UDP traffic
Datagrams matching asn:28209 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
7
Datagrams
1
Source addresses
1
Networks
1
Countries
6
Destination ports
Traffic by type
Other services
1 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest OOKLA datagram, to 8080/udp
payload bytes
00000000 7e 2e 37 36 01 11 1f 6b 42 29 78 1d 14 68 07 37 |~.76...kB)x..h.7|
00000010 15 6e 53 5f 37 66 6b 2b 2c 67 3b 47 7d 44 02 7b |.nS_7fk+,g;G}D.{|
00000020 08 3a 32 09 4b 51 75 0d 7a 6d 2a 0e 55 31 45 6a |.:2.KQu.zm*.U1Ej|
00000030 20 18 49 57 7e 34 02 2a 1b 3d 72 18 cd c1 | .IW~4.*.=r...|Unrecognised
6 datagrams from 1 sourceDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 8000/udp
payload bytes
00000000 51 2e 3d 46 4f 72 67 61 61 1b 58 55 52 57 2c 74 |Q.=FOrgaa.XURW,t|
00000010 57 23 2c 66 35 3b 0b 11 1a 7b 64 1a 70 2f 4f 41 |W#,f5;...{d.p/OA|
00000020 2c 0d 08 7b 7f 6f 5c 61 0b 34 36 5d 0b 62 51 62 |,..{.o\a.46].bQb|
00000030 05 7d 48 3a 38 53 4c 53 4f 30 6d 3f 60 3c 00 0c |.}H:8SLSO0m?`<..|
00000040 49 08 08 49 78 ed b2 |I..Ix..|Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 1 | 1 | 2 to 10 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 189.113.8.254 | AS28209 Under Servicos de Internet Ltda | BR | Unrecognised | 7 | 2026-10-09 17:01 |
Latest datagrams
payload bytes
00000000 51 2e 3d 46 4f 72 67 61 61 1b 58 55 52 57 2c 74 |Q.=FOrgaa.XURW,t| 00000010 57 23 2c 66 35 3b 0b 11 1a 7b 64 1a 70 2f 4f 41 |W#,f5;...{d.p/OA| 00000020 2c 0d 08 7b 7f 6f 5c 61 0b 34 36 5d 0b 62 51 62 |,..{.o\a.46].bQb| 00000030 05 7d 48 3a 38 53 4c 53 4f 30 6d 3f 60 3c 00 0c |.}H:8SLSO0m?`<..| 00000040 49 08 08 49 78 ed b2 |I..Ix..|payload bytes
00000000 48 2e 2a 0a 70 67 02 04 4a 72 21 03 30 3f 1e 75 |H.*.pg..Jr!.0?.u| 00000010 7e 12 1d 51 5a |~..QZ|
payload bytes
00000000 41 2e 12 7b 73 44 7c 26 0a 79 71 2c 62 09 4e 70 |A..{sD|&.yq,b.Np| 00000010 6b 0c 47 16 02 4a 37 63 32 65 11 7e 11 3b 64 52 |k.G..J7c2e.~.;dR| 00000020 01 77 4d 74 3b 49 1a 45 42 0b 71 24 15 3f 15 00 |.wMt;I.EB.q$.?..| 00000030 4b 63 f3 |Kc.|payload bytes
00000000 34 2e 7c 03 6a 61 58 12 64 3d 3a 16 3d 05 4e 54 |4.|.jaX.d=:.=.NT| 00000010 3e 4d 2f 0a 47 32 34 56 2f 27 4c 6d 76 25 22 2a |>M/.G24V/'Lmv%"*| 00000020 23 1e 2e 0e 00 06 20 64 43 5a 7a 01 5f 48 55 1d |#..... dCZz._HU.| 00000030 15 04 27 5c 36 5c 32 65 03 7f 52 79 e4 8b |..'\6\2e..Ry..|
payload bytes
00000000 7e 2e 37 36 01 11 1f 6b 42 29 78 1d 14 68 07 37 |~.76...kB)x..h.7| 00000010 15 6e 53 5f 37 66 6b 2b 2c 67 3b 47 7d 44 02 7b |.nS_7fk+,g;G}D.{| 00000020 08 3a 32 09 4b 51 75 0d 7a 6d 2a 0e 55 31 45 6a |.:2.KQu.zm*.U1Ej| 00000030 20 18 49 57 7e 34 02 2a 1b 3d 72 18 cd c1 | .IW~4.*.=r...|payload bytes
00000000 76 2e 19 79 17 2f 32 00 7f 28 42 16 43 74 32 21 |v..y./2..(B.Ct2!| 00000010 66 48 46 59 17 40 45 6b 67 45 65 7d 57 5c ed |fHFY.@EkgEe}W\.|
payload bytes
00000000 10 2e 0e 20 0b 65 68 41 26 4e 15 1b 3e 43 64 5e |... .ehA&N..>Cd^| 00000010 2f 6b 6b 61 55 3b 33 43 0b 46 7f 46 1d 3e 51 2d |/kkaU;3C.F.F.>Q-| 00000020 12 60 4d 1d 45 35 5e 6b 03 73 06 41 36 6b 20 65 |.`M.E5^k.s.A6k e| 00000030 56 0b 46 2b 47 79 6e 52 3f 6d 18 5c 2b 69 09 e0 |V.F+GynR?m.\+i..| 00000040 e8 |.|