UDP traffic
Datagrams matching asn:36352 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
27
Datagrams
7
Source addresses
1
Networks
1
Countries
11
Destination ports
Traffic by type
Other services
1 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest OOKLA datagram, to 8080/udp
payload bytes
00000000 78 2e 45 03 5b 66 48 05 44 49 56 0f 33 3d 4f 62 |x.E.[fH.DIV.3=Ob| 00000010 12 2b 38 41 39 54 12 54 02 15 51 00 04 26 3f 7c |.+8A9T.T..Q..&?|| 00000020 04 04 7f 5f 6a 47 64 2e 10 3a 3d 43 7d 60 |..._jGd..:=C}`|
Unrecognised
24 datagrams from 7 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 1900/udp
payload bytes
00000000 0f 2e 26 47 03 47 28 21 5c 78 49 7a 64 68 58 63 |..&G.G(!\xIzdhXc| 00000010 39 5c 1f 21 6c 46 27 37 40 3c 22 75 6e 71 45 7d |9\.!lF'7@<"unqE}| 00000020 21 6b 45 24 a8 e7 |!kE$..|
Peer-to-peer
2 datagrams from 1 sourceFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| mDNS | 5353/udp | 4 | 4 | 2 to 10 |
| Memcached | 11211/udp | 2 | 2 | 10,000 to 51,000 |
| SSDP | 1900/udp | 1 | 1 | 30.8 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 172.245.90.204 | AS36352 HostPapa | US | Unrecognised | 11 | 2026-10-11 07:21 |
| 172.245.43.228 | AS36352 HostPapa | US | Unrecognised | 6 | 2026-10-10 10:55 |
| 107.173.67.223 | AS36352 HostPapa | US | Unrecognised | 3 | 2026-10-11 07:10 |
| 107.174.181.21 | AS36352 HostPapa | US | Unrecognised | 3 | 2026-10-09 03:07 |
| 192.236.230.186 | AS36352 HostPapa | US | Unrecognised | 2 | 2026-10-08 11:22 |
| 66.212.21.31 | AS36352 HostPapa | US | Unrecognised | 1 | 2026-10-06 23:09 |
| 23.238.46.196 | AS36352 HostPapa | US | Unrecognised | 1 | 2026-10-07 12:40 |
Latest datagrams
payload bytes
00000000 0f 2e 26 47 03 47 28 21 5c 78 49 7a 64 68 58 63 |..&G.G(!\xIzdhXc| 00000010 39 5c 1f 21 6c 46 27 37 40 3c 22 75 6e 71 45 7d |9\.!lF'7@<"unqE}| 00000020 21 6b 45 24 a8 e7 |!kE$..|
payload bytes
00000000 40 2e 52 14 09 48 35 46 07 43 4d 73 64 39 7a 6f |@.R..H5F.CMsd9zo| 00000010 51 1a 0f 55 0f 42 3e 7e 76 5b 02 02 09 6d 11 49 |Q..U.B>~v[...m.I| 00000020 5a 64 5d 63 2c 13 29 33 56 77 27 3b 30 21 2a 01 |Zd]c,.)3Vw';0!*.| 00000030 3c 39 56 4b 7b 15 49 71 70 4b 74 79 38 05 ff b2 |<9VK{.IqpKty8...|payload bytes
00000000 45 2e 0e 6e 3b 35 35 5c 65 49 5f 7c 08 59 56 55 |E..n;55\eI_|.YVU| 00000010 28 33 39 40 3e 2a 1c 32 7e 41 2b 21 68 08 20 2e |(39@>*.2~A+!h. .| 00000020 14 2e 1c 50 63 52 2c 48 1b 0b 44 23 64 1a 79 0c |...PcR,H..D#d.y.| 00000030 4d 32 4d 0c 5c 69 3e 5a 2b 69 7b 13 71 1b 41 06 |M2M.\i>Z+i{.q.A.| 00000040 4a 5e 56 2d 30 02 76 4b 0d 3a 6e 72 55 67 7e 22 |J^V-0.vK.:nrUg~"| 00000050 19 4b 2e 75 35 6c 4f eb 2d |.K.u5lO.-|payload bytes
