UDP traffic

Datagrams matching asn:396982 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

338

Datagrams

234

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

122 datagrams from 57 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 60 NTP 31 SNMP 15 NetBIOS 5 SSDP 5 mDNS 2 CoAP 2 TFTP 2

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

Other services

83 datagrams from 77 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 70 SIP 6 Kerberos 5 XDMCP 1 RADIUS 1

Latest DTLS datagram, to 12446/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

132 datagrams from 123 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 132

Latest Unrecognised datagram, to 500/udp

·O,·P·4·(·$·p·$·p·$·p·$·p·$·p·$

payload bytes

00000000  f2 4f 2c dd 17 1c b3 d5  00 00 00 00 00 00 00 00  |.O,.............|
00000010  01 10 02 00 00 00 00 00  00 00 01 50 00 00 01 34  |...........P...4|
00000020  00 00 00 01 00 00 00 01  00 00 01 28 01 01 00 08  |...........(....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 70 80 03 00 00 24  02 01 00 00 80 01 00 05  |..p....$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 70 80  03 00 00 24 03 01 00 00  |......p....$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 70 80 03 00 00 24  |..........p....$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
000000c0  03 00 00 24 05 01 00 00  80 01 00 05 80 02 00 02  |...$............|
000000d0  80 03 00 01 80 04 00 01  80 0b 00 01 00 0c 00 04  |................|
000000e0  00 00 70 80 03 00 00 24  06 01 00 00 80 01 00 05  |..p....$........|
000000f0  80 02 00 01 80 03 00 01  80 04 00 01 80 0b 00 01  |................|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	56	16	28 to 54
SNMPv2	161/udp	15	15	6.3
NTP	123/udp	31	9	556.9
mDNS	5353/udp	6	6	2 to 10
NetBIOS	137/udp +1	5	5	3.8
SSDP	1900/udp +1	5	5	30.8
TFTP	69/udp	2	2	60
RIPv1	520/udp	1	1	131.24
CharGEN	19/udp	1	1	358.8
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS51
123/udp NTP31
161/udp SNMP15
5632/udp pcAnywhere8
12746/udp DTLS8
4500/udp IPsec NAT-T8
13946/udp DTLS7
5353/udp DNS6
500/udp IKE6
13646/udp DTLS5
12546/udp DTLS5
427/udp SLP5

DNS questions

DNS record types

TXT50
PTR7
ANY3

Networks

AS396982 Google LLC from 234 sources338

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.214	AS396982 Google LLC	US	DNS	9	2026-10-10 16:32
34.22.219.27	AS396982 Google LLC	BE	NTP	8	2026-10-11 08:35
35.233.53.61	AS396982 Google LLC	BE	NTP	8	2026-10-11 08:45
35.187.115.138	AS396982 Google LLC	BE	NTP	7	2026-10-11 08:47
216.25.89.125	AS396982 Google LLC	US	NTP	4	2026-10-11 04:54
198.235.24.222	AS396982 Google LLC	US	Unrecognised	3	2026-10-10 15:02
147.185.132.40	AS396982 Google LLC	US	Unrecognised	3	2026-10-11 03:40
198.235.24.48	AS396982 Google LLC	US	DTLS	3	2026-10-10 17:26
147.185.132.198	AS396982 Google LLC	US	SNMP	3	2026-10-11 04:12
147.185.132.103	AS396982 Google LLC	US	SNMP	2	2026-10-10 18:43
216.25.89.101	AS396982 Google LLC	US	Unrecognised	2	2026-10-10 17:23
198.235.24.252	AS396982 Google LLC	US	Unrecognised	2	2026-10-11 00:01
198.235.24.97	AS396982 Google LLC	US	DTLS	2	2026-10-10 23:30
216.25.89.108	AS396982 Google LLC	US	Unrecognised	2	2026-10-11 04:58
205.210.31.96	AS396982 Google LLC	US	Unrecognised	2	2026-10-10 22:37
147.185.132.112	AS396982 Google LLC	US	DTLS	2	2026-10-10 18:13
198.235.24.185	AS396982 Google LLC	US	SIP	2	2026-10-11 03:00
205.210.31.59	AS396982 Google LLC	US	DTLS	2	2026-10-11 08:02

Latest datagrams

2026-10-11 08:47:0435.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:45:3935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:45:3235.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:35:2034.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:35:1534.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:29:06205.210.31.246to 12446/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 08:12:0935.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 08:06:48205.210.31.223to 13946/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 08:03:56147.185.132.252to 12346/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 08:02:41205.210.31.59to 12646/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 08:02:28198.235.24.194to 13546/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 07:59:2335.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 07:29:14147.185.132.129to 500/udpUnrecognisedUS

·O,·P·4·(·$·p·$·p·$·p·

payload bytes

00000000  f2 4f 2c dd 17 1c b3 d5  00 00 00 00 00 00 00 00  |.O,.............|
00000010  01 10 02 00 00 00 00 00  00 00 01 50 00 00 01 34  |...........P...4|
00000020  00 00 00 01 00 00 00 01  00 00 01 28 01 01 00 08  |...........(....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 70 80 03 00 00 24  02 01 00 00 80 01 00 05  |..p....$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 70 80  03 00 00 24 03 01 00 00  |......p....$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 70 80 03 00 00 24  |..........p....$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
000000c0  03 00 00 24 05 01 00 00  80 01 00 05 80 02 00 02  |...$............|
000000d0  80 03 00 01 80 04 00 01  80 0b 00 01 00 0c 00 04  |................|
000000e0  00 00 70 80 03 00 00 24  06 01 00 00 80 01 00 05  |..p....$........|
000000f0  80 02 00 01 80 03 00 01  80 04 00 01 80 0b 00 01  |................|
... 336 bytes shown in part

2026-10-11 07:21:56205.210.31.145to 44818/udpUnrecognisedUS

c·

payload bytes

00000000  63 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |c...............|
00000010  00 00 00 00 00 00 00 00                           |........|

2026-10-11 07:16:4235.203.211.118to 15060/udpSIPGB
OPTIONS sip:RECQqpJw@<HONEYPOT> SIP/2.0 Via: SIP/2.0/UDP 10.154.1.118:56880;branch=LHuBxs.8634091427;rport;alias From: sip:HzeMkmot@10.154.1.118:56880;tag=77392728 To: sip:zcJjVipd@<HONEYPOT> Call
Payload bytes withheld: they contain the sensor's address.