UDP traffic

Datagrams matching asn:45102 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

278

Datagrams

Source addresses

Networks

Countries

120

Destination ports

Traffic by type

Service queries

53 datagrams from 24 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 21 CoAP 8 NTP 7 SNMP 6 SSDP 3 NetBIOS 3 TFTP 2 Sun RPC 1 CLDAP 1 SOAP 1

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Other services

46 datagrams from 21 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 19 SIP 5 HTTP 4 SOCKS5 3 RADIUS 3 GTP-U 2 STUN 2 GTP-C 2 Redis 1 SKYPECALL 1

Latest DTLS datagram, to 12646/udp

·ԑ·P·w1·֓·&·/·&*z"·Wf·CƜ·8·,·0·̨̩̪·+·/·$·(·k·#·'·g· ·9· ·3·=·<·5·/·X· · ·#· ·0·.· · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 c6 01 00 00  |................|
00000010  ba 00 00 00 00 00 00 00  ba fe fd d4 91 04 1e 50  |...............P|
00000020  1c c2 77 31 e3 d6 93 ab  26 94 2f f3 26 2a 7a 22  |..w1....&./.&*z"|
00000030  1e 57 66 ac da 43 c6 9c  d4 02 b3 00 00 00 38 c0  |.Wf..C........8.|
00000040  2c c0 30 00 9f cc a9 cc  a8 cc aa c0 2b c0 2f 00  |,.0.........+./.|
00000050  9e c0 24 c0 28 00 6b c0  23 c0 27 00 67 c0 0a c0  |..$.(.k.#.'.g...|
00000060  14 00 39 c0 09 c0 13 00  33 00 9d 00 9c 00 3d 00  |..9.....3.....=.|
00000070  3c 00 35 00 2f 00 ff 01  00 00 58 00 0b 00 04 03  |<.5./.....X.....|
00000080  00 01 02 00 0a 00 0c 00  0a 00 1d 00 17 00 1e 00  |................|
00000090  19 00 18 00 23 00 00 00  16 00 00 00 17 00 00 00  |....#...........|
000000a0  0d 00 30 00 2e 04 03 05  03 06 03 08 07 08 08 08  |..0.............|
000000b0  09 08 0a 08 0b 08 04 08  05 08 06 04 01 05 01 06  |................|
000000c0  01 03 03 02 03 03 01 02  01 03 02 02 02 04 02 05  |................|
000000d0  02 06 02                                          |...|

QUIC

20 datagrams from 5 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 20

Latest QUIC datagram, to 853/udp

QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00

Unrecognised

156 datagrams from 64 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 156

Latest Unrecognised datagram, to 5095/udp

· ·N

payload bytes

00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |

Peer-to-peer

3 datagrams from 3 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 3

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +2	13	7	28 to 54
NTP	123/udp	7	5	556.9
mDNS	5353/udp	12	4	2 to 10
SNMPv2	161/udp +1	8	4	6.3
TFTP	69/udp +1	5	3	60
NetBIOS	137/udp	3	2	3.8
SSDP	1900/udp +1	3	2	30.8
WS-Discovery	3702/udp	2	2	10 to 500
Portmap	111/udp	1	1	7 to 28
CLDAP	389/udp	1	1	56 to 70

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

443/udp QUIC18
5353/udp DNS12
53/udp DNS12
5683/udp CoAP8
10000/udp7
123/udp NTP7
161/udp SNMP7
500/udp IKE7
623/udp IPMI6
2123/udp GTP-C6
80/udp5
1194/udp OpenVPN5

DNS questions

DNS record types

A8
TXT6
PTR4

QUIC clients (JA4)

q13i0311dq_55b375c5d22e_c183556c78e2 from 4 sources12
q13i0311h3_55b375c5d22e_c183556c78e2 from 4 sources8

QUIC transport parameters

cde977acba33 from 4 sources12
12d07494ae7c from 4 sources8

QUIC versions

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 94 sources278

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
43.98.165.95	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	34	2026-10-06 07:19
47.84.101.219	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	33	2026-10-06 07:47
43.98.186.223	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	30	2026-10-06 07:19
43.98.175.145	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DTLS	8	2026-10-09 05:14
47.84.122.184	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DTLS	8	2026-10-09 05:11
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	QUIC	7	2026-10-10 02:37
47.251.13.59	AS45102 Alibaba (US) Technology Co., Ltd.	US	QUIC	6	2026-10-10 11:19
8.211.44.115	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	6	2026-10-11 01:45
47.245.117.221	AS45102 Alibaba (US) Technology Co., Ltd.	SG	QUIC	5	2026-10-09 01:03
47.84.179.21	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	5	2026-10-06 17:04
47.245.84.83	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	5	2026-10-10 05:06
47.91.125.252	AS45102 Alibaba (US) Technology Co., Ltd.	AE	QUIC	5	2026-10-09 10:12
47.254.154.232	AS45102 Alibaba (US) Technology Co., Ltd.	DE	CoAP	5	2026-10-09 23:45
8.209.82.97	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	4	2026-10-09 23:03
47.90.213.222	AS45102 Alibaba (US) Technology Co., Ltd.	US	SOCKS5	4	2026-10-08 15:27
47.74.5.117	AS45102 Alibaba (US) Technology Co., Ltd.	JP	Unrecognised	4	2026-10-06 00:41
47.251.179.212	AS45102 Alibaba (US) Technology Co., Ltd.	US	DNS	3	2026-10-07 08:52
8.209.97.27	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	3	2026-10-07 17:46
47.84.133.68	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	3	2026-10-08 22:03
8.211.33.23	AS45102 Alibaba (US) Technology Co., Ltd.	DE	Unrecognised	3	2026-10-10 11:53

