UDP traffic

Datagrams matching asn:16509 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

80 datagrams from 10 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 72 NTP 8

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.server

payload bytes

00000000  ea 3c 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.<...........ver|
00000010  73 69 6f 6e 06 73 65 72  76 65 72 00 00 10 00 03  |sion.server.....|

Unrecognised

9 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 500/udp

9·Oԣ·P·\·P·$·p·$·p· ·*·N4t ·Rw·A·mŋ·n·)I9·VI·y·J·Br·X·%\·

payload bytes

00000000  39 9f 4f d4 a3 13 50 d9  00 00 00 00 00 00 00 00  |9.O...P.........|
00000010  01 10 04 00 00 00 00 00  00 00 01 b8 04 00 00 5c  |...............\|
00000020  00 00 00 01 00 00 00 01  00 00 00 50 01 01 00 02  |...........P....|
00000030  03 00 00 24 01 01 00 00  80 01 00 07 80 0e 00 80  |...$............|
00000040  80 02 00 02 80 04 00 05  80 03 fd e9 80 0b 00 01  |................|
00000050  80 0c 70 80 00 00 00 24  02 01 00 00 80 01 00 07  |..p....$........|
00000060  80 0e 01 00 80 02 00 06  80 04 00 05 80 03 fd e9  |................|
00000070  80 0b 00 01 80 0c 70 80  0a 00 00 c4 d3 2a d5 ee  |......p......*..|
00000080  4e 34 74 0a 15 cc 52 77  15 c5 41 9d 6d c5 8b 86  |N4t...Rw..A.m...|
00000090  16 e6 6e a4 81 87 f9 29  49 39 0b 56 49 fc c1 85  |..n....)I9.VI...|
000000a0  8e 1f f6 a6 a9 88 ea ef  bf 79 ee 98 4a ec 42 72  |.........y..J.Br|
000000b0  b7 11 bc dd 13 58 d4 e7  25 5c f1 24 83 01 36 47  |.....X..%\.$..6G|
000000c0  ba ae 87 42 0a 7b 55 2f  22 3a 08 2e b0 de c9 5c  |...B.{U/":.....\|
000000d0  bc 11 e6 8f eb 83 fd 72  03 d2 bd f2 04 9c 30 01  |.......r......0.|
000000e0  4a 64 f9 03 51 2f ed f1  46 ce b7 1d 15 b0 ae 2b  |Jd..Q/..F......+|
000000f0  a5 eb 59 d5 3f 74 e6 62  b9 64 ea c5 cb 3a 57 1a  |..Y.?t.b.d...:W.|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	72	6	28 to 54
NTP	123/udp	8	4	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS74
123/udp NTP8
500/udp IKE6
1434/udp MSSQL Browser1
39131/udp BitTorrent1

DNS questions

DNS record types

TXT59
A13

Networks

AS16509 Amazon.com, Inc. from 15 sources90

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
18.226.68.29	AS16509 Amazon.com, Inc.	US	DNS	23	2026-10-06 13:13
13.58.25.240	AS16509 Amazon.com, Inc.	US	DNS	14	2026-10-07 13:16
52.14.245.101	AS16509 Amazon.com, Inc.	US	DNS	13	2026-10-08 12:08
18.188.181.94	AS16509 Amazon.com, Inc.	US	DNS	10	2026-10-10 12:34
3.15.177.149	AS16509 Amazon.com, Inc.	US	DNS	8	2026-10-09 13:40
13.59.254.158	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-10 14:20
54.183.233.95	AS16509 Amazon.com, Inc.	US	Unrecognised	3	2026-10-07 19:08
54.219.32.123	AS16509 Amazon.com, Inc.	US	Unrecognised	3	2026-10-08 02:11
18.116.101.220	AS16509 Amazon.com, Inc.	US	NTP	3	2026-10-10 04:30
18.218.118.203	AS16509 Amazon.com, Inc.	US	NTP	2	2026-10-06 03:24
52.56.233.136	AS16509 Amazon.com, Inc.	GB	Unrecognised	2	2026-10-05 20:47
3.129.187.38	AS16509 Amazon.com, Inc.	US	NTP	2	2026-10-09 03:54
15.216.108.188	AS16509 Amazon.com, Inc.	ES	BitTorrent	1	2026-10-09 21:32
18.225.98.155	AS16509 Amazon.com, Inc.	US	Unrecognised	1	2026-10-06 04:51
3.130.168.2	AS16509 Amazon.com, Inc.	US	NTP	1	2026-10-08 02:52

