UDP traffic

Datagrams matching asn:213412 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

7 datagrams from 5 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 4 CLDAP 3

Latest SNMP datagram, to 161/udp

0)·public·Y~*·0·0·+·

payload bytes

00000000  30 29 02 01 01 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 ec 59 7e 2a 02 01 00  02 01 00 30 0e 30 0c 06  |..Y~*......0.0..|
00000020  08 2b 06 01 02 01 01 05  00 05 00                 |.+.........|

Other services

4 datagrams from 4 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

XDMCP 4

Latest XDMCP datagram, to 177/udp

payload bytes

00000000  00 01 00 02 00 01 00                              |.......|

Unrecognised

28 datagrams from 18 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 28

Latest Unrecognised datagram, to 500/udp

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
CLDAP	389/udp	3	3	56 to 70
SNMPv2	161/udp	4	2	6.3
RIPv1	520/udp	2	2	131.24
Memcached	11211/udp	2	2	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP4
177/udp XDMCP4
443/udp QUIC4
389/udp CLDAP3
427/udp SLP2
500/udp IKE2
520/udp RIP2
523/udp2
623/udp IPMI2
1194/udp OpenVPN2
1434/udp MSSQL Browser2
6969/udp2

Networks

AS213412 ONYPHE SAS from 19 sources39

Countries

US United States20
FR France19

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
91.230.168.217	AS213412 ONYPHE SAS	US	Unrecognised	3	2026-10-10 19:51
91.231.89.90	AS213412 ONYPHE SAS	FR	Unrecognised	3	2026-10-10 23:36
91.231.89.89	AS213412 ONYPHE SAS	FR	Unrecognised	3	2026-10-10 20:06
91.231.89.92	AS213412 ONYPHE SAS	FR	SNMP	3	2026-10-10 20:03
91.230.168.220	AS213412 ONYPHE SAS	US	SNMP	3	2026-10-10 19:48
91.230.168.218	AS213412 ONYPHE SAS	US	Unrecognised	3	2026-10-10 23:20
91.230.168.221	AS213412 ONYPHE SAS	US	XDMCP	2	2026-10-10 23:17
91.230.168.119	AS213412 ONYPHE SAS	US	XDMCP	2	2026-10-10 12:52
91.230.168.216	AS213412 ONYPHE SAS	US	CLDAP	2	2026-10-10 16:22
91.231.89.88	AS213412 ONYPHE SAS	FR	CLDAP	2	2026-10-10 16:37
91.231.89.167	AS213412 ONYPHE SAS	FR	XDMCP	2	2026-10-10 13:08
91.231.89.91	AS213412 ONYPHE SAS	FR	Unrecognised	2	2026-10-11 00:28
91.230.168.219	AS213412 ONYPHE SAS	US	Unrecognised	2	2026-10-11 00:13
91.231.89.93	AS213412 ONYPHE SAS	FR	XDMCP	2	2026-10-10 23:33
91.231.89.166	AS213412 ONYPHE SAS	FR	Unrecognised	1	2026-10-10 09:39
91.230.168.222	AS213412 ONYPHE SAS	US	CLDAP	1	2026-10-10 16:35
91.230.168.118	AS213412 ONYPHE SAS	US	Unrecognised	1	2026-10-10 09:23
91.231.89.160	AS213412 ONYPHE SAS	FR	Unrecognised	1	2026-10-10 23:49
91.230.168.112	AS213412 ONYPHE SAS	US	Unrecognised	1	2026-10-10 23:34

Latest datagrams

2026-10-11 00:28:3091.231.89.91to 500/udpUnrecognisedFR

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-11 00:13:1091.230.168.219to 500/udpUnrecognisedUS

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:36:1291.231.89.90to 1434/udpUnrecognisedFR
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-10 23:34:2891.230.168.112to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 23:33:1191.231.89.93to 17185/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 23:20:5591.230.168.218to 1434/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-10 23:17:5491.230.168.221to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 20:59:1791.231.89.90to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 20:44:0191.230.168.218to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 20:06:5091.231.89.89to 1194/udpUnrecognisedFR

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|

2026-10-10 20:03:5191.231.89.92to 17184/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 20 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |. ..........UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 19:51:3391.230.168.217to 1194/udpUnrecognisedUS

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|

2026-10-10 19:48:3691.230.168.220to 17184/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 20 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |. ..........UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 17:30:0491.231.89.89to 427/udpUnrecognisedFR

·=·en·service:VMwareInfrastructure·DEFAULT·

payload bytes

00000000  02 01 00 00 3d 00 00 00  00 00 12 06 00 02 65 6e  |....=.........en|
00000010  00 00 00 1c 73 65 72 76  69 63 65 3a 56 4d 77 61  |....service:VMwa|
00000020  72 65 49 6e 66 72 61 73  74 72 75 63 74 75 72 65  |reInfrastructure|
00000030  00 07 44 45 46 41 55 4c  54 00 00 00 00           |..DEFAULT....|