Latest datagrams

2026-10-11 03:55:178.209.83.9to 5095/udpUnrecognisedDE

· ·N

payload bytes

00000000  01 00 00 00 00 01 00 0d  01 00 00 4e 20           |...........N |

2026-10-11 03:28:0147.254.167.143to 623/udpUnrecognisedDE

payload bytes

00000000  06 00 ff 06 00 00 11 be  80 00 00 00              |............|

2026-10-11 01:57:058.211.42.24to 28784/udpUnrecognisedDE

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-11 01:45:518.211.44.115to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-10 17:36:2947.88.90.74to 6060/udpSIPUS

REGISTER sip:·\.0\.0\.0 SIP/2.0 Via: SIP/2.0/UDP 192.168.0.235:52535;rport;branch=z9hG4bKPj6fdf1f75ac884ac0b29e629677a35fa8 Max-Forwards: 70 From: <sip:asdad@123123>;tag=f089ae2854224eb3b0b5d4e0e5d

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 00 5c 2e  |REGISTER sip:.\.|
00000010  30 5c 2e 30 5c 2e 30 20  53 49 50 2f 32 2e 30 0d  |0\.0\.0 SIP/2.0.|
00000020  0a 56 69 61 3a 20 53 49  50 2f 32 2e 30 2f 55 44  |.Via: SIP/2.0/UD|
00000030  50 20 31 39 32 2e 31 36  38 2e 30 2e 32 33 35 3a  |P 192.168.0.235:|
00000040  35 32 35 33 35 3b 72 70  6f 72 74 3b 62 72 61 6e  |52535;rport;bran|
00000050  63 68 3d 7a 39 68 47 34  62 4b 50 6a 36 66 64 66  |ch=z9hG4bKPj6fdf|
00000060  31 66 37 35 61 63 38 38  34 61 63 30 62 32 39 65  |1f75ac884ac0b29e|
00000070  36 32 39 36 37 37 61 33  35 66 61 38 0d 0a 4d 61  |629677a35fa8..Ma|
00000080  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000090  46 72 6f 6d 3a 20 3c 73  69 70 3a 61 73 64 61 64  |From: <sip:asdad|
000000a0  40 31 32 33 31 32 33 3e  3b 74 61 67 3d 66 30 38  |@123123>;tag=f08|
000000b0  39 61 65 32 38 35 34 32  32 34 65 62 33 62 30 62  |9ae2854224eb3b0b|
000000c0  35 64 34 65 30 65 35 64  34 63 61 66 62 0d 0a 54  |5d4e0e5d4cafb..T|
000000d0  6f 3a 20 3c 73 69 70 3a  61 73 64 61 64 40 31 32  |o: <sip:asdad@12|
000000e0  33 31 32 33 3e 0d 0a 43  61 6c 6c 2d 49 44 3a 20  |3123>..Call-ID: |
000000f0  33 38 30 37 63 66 35 34  64 63 36 37 34 35 31 33  |3807cf54dc674513|
... 504 bytes shown in part

2026-10-10 17:26:3547.251.76.211to 28784/udpUnrecognisedUS

HAP·nh · ·P·R

payload bytes

00000000  48 41 50 e6 01 6e 68 0d  00 1a 00 09 00 01 50 01  |HAP..nh.......P.|
00000010  02 00 01 00 17 52                                 |.....R|

2026-10-10 16:13:1647.250.38.169to 6969/udpUnrecognisedMY
·'·o·6
payload bytes
```
00000000  00 00 04 17 27 10 19 80  00 00 00 00 6f 0b 11 36  |....'.......o..6|
```

2026-10-10 13:00:1847.245.141.134to 1604/udpUnrecognisedDE

·0·

payload bytes

00000000  1e 00 01 30 02 fd a8 e3  00 00 00 00 00 00 00 00  |...0............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-10 11:53:308.211.33.23to 64738/udpUnrecognisedDE
·abcdefgh
payload bytes
```
00000000  00 00 00 00 61 62 63 64  65 66 67 68              |....abcdefgh|
```

2026-10-10 11:19:4647.251.13.59to 123/udpNTPUS

#·/·

payload bytes

00000000  23 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |#...............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  e7 c0 e7 f1 2f ba d0 00  |............/...|

2026-10-10 09:16:128.211.46.83to 4500/udpUnrecognisedDE
H·r·]p!
payload bytes
```
00000000  48 8b 14 72 93 5d 70 21                           |H..r.]p!|
```
2026-10-10 08:34:428.211.47.19to 1434/udpUnrecognisedDE
·
payload bytes
```
00000000  02                                                |.|
```
2026-10-10 05:06:0147.245.84.83to 5353/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00 00 00                                       |....|
```

2026-10-10 05:05:5147.245.84.83to 5353/udpDNSSG

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-10 05:05:4147.245.84.83to 5353/udpDNSSG

DNS query A addons.g-fox.cn

payload bytes

00000000  f5 35 01 00 00 01 00 00  00 00 00 00 06 61 64 64  |.5...........add|
00000010  6f 6e 73 05 67 2d 66 6f  78 02 63 6e 00 00 01 00  |ons.g-fox.cn....|
00000020  01                                                |.|