UDP traffic

Datagrams matching asn:21859 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

165

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

56 datagrams from 16 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 31 TFTP 6 CLDAP 3 DNS 3 Sun RPC 3 SSDP 3 SOAP 3 NetBIOS 2 NTP 2

Latest SNMP datagram, to 161/udp

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

Other services

17 datagrams from 10 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

GTP-C 6 SIP 5 GTP-U 3 Redis 3

Latest GTP-C datagram, to 2123/udp

@· ·

payload bytes

00000000  40 01 00 09 00 ab cd 00  03 00 01 00 00           |@............|

Unrecognised

89 datagrams from 13 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 89

Latest Unrecognised datagram, to 47808/udp

· ·!·?· · · , : F K M y·

payload bytes

00000000  81 0a 00 21 01 04 02 05  01 0e 0c 02 3f ff ff 1e  |...!........?...|
00000010  09 0c 09 1c 09 2c 09 3a  09 46 09 4b 09 4d 09 79  |.....,.:.F.K.M.y|
00000020  1f                                                |.|

Peer-to-peer

3 datagrams from 3 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 3

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	31	9	6.3
TFTP	69/udp +1	9	7	60
RIPv1	520/udp	6	5	131.24
Portmap	111/udp	3	3	7 to 28
mDNS	5353/udp	3	3	2 to 10
CLDAP	389/udp	3	3	56 to 70
CharGEN	19/udp	3	3	358.8
SSDP	1900/udp	3	3	30.8
Memcached	11211/udp	3	3	10,000 to 51,000
WS-Discovery	3702/udp	3	3	10 to 500
NTP	123/udp	2	2	556.9
NetBIOS	137/udp	2	2	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP31
1434/udp MSSQL Browser9
520/udp RIP6
6969/udp6
69/udp TFTP6
2152/udp GTP-U6
2123/udp GTP-C6
5060/udp SIP5
500/udp IKE4
7/udp3
27016/udp3
389/udp CLDAP3

DNS questions

_services._dns-sd._udp.local PTR3

DNS record types

PTR3

Networks

AS21859 Zenlayer Inc from 16 sources165

Countries

PT Portugal165

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
109.105.210.62	AS21859 Zenlayer Inc	PT	Unrecognised	20	2026-10-09 08:20
185.180.141.9	AS21859 Zenlayer Inc	PT	Unrecognised	17	2026-10-09 08:20
185.180.141.10	AS21859 Zenlayer Inc	PT	Unrecognised	15	2026-10-09 08:19
185.226.197.30	AS21859 Zenlayer Inc	PT	Unrecognised	15	2026-10-10 02:48
185.180.141.7	AS21859 Zenlayer Inc	PT	Unrecognised	13	2026-10-09 08:19
185.226.197.28	AS21859 Zenlayer Inc	PT	Unrecognised	13	2026-10-10 02:48
109.105.210.65	AS21859 Zenlayer Inc	PT	Unrecognised	12	2026-10-09 08:21
185.226.197.27	AS21859 Zenlayer Inc	PT	Unrecognised	12	2026-10-10 02:49
109.105.210.64	AS21859 Zenlayer Inc	PT	Unrecognised	11	2026-10-09 08:21
185.226.197.29	AS21859 Zenlayer Inc	PT	Unrecognised	8	2026-10-10 02:49
109.105.210.63	AS21859 Zenlayer Inc	PT	Unrecognised	7	2026-10-09 08:21
185.226.196.29	AS21859 Zenlayer Inc	PT	SNMP	6	2026-10-06 07:50
185.226.196.27	AS21859 Zenlayer Inc	PT	Unrecognised	5	2026-10-06 07:50
185.180.141.8	AS21859 Zenlayer Inc	PT	Unrecognised	5	2026-10-09 08:19
185.226.196.30	AS21859 Zenlayer Inc	PT	SNMP	3	2026-10-06 07:51
185.226.196.28	AS21859 Zenlayer Inc	PT	SNMP	3	2026-10-06 07:49

Latest datagrams

2026-10-10 02:49:54185.226.197.29to 47808/udpUnrecognisedPT

· ·!·?· · · , : F K M y·

payload bytes

00000000  81 0a 00 21 01 04 02 05  01 0e 0c 02 3f ff ff 1e  |...!........?...|
00000010  09 0c 09 1c 09 2c 09 3a  09 46 09 4b 09 4d 09 79  |.....,.:.F.K.M.y|
00000020  1f                                                |.|

2026-10-10 02:49:41185.226.197.27to 30718/udpUnrecognisedPT
·
payload bytes
```
00000000  00 00 00 f8                                       |....|
```

2026-10-10 02:49:28185.226.197.27to 28015/udpUnrecognisedPT

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-10 02:49:10185.226.197.29to 27016/udpUnrecognisedPT

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-10 02:48:52185.226.197.30to 27015/udpUnrecognisedPT

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-10 02:48:39185.226.197.27to 11211/udpUnrecognisedPT
·stats
payload bytes
```
00000000  00 00 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|
```
2026-10-10 02:48:26185.226.197.28to 10001/udpUnrecognisedPT
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```
2026-10-10 02:48:13185.226.197.30to 6969/udpTFTPPT
·/a·netascii·
payload bytes
```
00000000  00 01 2f 61 00 6e 65 74  61 73 63 69 69 00        |../a.netascii.|
```
2026-10-10 02:48:00185.226.197.30to 6969/udpUnrecognisedPT
·'·8O·
payload bytes
```
00000000  00 00 04 17 27 10 19 80  00 00 00 00 38 4f 89 8b  |....'.......8O..|
```

