UDP traffic

Datagrams matching asn:398324 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.5K

Datagrams

Source addresses

Networks

Countries

936

Destination ports

Traffic by type

Service queries

232 datagrams from 68 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 66 TFTP 27 NetBIOS 23 Sun RPC 23 CLDAP 21 SOAP 18 SSDP 16 SNMP 15 NTP 12 CoAP 11

Latest DNS datagram, to 48442/udp

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

Other services

244 datagrams from 70 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 112 STUN 46 SIP 43 RTSP 27 DCE/RPC 9 RADIUS 6 XDMCP 1

Latest DTLS datagram, to 33587/udp

·~·r·r·_·BnS·r·3~_·Y·I·-N·> ·?·W·+·/· ·<· · · 127.0.0.1

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|

Unrecognised

1,018 datagrams from 94 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1,018

Latest Unrecognised datagram, to 37810/udp

payload bytes

00000000  ff                                                |.|

Peer-to-peer

28 datagrams from 12 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 28

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	62	25	28 to 54
SNMPv2	161/udp	15	15	6.3
NTP	123/udp	12	11	556.9
Portmap	111/udp	11	11	7 to 28
NetBIOS	137/udp +3	23	10	3.8
TFTP	6969/udp +3	27	7	60
CharGEN	19/udp	6	6	358.8
WS-Discovery	3702/udp	6	6	10 to 500
CLDAP	389/udp +3	21	5	56 to 70
SSDP	1900/udp +3	16	5	30.8
QOTD	17/udp	6	5	140.3
mDNS	5353/udp	4	4	2 to 10
RIPv1	520/udp	1	1	131.24

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

3478/udp STUN32
2362/udp30
2361/udp27
17185/udp26
17184/udp25
17186/udp25
44818/udp EtherNet/IP25
2363/udp23
5349/udp DTLS20
500/udp IKE18
19302/udp STUN15
161/udp SNMP15

DNS questions

DNS record types

A32
PTR18

Networks

AS398324 Censys, Inc. from 97 sources1,522

Countries

US United States1,522

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
66.132.172.246	AS398324 Censys, Inc.	US	Unrecognised	68	2026-10-11 03:51
66.132.172.254	AS398324 Censys, Inc.	US	DTLS	66	2026-10-11 04:39
66.132.172.248	AS398324 Censys, Inc.	US	Unrecognised	63	2026-10-11 04:30
66.132.172.252	AS398324 Censys, Inc.	US	RTSP	62	2026-10-11 02:13
66.132.172.253	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-10 22:36
66.132.172.251	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-11 03:34
66.132.172.250	AS398324 Censys, Inc.	US	Unrecognised	61	2026-10-11 04:56
66.132.172.244	AS398324 Censys, Inc.	US	Unrecognised	59	2026-10-11 04:27
66.132.172.243	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 05:23
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 05:16
66.132.172.241	AS398324 Censys, Inc.	US	Unrecognised	58	2026-10-11 01:51
66.132.172.245	AS398324 Censys, Inc.	US	Unrecognised	57	2026-10-11 04:54
66.132.172.240	AS398324 Censys, Inc.	US	Unrecognised	52	2026-10-10 22:37
66.132.172.242	AS398324 Censys, Inc.	US	Unrecognised	48	2026-10-10 22:59
66.132.172.249	AS398324 Censys, Inc.	US	Unrecognised	46	2026-10-11 05:05
66.132.172.230	AS398324 Censys, Inc.	US	Unrecognised	17	2026-10-10 11:11
66.132.172.236	AS398324 Censys, Inc.	US	Unrecognised	15	2026-10-10 23:09
66.132.224.20	AS398324 Censys, Inc.	US	Unrecognised	14	2026-10-11 04:05
66.132.186.242	AS398324 Censys, Inc.	US	Unrecognised	14	2026-10-10 12:59
66.132.186.215	AS398324 Censys, Inc.	US	Unrecognised	14	2026-10-10 20:22

Latest datagrams

2026-10-11 05:26:5466.132.159.40to 37810/udpUnrecognisedUS
·
payload bytes
```
00000000  ff                                                |.|
```

2026-10-11 05:23:5666.132.172.243to 12967/udpSSDPUS

M-SEARCH * HTTP/1.1 HOST:239.255.255.250:1900 ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 32 33 39 2e 32 35  |1.1..HOST:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 41 4e  |ST:ssdp:all..MAN|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 0d 0a                                       |....|

2026-10-11 05:16:5566.132.172.247to 23008/udpUnrecognisedUS

DB2GETADDR·SQL09010·

payload bytes

00000000  44 42 32 47 45 54 41 44  44 52 00 53 51 4c 30 39  |DB2GETADDR.SQL09|
00000010  30 31 30 00                                       |010.|

2026-10-11 05:05:0366.132.172.249to 48442/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 04:56:5266.132.172.250to 46497/udpUnrecognisedUS

Me·!·R·P·4·(·$·$·$·$·

payload bytes

00000000  4d 65 82 21 07 fc fd 52  00 00 00 00 00 00 00 00  |Me.!...R........|
00000010  01 10 02 00 00 00 00 00  00 00 01 50 00 00 01 34  |...........P...4|
00000020  00 00 00 01 00 00 00 01  00 00 01 28 01 01 00 08  |...........(....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 01  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 01 00 03 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 02 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 01 00  03 00 00 24 03 01 00 00  |...........$....|
00000080  80 01 00 05 80 02 00 01  80 03 00 01 80 04 00 01  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 01 00 03 00 00 24  |...............$|
000000a0  04 01 00 00 80 01 00 05  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 01 00  |................|
000000c0  03 00 00 24 05 01 00 00  80 01 00 01 80 02 00 01  |...$............|
000000d0  80 03 00 01 80 04 00 01  80 0b 00 01 00 0c 00 04  |................|
000000e0  00 00 01 00 03 00 00 24  06 01 00 00 80 01 00 01  |.......$........|
000000f0  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
... 336 bytes shown in part

