UDP traffic

Datagrams matching asn:401626 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

19 datagrams from 5 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

CoAP 6 NetBIOS 3 SSDP 3 CLDAP 2 TFTP 2 NTP 1 DNS 1 Sun RPC 1

Latest CoAP datagram, to 5683/udp

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

Unrecognised

24 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 24

Latest Unrecognised datagram, to 500/udp

n2NI$·

payload bytes

00000000  6e 32 4e 49 24 f2 bc be  00 00 00 00 00 00 00 00  |n2NI$...........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	3	2	3.8
SSDP	1900/udp	3	2	30.8
CLDAP	389/udp	2	2	56 to 70
CharGEN	19/udp	2	2	358.8
Memcached	11211/udp	2	2	10,000 to 51,000
TFTP	69/udp	2	1	60
QOTD	17/udp	2	1	140.3
Portmap	111/udp	1	1	7 to 28
DNS	53/udp	1	1	28 to 54
NTP	123/udp	1	1	556.9
SNMPv2	161/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

500/udp IKE6
5060/udp SIP6
5683/udp CoAP6
137/udp NetBIOS3
1434/udp MSSQL Browser3
1900/udp SSDP3
17/udp QOTD2
19/udp CharGEN2
69/udp TFTP2
389/udp CLDAP2
10001/udp Ubiquiti discovery2
11211/udp Memcached2

DNS questions

google.com ANY1

DNS record types

ANY1

Networks

AS401626 Netiface America, Inc. from 5 sources43

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
217.60.76.179	AS401626 Netiface America, Inc.	AE	Unrecognised	10	2026-10-10 15:54
64.89.163.247	AS401626 Netiface America, Inc.	US	Unrecognised	10	2026-10-10 18:50
217.60.76.59	AS401626 Netiface America, Inc.	AE	Unrecognised	9	2026-10-10 13:52
217.60.76.129	AS401626 Netiface America, Inc.	AE	Unrecognised	8	2026-10-09 10:42
217.60.76.58	AS401626 Netiface America, Inc.	AE	Unrecognised	6	2026-10-09 18:32

Latest datagrams

2026-10-10 18:50:4364.89.163.247to 500/udpUnrecognisedUS

n2NI$·

payload bytes

00000000  6e 32 4e 49 24 f2 bc be  00 00 00 00 00 00 00 00  |n2NI$...........|

2026-10-10 15:54:50217.60.76.179to 137/udpNetBIOSAE

NetBIOS node status query *

payload bytes

00000000  4d ba 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |M........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-10 13:52:26217.60.76.59to 10001/udpUnrecognisedAE
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```
2026-10-10 06:43:56217.60.76.179to 1434/udpUnrecognisedAE
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-10 01:12:52217.60.76.179to 500/udpUnrecognisedAE

!·

payload bytes

00000000  21 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |!...............|
00000010  01                                                |.|

2026-10-09 23:56:49217.60.76.179to 500/udpUnrecognisedAE

!·

payload bytes

00000000  21 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |!...............|
00000010  01                                                |.|

2026-10-09 18:32:00217.60.76.58to 10001/udpUnrecognisedAE
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-09 16:59:56217.60.76.59to 137/udpNetBIOSAE

NetBIOS node status query *

payload bytes

00000000  4d ba 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |M........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-09 10:42:26217.60.76.129to 5683/udpCoAPAE

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

2026-10-09 03:04:01217.60.76.179to 19/udpUnrecognisedAE
1234567890
payload bytes
```
00000000  31 32 33 34 35 36 37 38  39 30                    |1234567890|
```

2026-10-09 02:15:31217.60.76.129to 5683/udpCoAPAE

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

2026-10-09 00:54:5564.89.163.247to 53/udpDNSUS

DNS query ANY google.com

payload bytes

00000000  79 f1 01 20 00 01 00 00  00 00 00 01 06 67 6f 6f  |y.. .........goo|
00000010  67 6c 65 03 63 6f 6d 00  00 ff 00 01 00 00 29 10  |gle.com.......).|
00000020  00 00 00 00 00 00 00                              |.......|

2026-10-08 22:58:48217.60.76.58to 500/udpUnrecognisedAE

n2NI$·

payload bytes

00000000  6e 32 4e 49 24 f2 bc be  00 00 00 00 00 00 00 00  |n2NI$...........|

2026-10-08 20:51:38217.60.76.59to 1900/udpSSDPAE

M-SEARCH * HTTP/1.1 HOST: 239.255.255.250:1900 MAN: "ssdp:discover" MX: 2 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 20 32 33 39 2e 32  |1.1..HOST: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 41 4e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.MAN: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 32 0d 0a 53 54  |over"..MX: 2..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-08 16:17:3064.89.163.247to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 HOST: 239.255.255.250:1900 MAN: "ssdp:discover" MX: 2 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 20 32 33 39 2e 32  |1.1..HOST: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 41 4e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.MAN: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 32 0d 0a 53 54  |over"..MX: 2..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|