2026-10-10 02:47:47185.226.197.28to 6881/udpBitTorrentPT

d1:ad2:id20:WliLiGT61ZBWhpOJvsC36:target20:YEKWZcYiwzyV5AaogEnj4:want4:n4n6e1:q9:find_node1:t2:Mh1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 57 6c 69 4c  |d1:ad2:id20:WliL|
00000010  69 47 54 36 31 5a 42 57  68 70 4f 4a 76 73 43 33  |iGT61ZBWhpOJvsC3|
00000020  36 3a 74 61 72 67 65 74  32 30 3a 59 45 4b 57 5a  |6:target20:YEKWZ|
00000030  63 59 69 77 7a 79 56 35  41 61 6f 67 45 6e 6a 34  |cYiwzyV5AaogEnj4|
00000040  3a 77 61 6e 74 34 3a 6e  34 6e 36 65 31 3a 71 39  |:want4:n4n6e1:q9|
00000050  3a 66 69 6e 64 5f 6e 6f  64 65 31 3a 74 32 3a 4d  |:find_node1:t2:M|
00000060  68 31 3a 79 31 3a 71 65                           |h1:y1:qe|

2026-10-10 02:47:34185.226.197.29to 5632/udpUnrecognisedPT

NQ·A·

payload bytes

00000000  4e 51 00 00 00 00 00 00  00 00 00 00 00 00 41 f4  |NQ............A.|
00000010  bf a6                                             |..|

2026-10-10 02:46:56185.226.197.28to 5353/udpDNSPT

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-10 02:46:42185.226.197.29to 5060/udpSIPPT

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport From: <sip:nm@nm>;tag=root To: <sip:nm2@nm2> Call-ID: 50000 CSeq: 42 OPTIONS Max-Forwards: 70 Content-Length: 0 Contact: <sip:nm@nm>

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 46 72  |ch=foo;rport..Fr|
00000040  6f 6d 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 3b  |om: <sip:nm@nm>;|
00000050  74 61 67 3d 72 6f 6f 74  0d 0a 54 6f 3a 20 3c 73  |tag=root..To: <s|
00000060  69 70 3a 6e 6d 32 40 6e  6d 32 3e 0d 0a 43 61 6c  |ip:nm2@nm2>..Cal|
00000070  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000080  71 3a 20 34 32 20 4f 50  54 49 4f 4e 53 0d 0a 4d  |q: 42 OPTIONS..M|
00000090  61 78 2d 46 6f 72 77 61  72 64 73 3a 20 37 30 0d  |ax-Forwards: 70.|
000000a0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000b0  20 30 0d 0a 43 6f 6e 74  61 63 74 3a 20 3c 73 69  | 0..Contact: <si|
000000c0  70 3a 6e 6d 40 6e 6d 3e  0d 0a 41 63 63 65 70 74  |p:nm@nm>..Accept|
000000d0  3a 20 61 70 70 6c 69 63  61 74 69 6f 6e 2f 73 64  |: application/sd|
000000e0  70 0d 0a 0d 0a                                    |p....|

2026-10-10 02:46:29185.226.197.30to 4800/udpUnrecognisedPT
·
payload bytes
```
00000000  01 00 00 08 00 00 00 00                           |........|
```

2026-10-10 02:46:15185.226.197.28to 4500/udpUnrecognisedPT

·"3·B·W·n·s·g/·(·p·(·p·

payload bytes

00000000  c1 22 33 9d 00 00 00 42  c0 57 ac 8f 10 6e 84 73  |."3....B.W...n.s|
00000010  10 f5 85 a8 b0 b4 67 2f  00 00 00 00 00 00 00 00  |......g/........|
00000020  01 10 02 00 00 00 00 00  00 00 03 c0 00 00 03 a4  |................|
00000030  00 00 00 01 00 00 00 01  00 00 03 98 01 01 00 18  |................|
00000040  03 00 00 28 01 01 00 00  80 01 00 07 80 02 00 05  |...(............|
00000050  80 03 00 01 80 04 00 02  80 0e 01 00 80 0b 00 01  |................|
00000060  00 0c 00 04 00 00 70 80  03 00 00 28 02 01 00 00  |......p....(....|
00000070  80 01 00 07 80 02 00 05  80 03 00 01 80 04 00 0e  |................|
00000080  80 0e 01 00 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
00000090  03 00 00 28 03 01 00 00  80 01 00 07 80 02 00 05  |...(............|
000000a0  80 03 00 0a 80 04 00 0e  80 0e 01 00 80 0b 00 01  |................|
000000b0  00 0c 00 04 00 00 70 80  03 00 00 28 04 01 00 00  |......p....(....|
000000c0  80 01 00 07 80 02 00 04  80 03 00 03 80 04 00 0e  |................|
000000d0  80 0e 01 00 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
000000e0  03 00 00 28 05 01 00 00  80 01 00 07 80 02 00 04  |...(............|
000000f0  80 03 00 01 80 04 00 0e  80 0e 01 00 80 0b 00 01  |................|
... 512 bytes shown in part