UDP traffic

Datagrams matching asn:396982 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.7K

Datagrams

721

Source addresses

Networks

Countries

130

Destination ports

Traffic by type

Service queries

591 datagrams from 287 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 212 NTP 142 SNMP 111 SSDP 54 NetBIOS 39 TFTP 21 CoAP 8 mDNS 4

Latest DNS datagram, to 53/udp

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

Other services

480 datagrams from 310 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 408 SIP 38 Kerberos 21 XDMCP 7 RADIUS 6

Latest DTLS datagram, to 13146/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

663 datagrams from 462 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 663

Latest Unrecognised datagram, to 47806/udp

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

Peer-to-peer

6 datagrams from 6 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 6

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	188	86	28 to 54
SNMPv2	161/udp	111	65	6.3
SSDP	1900/udp +3	54	52	30.8
NTP	123/udp	142	39	556.9
NetBIOS	137/udp +3	39	39	3.8
mDNS	5353/udp	28	28	2 to 10
TFTP	69/udp	21	21	60
RIPv1	520/udp	6	6	131.24
CharGEN	19/udp	6	6	358.8
QOTD	17/udp	6	6	140.3
WS-Discovery	3702/udp	5	5	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS159
123/udp NTP142
161/udp SNMP111
4500/udp IPsec NAT-T48
5632/udp pcAnywhere46
5351/udp NAT-PMP43
500/udp IKE42
1900/udp SSDP37
17185/udp37
5353/udp DNS28
12746/udp DTLS26
13746/udp DTLS25

DNS questions

DNS record types

TXT160
PTR41
ANY7

Networks

AS396982 Google LLC from 721 sources1,740

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
216.180.246.179	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:47
216.180.246.155	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:00
216.180.246.230	AS396982 Google LLC	US	DNS	17	2026-10-07 11:04
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.225	AS396982 Google LLC	US	DNS	17	2026-10-07 11:15
216.180.246.217	AS396982 Google LLC	US	DNS	17	2026-10-07 16:46
34.38.244.230	AS396982 Google LLC	BE	NTP	14	2026-10-06 09:28
130.211.71.27	AS396982 Google LLC	BE	NTP	11	2026-10-06 12:24
34.140.212.21	AS396982 Google LLC	BE	NTP	10	2026-10-09 09:19
216.180.246.33	AS396982 Google LLC	US	SNMP	10	2026-10-08 17:36
34.156.255.194	AS396982 Google LLC	BE	NTP	10	2026-10-08 12:22
216.180.246.207	AS396982 Google LLC	US	DNS	10	2026-10-07 16:25
35.187.52.176	AS396982 Google LLC	BE	NTP	9	2026-10-07 11:52
216.180.246.214	AS396982 Google LLC	US	DNS	9	2026-10-10 16:32
147.185.132.231	AS396982 Google LLC	US	Unrecognised	8	2026-10-10 05:18
35.187.14.234	AS396982 Google LLC	BE	NTP	8	2026-10-10 12:04
34.22.199.123	AS396982 Google LLC	BE	NTP	8	2026-10-10 11:58
198.235.24.80	AS396982 Google LLC	US	Unrecognised	8	2026-10-10 19:06
198.235.24.97	AS396982 Google LLC	US	Unrecognised	7	2026-10-10 23:30

Latest datagrams

2026-10-11 03:26:52205.210.31.170to 13146/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:11:33198.235.24.57to 12546/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:09:10216.25.89.113to 53/udpDNSUS

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:02:23147.185.132.210to 161/udpSNMPUS

0&·public·c·0·0 ·+·

payload bytes

00000000  30 26 02 01 01 04 06 70  75 62 6c 69 63 a1 19 02  |0&.....public...|
00000010  04 dc 63 c2 9a 02 01 00  02 01 00 30 0b 30 09 06  |..c........0.0..|
00000020  05 2b 06 01 02 01 05 00                           |.+......|

2026-10-11 03:00:01198.235.24.185to 88/udpKerberosUS

j·0· ·x0v·@·0· 0·Xpanse· REALM.com·0·0·krbtgt· REALM.com·20231123004255Z· Jv·0·

payload bytes

00000000  6a 81 87 30 81 84 a1 03  02 01 05 a2 03 02 01 0a  |j..0............|
00000010  a4 78 30 76 a0 07 03 05  00 40 00 00 00 a1 13 30  |.x0v.....@.....0|
00000020  11 a0 03 02 01 01 a1 0a  30 08 1b 06 58 70 61 6e  |........0...Xpan|
00000030  73 65 a2 0b 1b 09 52 45  41 4c 4d 2e 63 6f 6d a3  |se....REALM.com.|
00000040  1e 30 1c a0 03 02 01 02  a1 15 30 13 1b 06 6b 72  |.0........0...kr|
00000050  62 74 67 74 1b 09 52 45  41 4c 4d 2e 63 6f 6d a5  |btgt..REALM.com.|
00000060  11 18 0f 32 30 32 33 31  31 32 33 30 30 34 32 35  |...2023112300425|
00000070  35 5a a7 06 02 04 09 4a  76 81 a8 0e 30 0c 02 01  |5Z.....Jv...0...|
00000080  12 02 01 11 02 01 10 02  01 17                    |..........|

2026-10-11 02:59:22147.185.132.21to 12646/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 02:53:1435.203.210.27to 47806/udpUnrecognisedGB

· ·?·K

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b                                                |K|

2026-10-11 02:49:57205.210.31.242to 12146/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 02:46:13147.185.132.147to 5632/udpUnrecognisedUS
ST
payload bytes
```
00000000  53 54                                             |ST|
```
2026-10-11 02:39:12162.216.149.118to 21433/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 02:35:0935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:34:2535.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:33:50198.235.24.95to 12446/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 02:29:06147.185.132.74to 61433/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 02:23:23147.185.132.198to 12746/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|