UDP traffic

Datagrams matching asn:4134 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

5 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 1 DNS 1 CoAP 1 SNMP 1 SOAP 1

Latest NTP datagram, to 123/udp

payload bytes

00000000  1c 00 00 00                                       |....|

Other services

6 datagrams from 6 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 3 SIP 3

Latest SOCKS5 datagram, to 56941/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

52 datagrams from 28 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 52

Latest Unrecognised datagram, to 4000/udp

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

Peer-to-peer

11 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 11

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	2	2	2 to 10
NTP	123/udp	1	1	556.9
SNMPv2	162/udp	1	1	6.3
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

_services._dns-sd._udp.local PTR1

DNS record types

PTR1

Networks

AS4134 Chinanet from 38 sources74

Countries

CN China74

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
223.157.171.209	AS4134 Chinanet	CN	BitTorrent	11	2026-10-10 08:52
123.178.147.22	AS4134 Chinanet	CN	Unrecognised	7	2026-10-10 00:12
106.127.143.134	AS4134 Chinanet	CN	Unrecognised	4	2026-10-06 10:47
222.186.13.130	AS4134 Chinanet	CN	CoAP	4	2026-10-09 20:00
27.148.33.34	AS4134 Chinanet	CN	Unrecognised	4	2026-10-07 11:34
218.3.255.164	AS4134 Chinanet	CN	Unrecognised	3	2026-10-09 01:25
49.78.1.112	AS4134 Chinanet	CN	Unrecognised	2	2026-10-09 04:56
139.202.232.10	AS4134 Chinanet	CN	Unrecognised	2	2026-10-10 09:02
115.192.60.88	AS4134 Chinanet	CN	Unrecognised	2	2026-10-06 10:26
171.216.229.19	AS4134 Chinanet	CN	Unrecognised	2	2026-10-06 07:20
183.162.100.65	AS4134 Chinanet	CN	Unrecognised	2	2026-10-09 17:15
110.83.236.70	AS4134 Chinanet	CN	Unrecognised	2	2026-10-09 19:39
223.215.251.187	AS4134 Chinanet	CN	Unrecognised	2	2026-10-06 10:21
106.9.93.40	AS4134 Chinanet	CN	Unrecognised	2	2026-10-07 12:51
115.216.36.5	AS4134 Chinanet	CN	Unrecognised	2	2026-10-07 22:33
59.49.230.168	AS4134 Chinanet	CN	Unrecognised	1	2026-10-10 11:17
175.30.48.142	AS4134 Chinanet	CN	DNS	1	2026-10-06 04:49
117.25.122.217	AS4134 Chinanet	CN	Unrecognised	1	2026-10-05 15:46
125.84.251.37	AS4134 Chinanet	CN	SIP	1	2026-10-10 06:50
59.51.142.86	AS4134 Chinanet	CN	Unrecognised	1	2026-10-06 01:05

Latest datagrams

2026-10-11 01:28:51116.30.9.218to 4000/udpUnrecognisedCN

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

2026-10-10 21:24:26183.129.148.70to 8081/udpUnrecognisedCN
·.MkR·&GG·k
payload bytes
```
00000000  0f 2e 4d 6b 52 05 26 47  47 8d 6b                 |..MkR.&GG.k|
```

2026-10-10 19:01:41124.31.106.10to 5061/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 11:17:5359.49.230.168to 80/udpUnrecognisedCN
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 11:16:59106.117.111.115to 1194/udpUnrecognisedCN

8·8·b·gF-ކsM,·Q·#·a·#·r·P·&,·

payload bytes

00000000  38 81 38 14 62 1d 67 46  2d de 86 73 4d 2c bf f1  |8.8.b.gF-..sM,..|
00000010  51 b2 b1 23 1b 61 e4 23  08 a2 72 81 8e 00 00 00  |Q..#.a.#..r.....|
00000020  01 50 ff 26 2c 00 00 00  00 00                    |.P.&,.....|

2026-10-10 11:11:3214.145.44.147to 56941/udpSOCKS5CN

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 09:02:12139.202.232.10to 5353/udpUnrecognisedCN

}.C ·RvX0Ho·_`A!"·=·p·CnHH·49·/|·>O·N·-f]N c·"·|$Cjl·p??ro;·- ·D UJ&·1·P:f\\fX·*Bl5H]ua^

payload bytes

00000000  7d 2e 43 0d 0f 52 76 58  30 48 6f 1c 5f 60 41 21  |}.C..RvX0Ho._`A!|
00000010  22 06 3d 19 1c 70 01 43  6e 48 48 1c 04 34 39 02  |".=..p.CnHH..49.|
00000020  2f 7c 0f 3e 4f 05 17 7f  4e 06 1c 2d 66 5d 4e 09  |/|.>O...N..-f]N.|
00000030  63 0b 22 00 7c 24 43 6a  6c 0b 06 70 3f 3f 72 6f  |c.".|$Cjl..p??ro|
00000040  3b 02 2d 0a 07 44 0a 55  4a 26 02 31 03 50 3a 66  |;.-..D.UJ&.1.P:f|
00000050  5c 5c 66 58 00 2a 42 6c  35 48 5d 75 61 5e        |\\fX.*Bl5H]ua^|

2026-10-10 08:52:11223.157.171.209to 39131/udpBitTorrentCN

A·tg·

payload bytes

00000000  41 00 74 67 94 9f a4 f2  00 00 00 00 00 08 00 00  |A.tg............|
00000010  13 de 00 00                                       |....|

2026-10-10 08:52:09223.157.171.209to 39131/udpBitTorrentCN

A·tg·{·

payload bytes

00000000  41 00 74 67 94 80 7b ef  00 00 00 00 00 08 00 00  |A.tg..{.........|
00000010  13 de 00 00                                       |....|

2026-10-10 08:52:08223.157.171.209to 39131/udpBitTorrentCN

A·tg·p·

payload bytes

00000000  41 00 74 67 94 70 a8 90  00 00 00 00 00 08 00 00  |A.tg.p..........|
00000010  13 de 00 00                                       |....|

2026-10-10 08:44:23223.157.171.209to 39131/udpBitTorrentCN

A·˓x·7·

payload bytes

00000000  41 00 cb 93 78 b7 dc 37  00 00 00 00 00 08 00 00  |A...x..7........|
00000010  ae f8 00 00                                       |....|

2026-10-10 08:44:18223.157.171.209to 39131/udpBitTorrentCN

A·˓xy·>·

payload bytes

00000000  41 00 cb 93 78 79 f1 3e  00 00 00 00 00 08 00 00  |A...xy.>........|
00000010  ae f8 00 00                                       |....|

2026-10-10 08:44:17223.157.171.209to 39131/udpBitTorrentCN

A·˓x[ ·

payload bytes

00000000  41 00 cb 93 78 5b 20 f0  00 00 00 00 00 08 00 00  |A...x[ .........|
00000010  ae f8 00 00                                       |....|

2026-10-10 08:44:15223.157.171.209to 39131/udpBitTorrentCN

A·˓xK·

payload bytes

00000000  41 00 cb 93 78 4b ca d7  00 00 00 00 00 08 00 00  |A...xK..........|
00000010  ae f8 00 00                                       |....|

2026-10-10 08:42:34223.157.171.209to 39131/udpBitTorrentCN

A·+r7·2·`·

payload bytes

00000000  41 00 0e 2b 72 37 84 32  00 00 00 00 00 08 00 00  |A..+r7.2........|
00000010  60 02 00 00                                       |`...|