UDP traffic

Datagrams matching asn:16735 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 22997/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

11 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 11

Latest Unrecognised datagram, to 8080/udp

9.jZ=Cor(9n·s·w.·O·hf'%1k%·^*W(·1eX W·YF·LL·zM·"k·I·45"·

payload bytes

00000000  39 2e 6a 5a 3d 43 6f 72  28 39 6e 07 73 06 77 2e  |9.jZ=Cor(9n.s.w.|
00000010  01 07 08 4f 1c 68 66 27  25 31 6b 25 1d 5e 2a 57  |...O.hf'%1k%.^*W|
00000020  28 15 31 65 58 20 57 00  59 46 08 4c 4c 7f 7a 4d  |(.1eX W.YF.LL.zM|
00000030  06 03 1c 22 6b 02 49 10  34 35 22 98              |..."k.I.45".|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS16735 ALGAR TELECOM S/A from 6 sources12

Countries

BR Brazil12

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
201.48.108.11	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	7	2026-10-10 19:47
189.37.69.143	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	1	2026-10-09 22:41
189.37.70.88	AS16735 ALGAR TELECOM S/A	BR	SOCKS5	1	2026-10-09 05:08
189.37.69.44	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	1	2026-10-10 10:45
187.32.8.65	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	1	2026-10-07 13:02
189.37.77.63	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	1	2026-10-10 11:43

Latest datagrams

2026-10-10 19:47:07201.48.108.11to 8080/udpUnrecognisedBR

9.jZ=Cor(9n·s·w.·O·hf'%1k%·^*W(·1eX W·YF·LL·zM·"k·I·45"·

payload bytes

00000000  39 2e 6a 5a 3d 43 6f 72  28 39 6e 07 73 06 77 2e  |9.jZ=Cor(9n.s.w.|
00000010  01 07 08 4f 1c 68 66 27  25 31 6b 25 1d 5e 2a 57  |...O.hf'%1k%.^*W|
00000020  28 15 31 65 58 20 57 00  59 46 08 4c 4c 7f 7a 4d  |(.1eX W.YF.LL.zM|
00000030  06 03 1c 22 6b 02 49 10  34 35 22 98              |..."k.I.45".|

2026-10-10 17:17:26201.48.108.11to 30301/udpUnrecognisedBR

·.nq·;@·ts @·>&·eh·IUz·A8·:h·kV·l·Nw%Cj3·}q)· ·v·WK·djM·u·sZ!_kpW·3AD6>5`L?nCRF·^*x·L

payload bytes

00000000  12 2e 6e 71 00 3b 40 0b  14 74 73 0d 40 12 3e 26  |..nq.;@..ts.@.>&|
00000010  11 19 65 68 08 49 55 7a  0c 1e 41 38 0b 3a 68 1d  |..eh.IUz..A8.:h.|
00000020  6b 56 0e 6c 11 4e 77 25  43 6a 33 03 7d 71 29 0e  |kV.l.Nw%Cj3.}q).|
00000030  0a 0e 76 12 57 4b 0c 64  6a 4d 1c 75 08 04 13 73  |..v.WK.djM.u...s|
00000040  5a 21 5f 6b 70 57 11 33  41 44 36 3e 35 60 4c 3f  |Z!_kpW.3AD6>5`L?|
00000050  6e 43 52 46 0e 5e 2a 78  c5 4c                    |nCRF.^*x.L|

2026-10-10 11:43:24189.37.77.63to 40102/udpUnrecognisedBR

·G_·~·4Vx>\·2·P·

payload bytes

00000000  01 47 5f 9b dd ed 7e dd  df 00 ff ff 00 fe fe fe  |.G_...~.........|
00000010  fe fd fd fd fd 12 34 56  78 3e 5c d5 32 f3 50 1f  |......4Vx>\.2.P.|
00000020  e3                                                |.|

2026-10-10 10:45:57189.37.69.44to 27285/udpUnrecognisedBR

·G_·L·+IlouCY·@·/·

payload bytes

00000000  06 08 89 47 5f fa 4c 83  2b 49 6c 6f 75 43 59 f8  |...G_.L.+IlouCY.|
00000010  40 ad 9f f7 ee 2f a8                              |@..../.|

