UDP traffic

Datagrams matching asn:396982 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

1.8K

Datagrams

724

Source addresses

Networks

Countries

130

Destination ports

Traffic by type

Service queries

594 datagrams from 289 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 213 NTP 144 SNMP 111 SSDP 54 NetBIOS 39 TFTP 21 CoAP 8 mDNS 4

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

Other services

484 datagrams from 311 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 412 SIP 38 Kerberos 21 XDMCP 7 RADIUS 6

Latest DTLS datagram, to 12546/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

666 datagrams from 463 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 666

Latest Unrecognised datagram, to 5632/udp

payload bytes

00000000  4e 51                                             |NQ|

Peer-to-peer

6 datagrams from 6 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 6

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	189	87	28 to 54
SNMPv2	161/udp	111	65	6.3
SSDP	1900/udp +3	54	52	30.8
NTP	123/udp	144	41	556.9
NetBIOS	137/udp +3	39	39	3.8
mDNS	5353/udp	28	28	2 to 10
TFTP	69/udp	21	21	60
RIPv1	520/udp	6	6	131.24
CharGEN	19/udp	6	6	358.8
QOTD	17/udp	6	6	140.3
WS-Discovery	3702/udp	5	5	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS160
123/udp NTP144
161/udp SNMP111
4500/udp IPsec NAT-T48
5632/udp pcAnywhere47
5351/udp NAT-PMP43
500/udp IKE42
1900/udp SSDP37
17185/udp37
5353/udp DNS28
12746/udp DTLS27
13346/udp DTLS26

DNS questions

DNS record types

TXT161
PTR41
ANY7

Networks

AS396982 Google LLC from 724 sources1,750

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
216.180.246.179	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:47
216.180.246.155	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:00
216.180.246.230	AS396982 Google LLC	US	DNS	17	2026-10-07 11:04
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.225	AS396982 Google LLC	US	DNS	17	2026-10-07 11:15
216.180.246.217	AS396982 Google LLC	US	DNS	17	2026-10-07 16:46
34.38.244.230	AS396982 Google LLC	BE	NTP	14	2026-10-06 09:28
130.211.71.27	AS396982 Google LLC	BE	NTP	11	2026-10-06 12:24
34.140.212.21	AS396982 Google LLC	BE	NTP	10	2026-10-09 09:19
216.180.246.33	AS396982 Google LLC	US	SNMP	10	2026-10-08 17:36
34.156.255.194	AS396982 Google LLC	BE	NTP	10	2026-10-08 12:22
216.180.246.207	AS396982 Google LLC	US	DNS	10	2026-10-07 16:25
35.187.52.176	AS396982 Google LLC	BE	NTP	9	2026-10-07 11:52
216.180.246.214	AS396982 Google LLC	US	DNS	9	2026-10-10 16:32
147.185.132.231	AS396982 Google LLC	US	Unrecognised	8	2026-10-10 05:18
147.185.132.40	AS396982 Google LLC	US	DTLS	8	2026-10-11 03:40
35.187.14.234	AS396982 Google LLC	BE	NTP	8	2026-10-10 12:04
34.22.199.123	AS396982 Google LLC	BE	NTP	8	2026-10-10 11:58
198.235.24.80	AS396982 Google LLC	US	DTLS	8	2026-10-10 19:06

Latest datagrams

2026-10-11 04:15:44205.210.31.109to 12546/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:13:5534.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:12:47147.185.132.198to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

2026-10-11 04:06:13198.235.24.184to 12746/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:48:37147.185.132.93to 123/udpNTPUS

·O#Kq·R·

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-11 03:48:17198.235.24.127to 5632/udpUnrecognisedUS
NQ
payload bytes
```
00000000  4e 51                                             |NQ|
```

2026-10-11 03:40:20147.185.132.40to 13346/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:32:25216.25.89.125to 1701/udpUnrecognisedUS

·:· ·Xpanse· ·

payload bytes

00000000  c8 02 00 3a 00 00 00 00  00 00 00 00 80 08 00 00  |...:............|
00000010  00 00 00 01 00 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0c  00 00 00 07 58 70 61 6e  |............Xpan|
00000030  73 65 80 08 00 00 00 09  00 01                    |se........|

2026-10-11 03:32:15147.185.133.180to 31433/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 03:29:03205.210.31.225to 12246/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:26:52205.210.31.170to 13146/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:11:33198.235.24.57to 12546/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 03:09:10216.25.89.113to 53/udpDNSUS

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:02:23147.185.132.210to 161/udpSNMPUS

0&·public·c·0·0 ·+·

payload bytes

00000000  30 26 02 01 01 04 06 70  75 62 6c 69 63 a1 19 02  |0&.....public...|
00000010  04 dc 63 c2 9a 02 01 00  02 01 00 30 0b 30 09 06  |..c........0.0..|
00000020  05 2b 06 01 02 01 05 00                           |.+......|

2026-10-11 03:00:01198.235.24.185to 88/udpKerberosUS

j·0· ·x0v·@·0· 0·Xpanse· REALM.com·0·0·krbtgt· REALM.com·20231123004255Z· Jv·0·

payload bytes

00000000  6a 81 87 30 81 84 a1 03  02 01 05 a2 03 02 01 0a  |j..0............|
00000010  a4 78 30 76 a0 07 03 05  00 40 00 00 00 a1 13 30  |.x0v.....@.....0|
00000020  11 a0 03 02 01 01 a1 0a  30 08 1b 06 58 70 61 6e  |........0...Xpan|
00000030  73 65 a2 0b 1b 09 52 45  41 4c 4d 2e 63 6f 6d a3  |se....REALM.com.|
00000040  1e 30 1c a0 03 02 01 02  a1 15 30 13 1b 06 6b 72  |.0........0...kr|
00000050  62 74 67 74 1b 09 52 45  41 4c 4d 2e 63 6f 6d a5  |btgt..REALM.com.|
00000060  11 18 0f 32 30 32 33 31  31 32 33 30 30 34 32 35  |...2023112300425|
00000070  35 5a a7 06 02 04 09 4a  76 81 a8 0e 30 0c 02 01  |5Z.....Jv...0...|
00000080  12 02 01 11 02 01 10 02  01 17                    |..........|