2026-10-11 04:54:4866.132.172.245to 25904/udpUnrecognisedUS
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```
2026-10-11 04:48:1466.132.186.210to 5632/udpUnrecognisedUS
NQ
payload bytes
```
00000000  4e 51                                             |NQ|
```

2026-10-11 04:43:0166.132.172.243to 37780/udpUnrecognisedUS

payload bytes

00000000  01 08 00 14 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00                                       |....|

2026-10-11 04:39:2666.132.172.254to 33587/udpDTLSUS

·~·r·r·_·BnS·r·3~_·Y·I·-N·> ·?·W·+·/· ·<· · · 127.0.0.1

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 7e 01 00 00  |............~...|
00000010  72 00 00 00 00 00 00 00  72 fe fd 5f 06 07 42 6e  |r.......r.._..Bn|
00000020  53 de 72 d8 ef 33 7e 5f  ee 59 10 19 49 8b 2d 4e  |S.r..3~_.Y..I.-N|
00000030  7f de 3e 09 f4 a8 3f 03  f9 57 06 00 00 00 0c c0  |..>...?..W......|
00000040  ac c0 ae c0 2b c0 2f c0  0a c0 14 01 00 00 3c 00  |....+./.......<.|
00000050  0d 00 10 00 0e 04 03 05  03 06 03 04 01 05 01 06  |................|
00000060  01 08 07 00 0a 00 08 00  06 00 1d 00 17 00 18 00  |................|
00000070  0b 00 02 01 00 00 17 00  00 00 00 00 0e 00 0c 00  |................|
00000080  00 09 31 32 37 2e 30 2e  30 2e 31                 |..127.0.0.1|

2026-10-11 04:34:5566.132.224.16to 17186/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:30:0666.132.172.248to 15080/udpUnrecognisedUS

·!L_· ·̗·

payload bytes

00000000  ff ff ff ff 21 4c 5f a0  0a 00 00 00 08 9a cc 97  |....!L_.........|
00000010  ee a3 cd 02 10 00 02 00  00 00 08 00              |............|

2026-10-11 04:28:3366.132.172.248to 58385/udpUnrecognisedUS

·ܮt·}·]·1f(Oo·kI ·{·c·

payload bytes

00000000  14 1e dc ae 74 cc 7d 10  5d e4 31 66 28 4f 6f 02  |....t.}.].1f(Oo.|
00000010  0f 6b 49 20 c9 7b 8d c8  1c 63 e5                 |.kI .{...c.|

2026-10-11 04:27:1666.132.172.244to 39808/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 04:24:0066.132.172.245to 32679/udpUnrecognisedUS
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```

2026-10-11 04:11:4166.132.172.254to 47746/udpSIPUS

OPTIONS sip:censysinspect@censys.io SIP/2.0 To: <sip:test.echo@sip5060.net> From: Censys <sip:censysinspect@censys.io> CSeq: 1 OPTIONS Call-ID: a84b4c76e66710 Max-Forwards: 70 Via: SIP/2.0/UDP 1

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 63 65 6e 73  |OPTIONS sip:cens|
00000010  79 73 69 6e 73 70 65 63  74 40 63 65 6e 73 79 73  |ysinspect@censys|
00000020  2e 69 6f 20 53 49 50 2f  32 2e 30 0d 0a 54 6f 3a  |.io SIP/2.0..To:|
00000030  20 3c 73 69 70 3a 74 65  73 74 2e 65 63 68 6f 40  | <sip:test.echo@|
00000040  73 69 70 35 30 36 30 2e  6e 65 74 3e 0d 0a 46 72  |sip5060.net>..Fr|
00000050  6f 6d 3a 20 43 65 6e 73  79 73 20 3c 73 69 70 3a  |om: Censys <sip:|
00000060  63 65 6e 73 79 73 69 6e  73 70 65 63 74 40 63 65  |censysinspect@ce|
00000070  6e 73 79 73 2e 69 6f 3e  0d 0a 43 53 65 71 3a 20  |nsys.io>..CSeq: |
00000080  31 20 4f 50 54 49 4f 4e  53 0d 0a 43 61 6c 6c 2d  |1 OPTIONS..Call-|
00000090  49 44 3a 20 61 38 34 62  34 63 37 36 65 36 36 37  |ID: a84b4c76e667|
000000a0  31 30 0d 0a 4d 61 78 2d  46 6f 72 77 61 72 64 73  |10..Max-Forwards|
000000b0  3a 20 37 30 0d 0a 56 69  61 3a 20 53 49 50 2f 32  |: 70..Via: SIP/2|
000000c0  2e 30 2f 55 44 50 20 31  32 37 2e 30 2e 30 2e 31  |.0/UDP 127.0.0.1|
000000d0  3b 72 70 6f 72 74 0d 0a  41 63 63 65 70 74 3a 20  |;rport..Accept: |
000000e0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000f0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
... 262 bytes shown in part