UDP traffic

Datagrams matching asn:209334 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

3 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 1 DNS 1 SNMP 1

Latest NTP datagram, to 123/udp

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

Unrecognised

6 datagrams from 6 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 6

Latest Unrecognised datagram, to 47808/udp

· ·%· · · , 8 9 : F M x y·

payload bytes

00000000  81 0a 00 25 01 04 02 05  01 0e 0c 02 00 00 00 1e  |...%............|
00000010  09 0c 09 1c 09 2c 09 38  09 39 09 3a 09 46 09 4d  |.....,.8.9.:.F.M|
00000020  09 78 09 79 1f                                    |.x.y.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	1	1	2 to 10
NTP	123/udp	1	1	556.9
SNMPv2	161/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

9600/udp3
47808/udp BACnet2
123/udp NTP1
161/udp SNMP1
500/udp IKE1
5353/udp DNS1

DNS questions

_services._dns-sd._udp.local PTR1

DNS record types

PTR1

Networks

AS209334 Modat B.V. from 9 sources9

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
85.217.149.24	AS209334 Modat B.V.	CA	Unrecognised	1	2026-10-10 05:31
85.217.140.8	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-10 05:34
85.217.140.11	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-10 11:38
85.217.140.6	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-07 16:22
85.217.140.18	AS209334 Modat B.V.	FR	DNS	1	2026-10-07 04:24
85.217.140.36	AS209334 Modat B.V.	FR	NTP	1	2026-10-07 04:42
85.217.149.56	AS209334 Modat B.V.	CA	SNMP	1	2026-10-09 17:09
85.217.140.54	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-07 10:37
85.217.140.16	AS209334 Modat B.V.	FR	Unrecognised	1	2026-10-10 11:42

Latest datagrams

2026-10-10 11:42:2385.217.140.16to 47808/udpUnrecognisedFR

· ·%· · · , 8 9 : F M x y·

payload bytes

00000000  81 0a 00 25 01 04 02 05  01 0e 0c 02 00 00 00 1e  |...%............|
00000010  09 0c 09 1c 09 2c 09 38  09 39 09 3a 09 46 09 4d  |.....,.8.9.:.F.M|
00000020  09 78 09 79 1f                                    |.x.y.|

2026-10-10 11:38:5785.217.140.11to 9600/udpUnrecognisedFR

FINS·

payload bytes

00000000  46 49 4e 53 00 00 00 0c  00 00 00 00 00 00 00 00  |FINS............|
00000010  00 00 00 00                                       |....|

2026-10-10 05:34:3985.217.140.8to 47808/udpUnrecognisedFR

· ·%· · · , 8 9 : F M x y·

payload bytes

00000000  81 0a 00 25 01 04 02 05  01 0e 0c 02 00 00 00 1e  |...%............|
00000010  09 0c 09 1c 09 2c 09 38  09 39 09 3a 09 46 09 4d  |.....,.8.9.:.F.M|
00000020  09 78 09 79 1f                                    |.x.y.|

2026-10-10 05:31:3385.217.149.24to 9600/udpUnrecognisedCA

FINS·

payload bytes

00000000  46 49 4e 53 00 00 00 0c  00 00 00 00 00 00 00 00  |FINS............|
00000010  00 00 00 00                                       |....|

2026-10-09 17:09:0685.217.149.56to 161/udpSNMPCA

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-07 16:22:5885.217.140.6to 9600/udpUnrecognisedFR

FINS·

payload bytes

00000000  46 49 4e 53 00 00 00 0c  00 00 00 00 00 00 00 00  |FINS............|
00000010  00 00 00 00                                       |....|

2026-10-07 10:37:5885.217.140.54to 500/udpUnrecognisedFR

5b5e64c03e99b51100000000000000000110020000000000000001500000013400000001000000010000012801010008030000240101

payload bytes

00000000  35 62 35 65 36 34 63 30  33 65 39 39 62 35 31 31  |5b5e64c03e99b511|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000020  30 31 31 30 30 32 30 30  30 30 30 30 30 30 30 30  |0110020000000000|
00000030  30 30 30 30 30 31 35 30  30 30 30 30 30 31 33 34  |0000015000000134|
00000040  30 30 30 30 30 30 30 31  30 30 30 30 30 30 30 31  |0000000100000001|
00000050  30 30 30 30 30 31 32 38  30 31 30 31 30 30 30 38  |0000012801010008|
00000060  30 33 30 30 30 30 32 34  30 31 30 31              |030000240101|

2026-10-07 04:42:4285.217.140.36to 123/udpNTPFR

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-07 04:24:4285.217.140.18to 5353/udpDNSFR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|