UDP traffic

Datagrams matching asn:3320 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Unrecognised

37 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 37

Latest Unrecognised datagram, to 5060/udp

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

55493/udp20
51820/udp WireGuard6
4000/udp3
1434/udp MSSQL Browser2
5060/udp SIP2
8082/udp2
5353/udp mDNS1
6881/udp BitTorrent1
8081/udp1

Networks

AS3320 Deutsche Telekom AG from 8 sources38

Countries

DE Germany38

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
87.159.30.86	AS3320 Deutsche Telekom AG	DE	Unrecognised	20	2026-10-09 21:33
62.225.65.90	AS3320 Deutsche Telekom AG	DE	Unrecognised	6	2026-10-08 03:43
217.239.6.195	AS3320 Deutsche Telekom AG	DE	Unrecognised	3	2026-10-08 17:36
217.239.0.128	AS3320 Deutsche Telekom AG	DE	Unrecognised	3	2026-10-07 02:21
217.239.14.77	AS3320 Deutsche Telekom AG	DE	Unrecognised	2	2026-10-08 01:45
217.239.14.187	AS3320 Deutsche Telekom AG	DE	Unrecognised	2	2026-10-05 20:14
87.150.15.111	AS3320 Deutsche Telekom AG	DE	Unrecognised	1	2026-10-10 06:08
91.34.37.59	AS3320 Deutsche Telekom AG	DE	Unrecognised	1	2026-10-11 04:21

Latest datagrams

2026-10-11 04:21:0291.34.37.59to 5060/udpUnrecognisedDE

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

2026-10-10 06:08:3587.150.15.111to 8081/udpUnrecognisedDE

_.luGJu"__8y·#W9(Q#·!fD\· ·g`bRMW·M<v,tpD·G}@· V%%w·iT·

payload bytes

00000000  5f 2e 6c 75 47 4a 75 22  5f 5f 38 79 17 23 57 39  |_.luGJu"__8y.#W9|
00000010  28 51 23 16 0c 05 21 66  44 5c 06 09 03 67 60 62  |(Q#...!fD\...g`b|
00000020  52 4d 57 1a 17 4d 3c 76  2c 74 70 44 17 47 7d 40  |RMW..M<v,tpD.G}@|
00000030  18 20 56 25 25 77 0b 69  54 04 08                 |. V%%w.iT..|

2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-09 21:33:3987.159.30.86to 55493/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```