UDP traffic

Datagrams matching asn:213412 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

304

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

73 datagrams from 32 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 16 NetBIOS 8 CoAP 8 Sun RPC 8 SOAP 8 CLDAP 7 NTP 6 DNS 6 SSDP 6

Latest SNMP datagram, to 161/udp

0)·public·Y~*·0·0·+·

payload bytes

00000000  30 29 02 01 01 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 ec 59 7e 2a 02 01 00  02 01 00 30 0e 30 0c 06  |..Y~*......0.0..|
00000020  08 2b 06 01 02 01 01 05  00 05 00                 |.+.........|

Other services

38 datagrams from 24 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

XDMCP 8 DTLS 8 GTP-U 8 SIP 8 DCE/RPC 6

Latest XDMCP datagram, to 177/udp

payload bytes

00000000  00 01 00 02 00 01 00                              |.......|

Unrecognised

189 datagrams from 32 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 189

Latest Unrecognised datagram, to 500/udp

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

Peer-to-peer

4 datagrams from 4 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 4

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	16	6	6.3
Portmap	111/udp	8	6	7 to 28
mDNS	5353/udp	8	6	2 to 10
NetBIOS	137/udp	8	6	3.8
WS-Discovery	3702/udp	8	6	10 to 500
CLDAP	389/udp	7	6	56 to 70
DNS	53/udp	6	6	28 to 54
NTP	123/udp	6	6	556.9
SSDP	1900/udp	6	4	30.8
Memcached	11211/udp	6	4	10,000 to 51,000
RIPv1	520/udp	4	4	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP16
4500/udp IPsec NAT-T8
3391/udp DTLS8
137/udp NetBIOS8
6881/udp8
177/udp XDMCP8
2361/udp8
17184/udp8
3702/udp SOAP8
10001/udp Ubiquiti discovery8
6969/udp8
111/udp Sun RPC8

DNS questions

VERSION.BIND TXT6

DNS record types

TXT6

Networks

AS213412 ONYPHE SAS from 32 sources304

Countries

US United States152
FR France152

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
91.231.89.92	AS213412 ONYPHE SAS	FR	Unrecognised	12	2026-10-10 20:03
91.230.168.220	AS213412 ONYPHE SAS	US	Unrecognised	12	2026-10-10 19:48
91.230.168.219	AS213412 ONYPHE SAS	US	Unrecognised	11	2026-10-11 00:13
91.231.89.166	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-10 09:39
91.231.89.91	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-11 00:28
91.230.168.217	AS213412 ONYPHE SAS	US	Unrecognised	11	2026-10-10 19:51
91.230.168.118	AS213412 ONYPHE SAS	US	Unrecognised	11	2026-10-10 09:23
91.231.89.89	AS213412 ONYPHE SAS	FR	Unrecognised	11	2026-10-10 20:06
91.231.89.88	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 16:37
91.231.89.93	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:33
91.231.89.90	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:36
91.230.168.221	AS213412 ONYPHE SAS	US	Unrecognised	10	2026-10-10 23:17
91.230.168.117	AS213412 ONYPHE SAS	US	Unrecognised	10	2026-10-10 05:54
91.230.168.218	AS213412 ONYPHE SAS	US	Unrecognised	10	2026-10-10 23:20
91.231.89.160	AS213412 ONYPHE SAS	FR	Unrecognised	10	2026-10-10 23:49
91.230.168.112	AS213412 ONYPHE SAS	US	Unrecognised	10	2026-10-10 23:34
91.230.168.216	AS213412 ONYPHE SAS	US	Unrecognised	10	2026-10-10 16:22
91.230.168.116	AS213412 ONYPHE SAS	US	Unrecognised	9	2026-10-10 02:25
91.231.89.167	AS213412 ONYPHE SAS	FR	Unrecognised	9	2026-10-10 13:08
91.230.168.222	AS213412 ONYPHE SAS	US	SSDP	9	2026-10-10 16:35

Latest datagrams

2026-10-11 00:28:3091.231.89.91to 500/udpUnrecognisedFR

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-11 00:13:1091.230.168.219to 500/udpUnrecognisedUS

·"3DUfw·$·$·$·$·

payload bytes

00000000  00 11 22 33 44 55 66 77  00 00 00 00 00 00 00 00  |.."3DUfw........|
00000010  01 10 02 00 00 00 00 00  00 00 00 c0 00 00 00 a4  |................|
00000020  00 00 00 01 00 00 00 01  00 00 00 98 01 01 00 04  |................|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 00 01 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 00 01  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 00 01 00 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 00 01  |................|

2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:36:1291.231.89.90to 1434/udpUnrecognisedFR
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-10 23:34:2891.230.168.112to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 23:33:1191.231.89.93to 17185/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 23:20:5591.230.168.218to 1434/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-10 23:17:5491.230.168.221to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 20:59:1791.231.89.90to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 20:44:0191.230.168.218to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 20:06:5091.231.89.89to 1194/udpUnrecognisedFR

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|

2026-10-10 20:03:5191.231.89.92to 17184/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 20 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |. ..........UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 19:51:3391.230.168.217to 1194/udpUnrecognisedUS

8·

payload bytes

00000000  38 19 18 17 17 15 14 13  12 00 00 00 00 00        |8.............|

2026-10-10 19:48:3691.230.168.220to 17184/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 20 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |. ..........UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 17:30:0491.231.89.89to 427/udpUnrecognisedFR

·=·en·service:VMwareInfrastructure·DEFAULT·

payload bytes

00000000  02 01 00 00 3d 00 00 00  00 00 12 06 00 02 65 6e  |....=.........en|
00000010  00 00 00 1c 73 65 72 76  69 63 65 3a 56 4d 77 61  |....service:VMwa|
00000020  72 65 49 6e 66 72 61 73  74 72 75 63 74 75 72 65  |reInfrastructure|
00000030  00 07 44 45 46 41 55 4c  54 00 00 00 00           |..DEFAULT....|