2026-10-09 22:41:04189.37.69.143to 20178/udpUnrecognisedBR

=·ߕB·$·N·%·|QM·o·o_·

payload bytes

00000000  3d ab df 95 42 f9 af 24  07 4e a2 a0 1b bd bf 25  |=...B..$.N.....%|
00000010  d2 7c 51 4d d3 f9 6f 16  6f 5f 0f a4 90           |.|QM..o.o_...|

2026-10-09 06:24:45201.48.108.11to 8082/udpUnrecognisedBR
!.41b<·
payload bytes
```
00000000  21 2e 34 31 62 3c 0f a1  de                       |!.41b<...|
```

2026-10-09 05:08:19189.37.70.88to 22997/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-08 21:13:35201.48.108.11to 11211/udpUnrecognisedBR

y.Y+t[]V+,[w];·"_F*7nr(3Quv@cp·]>`·2<e g·

payload bytes

00000000  79 2e 59 2b 74 5b 5d 56  2b 2c 5b 77 5d 3b 0b 22  |y.Y+t[]V+,[w];."|
00000010  5f 46 2a 37 6e 72 28 33  51 75 76 40 63 70 07 5d  |_F*7nr(3Quv@cp.]|
00000020  3e 60 08 32 3c 65 09 67  12 8d c2                 |>`.2<e.g...|

2026-10-08 13:00:36201.48.108.11to 8083/udpUnrecognisedBR

'.5nB·/f*[G·VGjN}&@7·-bH61·" ·IMA7·[fv·A=·J·L4bJ[#·lPc4·C)5Nr·*·j·oREt·YAP<·+_·/oL6·_:]R<m·

payload bytes

00000000  27 2e 35 6e 42 1a 2f 66  2a 5b 47 00 08 56 47 6a  |'.5nB./f*[G..VGj|
00000010  4e 7d 26 40 37 11 2d 62  48 36 31 0e 22 20 0b 49  |N}&@7.-bH61." .I|
00000020  4d 41 37 0f 5b 66 76 05  41 3d 05 4a 14 4c 34 62  |MA7.[fv.A=.J.L4b|
00000030  4a 5b 23 01 6c 50 63 34  07 15 43 29 35 4e 72 02  |J[#.lPc4..C)5Nr.|
00000040  0f 2a 12 6a 10 08 6f 52  45 74 1c 59 41 50 3c 0b  |.*.j..oREt.YAP<.|
00000050  2b 5f 0c 17 2f 6f 4c 36  04 0f 5f 3a 5d 52 3c 6d  |+_../oL6.._:]R<m|
00000060  1c 02                                             |..|

2026-10-07 13:02:11187.32.8.65to 54107/udpUnrecognisedBR

·[·TO·4Vx"S·{·O

payload bytes

00000000  01 ee f0 5b d2 54 4f 06  85 00 ff ff 00 fe fe fe  |...[.TO.........|
00000010  fe fd fd fd fd 12 34 56  78 22 53 cd fc 7b 8a dc  |......4Vx"S..{..|
00000020  4f                                                |O|

2026-10-07 02:46:52201.48.108.11to 8000/udpUnrecognisedBR

}.·ay';kc?(·G#}MIq=*X!'}· xL`q ^32·

payload bytes

00000000  7d 2e 11 61 79 27 3b 6b  63 3f 28 0e 47 23 7d 4d  |}..ay';kc?(.G#}M|
00000010  49 71 3d 2a 58 21 27 7d  16 0a 78 4c 60 71 20 5e  |Iq=*X!'}..xL`q ^|
00000020  33 32 a1 bd                                       |32..|

2026-10-06 23:11:20201.48.108.11to 8000/udpUnrecognisedBR

·.);·oF8,wnM`jX9HT·0·f

payload bytes

00000000  01 2e 29 3b 07 6f 46 38  2c 77 6e 4d 60 6a 58 39  |..);.oF8,wnM`jX9|
00000010  48 54 16 30 13 1d 66                              |HT.0..f|