Latest datagrams

2026-10-10 14:20:1513.59.254.158to 53/udpDNSUS

DNS query TXT/CH version.server

payload bytes

00000000  ea 3c 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.<...........ver|
00000010  73 69 6f 6e 06 73 65 72  76 65 72 00 00 10 00 03  |sion.server.....|

2026-10-10 13:51:4613.59.254.158to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  b7 80 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |.............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-10 13:51:4513.59.254.158to 53/udpDNSUS

DNS query TXT/CH id.server

payload bytes

00000000  22 c0 01 00 00 01 00 00  00 00 00 00 02 69 64 06  |"............id.|
00000010  73 65 72 76 65 72 00 00  10 00 03                 |server.....|

2026-10-10 13:51:4213.59.254.158to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  d2 59 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.Y...........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03        |sion.bind.....|

2026-10-10 12:34:3818.188.181.94to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  2f 06 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |/............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-10 12:34:3718.188.181.94to 53/udpDNSUS

DNS query TXT/CH id.server

payload bytes

00000000  18 41 01 00 00 01 00 00  00 00 00 00 02 69 64 06  |.A...........id.|
00000010  73 65 72 76 65 72 00 00  10 00 03                 |server.....|

2026-10-10 12:34:3618.188.181.94to 53/udpDNSUS

DNS query TXT/CH hostname.bind

payload bytes

00000000  ca 04 01 00 00 01 00 00  00 00 00 00 08 68 6f 73  |.............hos|
00000010  74 6e 61 6d 65 04 62 69  6e 64 00 00 10 00 03     |tname.bind.....|

2026-10-10 12:34:3418.188.181.94to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  f2 e6 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03        |sion.bind.....|

2026-10-10 12:34:3418.188.181.94to 53/udpDNSUS

DNS query TXT/CH version.server

payload bytes

00000000  17 83 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.............ver|
00000010  73 69 6f 6e 06 73 65 72  76 65 72 00 00 10 00 03  |sion.server.....|

2026-10-10 12:30:3618.188.181.94to 53/udpDNSUS

DNS query A google.com

payload bytes

00000000  99 95 00 00 00 01 00 00  00 00 00 00 06 67 6f 6f  |.............goo|
00000010  67 6c 65 03 63 6f 6d 00  00 01 00 01              |gle.com.....|

2026-10-10 12:30:3518.188.181.94to 53/udpDNSUS

DNS query TXT/CH id.server

payload bytes

00000000  a2 f2 01 00 00 01 00 00  00 00 00 00 02 69 64 06  |.............id.|
00000010  73 65 72 76 65 72 00 00  10 00 03                 |server.....|

2026-10-10 12:30:3418.188.181.94to 53/udpDNSUS

DNS query TXT/CH hostname.bind

payload bytes

00000000  2f 42 01 00 00 01 00 00  00 00 00 00 08 68 6f 73  |/B...........hos|
00000010  74 6e 61 6d 65 04 62 69  6e 64 00 00 10 00 03     |tname.bind.....|

2026-10-10 12:30:3318.188.181.94to 53/udpDNSUS

DNS query TXT/CH version.server

payload bytes

00000000  12 7b 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.{...........ver|
00000010  73 69 6f 6e 06 73 65 72  76 65 72 00 00 10 00 03  |sion.server.....|

2026-10-10 12:30:3118.188.181.94to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  7f 8e 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03        |sion.bind.....|

2026-10-10 04:30:2118.116.101.220to 123/udpNTPUS

payload bytes

00000000  1b 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|