UDP traffic

Datagrams matching asn:202425 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

307

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

13 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 7 NetBIOS 6

Latest Sun RPC datagram, to 111/udp

j·

payload bytes

00000000  6a d4 cb c5 00 00 00 00  00 00 00 02 00 01 86 a0  |j...............|
00000010  00 00 00 02 00 00 00 03  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 01 86 a0 00 00 00 02  |................|
00000030  00 00 00 06 00 00 00 00                           |........|

Other services

29 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 15 SIP 4 DTLS 3 STUN 3 MINING 1 GTP-U 1 Redis 1 RADIUS 1

Latest HTTP datagram, to 30718/udp

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

Unrecognised

262 datagrams from 9 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 262

Latest Unrecognised datagram, to 40902/udp

payload bytes

00000000  00                                                |.|

Peer-to-peer

3 datagrams from 2 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 3

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	6	3	3.8
Portmap	111/udp	7	2	7 to 28
CharGEN	19/udp	4	1	358.8
RIPv1	520/udp	1	1	131.24
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS202425 IP Volume inc from 14 sources307

Countries

US United States264
NL The Netherlands43

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	70	2026-10-11 04:22
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	69	2026-10-11 03:42
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	68	2026-10-11 02:56
185.242.226.67	AS202425 IP Volume inc	US	Unrecognised	22	2026-10-10 19:10
80.82.77.139	AS202425 IP Volume inc	NL	Unrecognised	15	2026-10-10 18:31
93.174.95.106	AS202425 IP Volume inc	NL	Unrecognised	13	2026-10-10 23:15
185.242.226.63	AS202425 IP Volume inc	US	Unrecognised	12	2026-10-09 19:10
80.82.77.33	AS202425 IP Volume inc	NL	Unrecognised	8	2026-10-11 02:49
185.242.226.62	AS202425 IP Volume inc	US	SIP	7	2026-10-11 03:14
89.248.167.131	AS202425 IP Volume inc	NL	Unrecognised	6	2026-10-09 13:45
185.242.226.87	AS202425 IP Volume inc	US	Sun RPC	6	2026-10-09 06:52
185.242.226.66	AS202425 IP Volume inc	US	HTTP	5	2026-10-08 05:56
185.242.226.65	AS202425 IP Volume inc	US	HTTP	5	2026-10-11 00:23
94.102.49.193	AS202425 IP Volume inc	NL	STUN	1	2026-10-09 01:01

Latest datagrams

2026-10-11 04:22:55185.242.226.97to 40902/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-11 04:05:36185.242.226.97to 40902/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-11 03:42:15185.242.226.68to 5377/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-11 03:14:47185.242.226.62to 30718/udpHTTPUS

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

2026-10-11 02:56:21185.242.226.166to 21025/udpUnrecognisedUS

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-11 02:49:4780.82.77.33to 987/udpUnrecognisedNL

SRCH * HTTP/1.1 device-discovery-protocol-version:00030010

payload bytes

00000000  53 52 43 48 20 2a 20 48  54 54 50 2f 31 2e 31 0a  |SRCH * HTTP/1.1.|
00000010  64 65 76 69 63 65 2d 64  69 73 63 6f 76 65 72 79  |device-discovery|
00000020  2d 70 72 6f 74 6f 63 6f  6c 2d 76 65 72 73 69 6f  |-protocol-versio|
00000030  6e 3a 30 30 30 33 30 30  31 30 0a                 |n:00030010.|

2026-10-11 02:26:59185.242.226.68to 5377/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-11 02:10:17185.242.226.68to 5377/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-11 01:55:29185.242.226.166to 21025/udpUnrecognisedUS

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-11 00:40:48185.242.226.166to 21025/udpUnrecognisedUS

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-11 00:23:43185.242.226.166to 21025/udpUnrecognisedUS

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-11 00:23:41185.242.226.65to 121/udpHTTPUS

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

2026-10-10 23:15:1693.174.95.106to 44818/udpUnrecognisedNL

c·j·d·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  6a 0e be 64 00 00 00 00                           |j..d....|

2026-10-10 22:48:59185.242.226.97to 40893/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-10 21:46:30185.242.226.97to 40893/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```