UDP traffic

Datagrams matching asn:396982 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.8K

Datagrams

725

Source addresses

Networks

Countries

130

Destination ports

Traffic by type

Service queries

603 datagrams from 289 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 213 NTP 153 SNMP 111 SSDP 54 NetBIOS 39 TFTP 21 CoAP 8 mDNS 4

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

Other services

487 datagrams from 312 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 414 SIP 38 Kerberos 22 XDMCP 7 RADIUS 6

Latest DTLS datagram, to 13646/udp

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

Unrecognised

672 datagrams from 464 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 672

Latest Unrecognised datagram, to 1701/udp

·:· ·Xpanse· ·

payload bytes

00000000  c8 02 00 3a 00 00 00 00  00 00 00 00 80 08 00 00  |...:............|
00000010  00 00 00 01 00 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0c  00 00 00 07 58 70 61 6e  |............Xpan|
00000030  73 65 80 08 00 00 00 09  00 01                    |se........|

Peer-to-peer

6 datagrams from 6 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 6

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	189	87	28 to 54
SNMPv2	161/udp	111	65	6.3
SSDP	1900/udp +3	54	52	30.8
NTP	123/udp	153	41	556.9
NetBIOS	137/udp +3	39	39	3.8
mDNS	5353/udp	28	28	2 to 10
TFTP	69/udp	21	21	60
RIPv1	520/udp	6	6	131.24
CharGEN	19/udp	6	6	358.8
QOTD	17/udp	6	6	140.3
WS-Discovery	3702/udp	5	5	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS160
123/udp NTP153
161/udp SNMP111
4500/udp IPsec NAT-T49
5632/udp pcAnywhere47
5351/udp NAT-PMP43
500/udp IKE42
17185/udp38
1900/udp SSDP37
5353/udp DNS28
12746/udp DTLS27
13346/udp DTLS26

DNS questions

DNS record types

TXT161
PTR41
ANY7

Networks

AS396982 Google LLC from 725 sources1,768

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
216.180.246.179	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:47
216.180.246.155	AS396982 Google LLC	US	SNMP	17	2026-10-08 12:00
216.180.246.230	AS396982 Google LLC	US	DNS	17	2026-10-07 11:04
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.225	AS396982 Google LLC	US	DNS	17	2026-10-07 11:15
216.180.246.217	AS396982 Google LLC	US	DNS	17	2026-10-07 16:46
34.38.244.230	AS396982 Google LLC	BE	NTP	14	2026-10-06 09:28
130.211.71.27	AS396982 Google LLC	BE	NTP	11	2026-10-06 12:24
34.140.212.21	AS396982 Google LLC	BE	NTP	10	2026-10-09 09:19
216.180.246.33	AS396982 Google LLC	US	SNMP	10	2026-10-08 17:36
34.156.255.194	AS396982 Google LLC	BE	NTP	10	2026-10-08 12:22
216.180.246.207	AS396982 Google LLC	US	DNS	10	2026-10-07 16:25
35.187.52.176	AS396982 Google LLC	BE	NTP	9	2026-10-07 11:52
216.180.246.214	AS396982 Google LLC	US	DNS	9	2026-10-10 16:32
147.185.132.231	AS396982 Google LLC	US	Unrecognised	8	2026-10-10 05:18
147.185.132.40	AS396982 Google LLC	US	SNMP	8	2026-10-11 03:40
35.187.14.234	AS396982 Google LLC	BE	NTP	8	2026-10-10 12:04
34.22.199.123	AS396982 Google LLC	BE	NTP	8	2026-10-10 11:58
198.235.24.80	AS396982 Google LLC	US	Unrecognised	8	2026-10-10 19:06

Latest datagrams

2026-10-11 05:24:53205.210.31.105to 1701/udpUnrecognisedUS

·:· ·Xpanse· ·

payload bytes

00000000  c8 02 00 3a 00 00 00 00  00 00 00 00 80 08 00 00  |...:............|
00000010  00 00 00 01 00 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 03 80 0c  00 00 00 07 58 70 61 6e  |............Xpan|
00000030  73 65 80 08 00 00 00 09  00 01                    |se........|

