HoneyLabs

UDP traffic

Datagrams matching asn:37963 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Your plan searches up to 7d, so 30d was shortened. Plans

233

Datagrams

32

Source addresses

1

Networks

1

Countries

61

Destination ports

Traffic by type

Service queries

13 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Latest CoAP datagram, to 43578/udp

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

payload bytes
00000000  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000010  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000020  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000030  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000040  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000050  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000060  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000070  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000080  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
00000090  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000a0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000b0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000c0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000d0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000e0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|
000000f0  43 43 43 43 43 43 43 43  43 43 43 43 43 43 43 43  |CCCCCCCCCCCCCCCC|

Unrecognised

220 datagrams from 30 sources

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 8000/udp

q.·mZA+·,xzjuA7·NnWm·s·~Y·a·KRc@

payload bytes
00000000  71 2e 1b 6d 5a 41 2b 1f  2c 78 7a 6a 75 41 37 13  |q..mZA+.,xzjuA7.|
00000010  11 4e 6e 57 6d 1e 73 12  16 7e 59 0b 61 06 4b 52  |.NnWm.s..~Y.a.KR|
00000020  63 40                                             |c@|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
NTP123/udp41556.9
DNS53/udp1128 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

DNS record types

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
118.31.71.226AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-06 18:45
121.40.45.152AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-06 12:03
47.95.192.150AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-07 15:14
47.94.136.50AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-08 17:47
121.41.167.96AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-05 15:58
112.124.59.239AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-05 16:42
47.95.196.164AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 10:18
47.99.106.159AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-06 21:49
121.41.166.75AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 03:03
47.99.105.95AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 08:50
121.41.165.209AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 10:30
121.43.145.219AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-07 05:08
47.97.199.68AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-07 11:13
121.199.163.131AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-08 07:03
121.40.46.218AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-06 17:43
47.95.201.222AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 06:50
47.94.131.134AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 04:56
121.199.172.2AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-09 12:18
121.40.47.206AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-08 12:00
47.94.165.91AS37963 Hangzhou Alibaba Advertising Co.,Ltd.CNUnrecognised82026-10-08 11:14

Latest datagrams