UDP traffic

Datagrams matching asn:20052 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

608

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

135 datagrams from 26 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 31 DNS 23 Sun RPC 17 NetBIOS 13 TFTP 12 NTP 9 CoAP 8 SOAP 8 CLDAP 7 SNMP 7

Latest SSDP datagram, to 32410/udp

M-SEARCH * HTTP/1.1

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a                                    |1.1..|

Other services

53 datagrams from 16 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

STUN 37 Redis 8 SIP 8

Latest STUN datagram, to 8088/udp

·!· D ·4Vx·#Eg

payload bytes

00000000  00 01 00 00 21 12 0a 44  20 12 34 56 78 9a bc de  |....!..D .4Vx...|
00000010  f1 23 45 67                                       |.#Eg|

Unrecognised

399 datagrams from 23 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 399

Latest Unrecognised datagram, to 27015/udp

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

Peer-to-peer

21 datagrams from 12 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 21

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp +2	31	14	30.8
NetBIOS	137/udp	13	10	3.8
TFTP	69/udp	12	9	60
CharGEN	19/udp	12	8	358.8
mDNS	5353/udp	11	8	2 to 10
DNS	53/udp +1	12	6	28 to 54
NTP	123/udp	9	6	556.9
WS-Discovery	3702/udp	8	6	10 to 500
Portmap	111/udp	8	5	7 to 28
RIPv1	520/udp	8	5	131.24
QOTD	17/udp	8	5	140.3
Memcached	11211/udp	8	5	10,000 to 51,000
CLDAP	389/udp	7	5	56 to 70
SNMPv2	161/udp	7	4	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

3283/udp ARMS16
1900/udp SSDP15
37833/udp STUN13
137/udp NetBIOS13
3478/udp STUN12
69/udp TFTP12
21025/udp12
8088/udp STUN12
1194/udp OpenVPN12
6881/udp BitTorrent12
19/udp CharGEN12
5353/udp DNS11

DNS questions

DNS record types

PTR11
A8

Networks

AS20052 Arbor Networks, Inc. from 28 sources608

Countries

US United States608

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
146.88.241.80	AS20052 Arbor Networks, Inc.	US	Unrecognised	51	2026-10-11 09:28
146.88.241.100	AS20052 Arbor Networks, Inc.	US	Unrecognised	43	2026-10-11 07:40
146.88.241.170	AS20052 Arbor Networks, Inc.	US	Unrecognised	43	2026-10-11 07:50
146.88.241.110	AS20052 Arbor Networks, Inc.	US	Unrecognised	40	2026-10-11 08:25
146.88.241.120	AS20052 Arbor Networks, Inc.	US	Unrecognised	36	2026-10-11 04:26
146.88.241.20	AS20052 Arbor Networks, Inc.	US	Unrecognised	35	2026-10-11 06:30
146.88.241.40	AS20052 Arbor Networks, Inc.	US	Unrecognised	34	2026-10-11 08:46
146.88.241.50	AS20052 Arbor Networks, Inc.	US	Unrecognised	32	2026-10-11 07:06
146.88.241.130	AS20052 Arbor Networks, Inc.	US	Unrecognised	32	2026-10-11 07:54
146.88.241.150	AS20052 Arbor Networks, Inc.	US	Unrecognised	31	2026-10-11 05:22
146.88.241.60	AS20052 Arbor Networks, Inc.	US	Unrecognised	30	2026-10-11 09:31
146.88.241.70	AS20052 Arbor Networks, Inc.	US	Unrecognised	30	2026-10-11 07:57
146.88.241.140	AS20052 Arbor Networks, Inc.	US	Unrecognised	30	2026-10-11 03:18
146.88.241.90	AS20052 Arbor Networks, Inc.	US	Unrecognised	29	2026-10-11 07:12
146.88.241.160	AS20052 Arbor Networks, Inc.	US	Unrecognised	27	2026-10-11 09:28
146.88.241.30	AS20052 Arbor Networks, Inc.	US	Unrecognised	24	2026-10-11 07:44
146.88.240.40	AS20052 Arbor Networks, Inc.	US	STUN	9	2026-10-06 14:35
146.88.240.41	AS20052 Arbor Networks, Inc.	US	Unrecognised	8	2026-10-08 13:46
146.88.240.42	AS20052 Arbor Networks, Inc.	US	Unrecognised	7	2026-10-09 16:28
146.88.240.30	AS20052 Arbor Networks, Inc.	US	BitTorrent	7	2026-10-09 15:08

Latest datagrams

2026-10-11 09:31:06146.88.241.60to 389/udpCLDAPUS

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-11 09:28:51146.88.241.160to 51413/udpBitTorrentUS

d1:d2:id20:AAAAAAAAAAAAAAAAAAAA9:info_hash20:BBBBBBBBBBBBBBBBBBBe1:q9:get_peers1:t2:aa1:y1:qe

payload bytes

00000000  64 31 3a 64 32 3a 69 64  32 30 3a 41 41 41 41 41  |d1:d2:id20:AAAAA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 39  |AAAAAAAAAAAAAAA9|
00000020  3a 69 6e 66 6f 5f 68 61  73 68 32 30 3a 42 42 42  |:info_hash20:BBB|
00000030  42 42 42 42 42 42 42 42  42 42 42 42 42 42 42 42  |BBBBBBBBBBBBBBBB|
00000040  65 31 3a 71 39 3a 67 65  74 5f 70 65 65 72 73 31  |e1:q9:get_peers1|
00000050  3a 74 32 3a 61 61 31 3a  79 31 3a 71 65           |:t2:aa1:y1:qe|

2026-10-11 09:28:49146.88.241.80to 27015/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 09:12:15146.88.241.80to 27015/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 08:46:39146.88.241.40to 27021/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 08:45:20146.88.241.40to 27021/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 08:25:45146.88.241.110to 27961/udpUnrecognisedUS
·getstatus·
payload bytes
```
00000000  ff ff ff ff 67 65 74 73  74 61 74 75 73 10        |....getstatus.|
```

2026-10-11 07:57:57146.88.241.70to 389/udpCLDAPUS

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-11 07:54:40146.88.241.130to 27021/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 07:50:41146.88.241.170to 10001/udpUnrecognisedUS
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```
2026-10-11 07:47:40146.88.241.60to 7782/udpUnrecognisedUS
\status\·
payload bytes
```
00000000  5c 73 74 61 74 75 73 5c  00                       |\status\.|
```

2026-10-11 07:47:34146.88.241.70to 389/udpCLDAPUS

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-11 07:44:53146.88.241.30to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:40:26146.88.241.100to 27026/udpUnrecognisedUS

·TTSource Engine Query

payload bytes

00000000  ff ff ff ff 54 54 53 6f  75 72 63 65 20 45 6e 67  |....TTSource Eng|
00000010  69 6e 65 20 51 75 65 72  79                       |ine Query|

2026-10-11 07:35:59146.88.241.170to 10001/udpUnrecognisedUS
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```