00000000 43 2e 0e 4c 60 7b 7e 30 68 61 65 54 24 37 0b 70 |C..L`{~0haeT$7.p| 00000010 7c 24 16 62 41 55 46 75 58 40 7d 37 7b 77 4f 3e ||$.bAUFuX@}7{wO>| 00000020 15 5d 0a 75 58 09 25 41 6a 0a 15 0f 42 20 7f 3e |.].uX.%Aj...B .>| 00000030 44 15 20 06 6b 67 7b 43 27 78 7a 22 6f 49 60 04 |D. .kg{C'xz"oI`.| 00000040 26 6a 7a 7f 73 1f 40 5e 2a 55 6d 6c 76 6c 2a 3a |&jz.s.@^*Umlvl*:| 00000050 02 4a 06 b9 |.J..|payload bytes
00000000 39 2e 12 6b 62 40 36 22 55 31 06 1e 23 73 53 02 |9..kb@6"U1..#sS.| 00000010 11 5c 76 3d 30 64 28 5e 3a 7d 26 88 2b |.\v=0d(^:}&.+|
payload bytes
00000000 40 2e 46 64 63 46 51 61 2d 2a 03 56 12 7f 2b 7a |@.FdcFQa-*.V..+z| 00000010 74 20 2b 70 08 04 3d 0e 5c 0c 69 27 56 23 3a 17 |t +p..=.\.i'V#:.| 00000020 31 00 7b 14 46 4c a2 ed |1.{.FL..|payload bytes
00000000 37 2e 35 3b 1d 5c 3d 0d 38 3f 2d 69 2a 67 4d 4b |7.5;.\=.8?-i*gMK| 00000010 12 39 61 79 7d 7d 7e 09 54 40 65 59 32 27 19 69 |.9ay}}~.T@eY2'.i| 00000020 59 4f 25 77 2b 62 04 64 21 32 1a b7 |YO%w+b.d!2..|
payload bytes
00000000 6e 2e 22 18 44 43 04 79 40 0a 1c 6a 4f 7b 22 2e |n.".DC.y@..jO{".| 00000010 55 26 1e 65 19 4d 14 08 01 2e 55 4e 3b 32 29 2a |U&.e.M....UN;2)*| 00000020 53 4b 42 17 0e 46 10 4f 50 2c 39 20 28 5c 4e 7d |SKB..F.OP,9 (\N}| 00000030 02 6c 62 1c 39 76 24 3a 25 7a 08 60 2c 31 0a 7f |.lb.9v$:%z.`,1..| 00000040 7c 4d 16 0b 13 26 5a 64 52 13 04 7a 6f 52 77 72 ||M...&ZdR..zoRwr| 00000050 3e 59 78 38 |>Yx8|payload bytes
00000000 3b 2e 5c 71 2f 0e 79 51 1d 74 27 64 73 0e 5a e7 |;.\q/.yQ.t'ds.Z.|
payload bytes
00000000 5c 2e 08 6c 1e 4a 3b 3c 27 2a 3c 3e 2f 4e 0f 51 |\..l.J;<'*<>/N.Q| 00000010 1a 21 67 69 63 42 0a 0a 3b 13 77 3d 37 78 1e 13 |.!gicB..;.w=7x..| 00000020 0e 26 3d f2 |.&=.|
payload bytes
00000000 6e 2e 28 0e 66 5e 63 50 68 75 12 56 53 09 3a 75 |n.(.f^cPhu.VS.:u| 00000010 54 40 1c 63 0d 51 03 20 49 76 6b 46 31 71 16 98 |T@.c.Q. IvkF1q..| 00000020 d9 |.|
payload bytes
00000000 78 2e 45 03 5b 66 48 05 44 49 56 0f 33 3d 4f 62 |x.E.[fH.DIV.3=Ob| 00000010 12 2b 38 41 39 54 12 54 02 15 51 00 04 26 3f 7c |.+8A9T.T..Q..&?|| 00000020 04 04 7f 5f 6a 47 64 2e 10 3a 3d 43 7d 60 |..._jGd..:=C}`|
payload bytes
00000000 0b 2e 58 23 47 36 58 03 1f 6e 12 59 72 03 41 3a |..X#G6X..n.Yr.A:| 00000010 f3 |.|
payload bytes
00000000 63 2e 50 12 6c 71 2a 0e 33 66 12 38 10 32 1e 22 |c.P.lq*.3f.8.2."| 00000010 6d f6 8b |m..|
payload bytes
00000000 53 2e 5e 6a 14 62 34 1d 49 79 36 40 0a 3f 1a 51 |S.^j.b4.Iy6@.?.Q| 00000010 22 |"|