f 33 91 00 00 00 00 00 10 00 00 |A..../3.........| 00000010 51 59 00 00 |QY..|
payload bytes
00000000 41 00 ce f5 1f 00 b8 c1 00 00 00 00 00 10 00 00 |A...............| 00000010 51 59 00 00 |QY..|
payload bytes
00000000 41 00 23 5a be 94 2e e8 00 00 00 00 00 10 00 00 |A.#Z............| 00000010 80 37 00 00 |.7..|
payload bytes
00000000 41 00 23 5a be 37 a6 3c 00 00 00 00 00 10 00 00 |A.#Z.7.<........| 00000010 80 37 00 00 |.7..|
payload bytes
00000000 41 00 23 5a be 06 7b 96 00 00 00 00 00 10 00 00 |A.#Z..{.........| 00000010 80 37 00 00 |.7..|payload bytes
00000000 41 00 56 e5 b7 0f 57 ff 00 00 00 00 00 10 00 00 |A.V...W.........| 00000010 0e 67 00 00 |.g..|
payload bytes
00000000 41 00 56 e5 b6 b2 67 9f 00 00 00 00 00 10 00 00 |A.V...g.........| 00000010 0e 67 00 00 |.g..|
payload bytes
00000000 41 00 56 e5 b6 83 a3 ff 00 00 00 00 00 10 00 00 |A.V.............| 00000010 0e 67 00 00 |.g..|
payload bytes
00000000 41 00 79 23 84 f5 2a 2e 00 00 00 00 00 10 00 00 |A.y#..*.........| 00000010 b4 b8 00 00 |....|
payload bytes
00000000 41 00 79 23 84 98 2d 97 00 00 00 00 00 10 00 00 |A.y#..-.........| 00000010 b4 b8 00 00 |....|
payload bytes
00000000 41 00 79 23 84 63 8d bb 00 00 00 00 00 10 00 00 |A.y#.c..........| 00000010 b4 b8 00 00 |....|
payload bytes
00000000 41 00 b1 f7 7d 70 59 73 00 00 00 00 00 10 00 00 |A...}pYs........| 00000010 ba f6 00 00 |....|
payload bytes
00000000 41 00 b1 f7 7d 13 d6 96 00 00 00 00 00 10 00 00 |A...}...........| 00000010 ba f6 00 00 |....|