2026-10-11 05:21:2935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:19:3335.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:05:5335.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:05:4635.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:04:0235.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:58:31216.25.89.116to 427/udpUnrecognisedUS

· ·en·DEFAULT

payload bytes

00000000  02 09 00 00 1d 00 00 00  00 00 9d f6 00 02 65 6e  |..............en|
00000010  00 00 ff ff 00 07 44 45  46 41 55 4c 54           |......DEFAULT|

2026-10-11 04:58:17216.25.89.108to 1432/udpUnrecognisedUS
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 04:54:59216.25.89.125to 13646/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:50:50198.235.24.164to 4500/udpUnrecognisedUS

·P·4·(·$·p·$·p·$·

payload bytes

00000000  00 00 00 00 89 ec e2 de  18 86 e4 b9 00 00 00 00  |................|
00000010  00 00 00 00 01 10 02 00  00 00 00 00 00 00 01 50  |...............P|
00000020  00 00 01 34 00 00 00 01  00 00 00 01 00 00 01 28  |...4...........(|
00000030  01 01 00 08 03 00 00 24  01 01 00 00 80 01 00 05  |.......$........|
00000040  80 02 00 02 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000050  00 0c 00 04 00 00 70 80  03 00 00 24 02 01 00 00  |......p....$....|
00000060  80 01 00 05 80 02 00 01  80 03 00 01 80 04 00 02  |................|
00000070  80 0b 00 01 00 0c 00 04  00 00 70 80 03 00 00 24  |..........p....$|
00000080  03 01 00 00 80 01 00 01  80 02 00 02 80 03 00 01  |................|
00000090  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
000000a0  03 00 00 24 04 01 00 00  80 01 00 01 80 02 00 01  |...$............|
000000b0  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
000000c0  00 00 70 80 03 00 00 24  05 01 00 00 80 01 00 05  |..p....$........|
000000d0  80 02 00 02 80 03 00 01  80 04 00 01 80 0b 00 01  |................|
000000e0  00 0c 00 04 00 00 70 80  03 00 00 24 06 01 00 00  |......p....$....|
000000f0  80 01 00 05 80 02 00 01  80 03 00 01 80 04 00 01  |................|
... 340 bytes shown in part

2026-10-11 04:49:3035.203.210.85to 31433/udpUnrecognisedGB
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 04:49:02205.210.31.48to 13846/udpDTLSUS

·6·*·*·|w@·"·ʬ d/·"d·0·/·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 36 01 00 00  |............6...|
00000010  2a 00 00 00 00 00 00 00  2a fe fd 00 00 00 00 7c  |*.......*......||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 02 00  |/."d......0.....|
00000040  2f 01 00                                          |/..|

2026-10-11 04:46:15198.235.24.193to 88/udpKerberosUS

j·0· ·x0v·@·0· 0·Xpanse· REALM.com·0·0·krbtgt· REALM.com·20231123004255Z· Jv·0·

payload bytes

00000000  6a 81 87 30 81 84 a1 03  02 01 05 a2 03 02 01 0a  |j..0............|
00000010  a4 78 30 76 a0 07 03 05  00 40 00 00 00 a1 13 30  |.x0v.....@.....0|
00000020  11 a0 03 02 01 01 a1 0a  30 08 1b 06 58 70 61 6e  |........0...Xpan|
00000030  73 65 a2 0b 1b 09 52 45  41 4c 4d 2e 63 6f 6d a3  |se....REALM.com.|
00000040  1e 30 1c a0 03 02 01 02  a1 15 30 13 1b 06 6b 72  |.0........0...kr|
00000050  62 74 67 74 1b 09 52 45  41 4c 4d 2e 63 6f 6d a5  |btgt..REALM.com.|
00000060  11 18 0f 32 30 32 33 31  31 32 33 30 30 34 32 35  |...2023112300425|
00000070  35 5a a7 06 02 04 09 4a  76 81 a8 0e 30 0c 02 01  |5Z.....Jv...0...|
00000080  12 02 01 11 02 01 10 02  01 17                    |..........|

2026-10-11 04:39:4134.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:39:01198.235.24.53to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|