UDP traffic

Datagrams matching asn:4837 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

6 datagrams from 6 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 4 TFTP 1 SNMP 1

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  ac 2b 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |.+. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

Other services

12 datagrams from 10 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 6 SIP 4 RADIUS 1 OOKLA 1

Latest SOCKS5 datagram, to 22140/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

28 datagrams from 26 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 28

Latest Unrecognised datagram, to 31065/udp

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	4	4	28 to 54
RIPv1	520/udp	2	2	131.24
TFTP	69/udp	1	1	60
SNMPv2	161/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS4
8080/udp4
5060/udp SIP4
443/udp QUIC3
44818/udp EtherNet/IP2
10001/udp Ubiquiti discovery2
8081/udp2
520/udp RIP2
20/udp1
2424/udp1
4000/udp1
5008/udp1

DNS questions

version.bind TXT4

DNS record types

TXT4

Networks

AS4837 CHINA UNICOM China169 Backbone from 41 sources46

Countries

CN China46

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
116.171.164.207	AS4837 CHINA UNICOM China169 Backbone	CN	SOCKS5	4	2026-10-10 00:55
175.163.103.77	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	3	2026-10-11 04:23
123.14.126.21	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-08 19:18
123.157.192.197	AS4837 CHINA UNICOM China169 Backbone	CN	TFTP	1	2026-10-06 16:13
123.144.21.9	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 22:27
124.88.113.72	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-09 13:16
61.53.12.43	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-06 00:47
182.54.23.53	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-08 10:07
124.90.48.42	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-08 10:36
1.24.16.117	AS4837 CHINA UNICOM China169 Backbone	CN	DNS	1	2026-10-05 18:10
175.155.243.7	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-06 00:00
122.136.26.139	AS4837 CHINA UNICOM China169 Backbone	CN	SOCKS5	1	2026-10-10 13:10
113.206.146.178	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 17:06
139.170.73.194	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 06:28
139.170.72.9	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-08 01:29
153.0.250.70	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-09 02:02
60.16.213.143	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 08:53
219.155.210.128	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-09 04:32
112.243.149.12	AS4837 CHINA UNICOM China169 Backbone	CN	SOCKS5	1	2026-10-07 11:43
182.88.7.101	AS4837 CHINA UNICOM China169 Backbone	CN	SIP	1	2026-10-11 03:30

Latest datagrams

2026-10-11 04:23:57175.163.103.77to 31065/udpUnrecognisedCN

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

2026-10-11 03:30:08182.88.7.101to 5060/udpSIPCN

OPTIONS sip:nm SIP/2.0 Via: SIP/2.0/UDP nm;branch=foo;rport Max-Forwards: 70 To: <sip:nm@nm> From: <sip:nm@nm>;tag=root Call-ID: 50000 CSeq: 63104 OPTIONS Contact: <sip:nm@nm> Accept: applicat

payload bytes

00000000  4f 50 54 49 4f 4e 53 20  73 69 70 3a 6e 6d 20 53  |OPTIONS sip:nm S|
00000010  49 50 2f 32 2e 30 0d 0a  56 69 61 3a 20 53 49 50  |IP/2.0..Via: SIP|
00000020  2f 32 2e 30 2f 55 44 50  20 6e 6d 3b 62 72 61 6e  |/2.0/UDP nm;bran|
00000030  63 68 3d 66 6f 6f 3b 72  70 6f 72 74 0d 0a 4d 61  |ch=foo;rport..Ma|
00000040  78 2d 46 6f 72 77 61 72  64 73 3a 20 37 30 0d 0a  |x-Forwards: 70..|
00000050  54 6f 3a 20 3c 73 69 70  3a 6e 6d 40 6e 6d 3e 0d  |To: <sip:nm@nm>.|
00000060  0a 46 72 6f 6d 3a 20 3c  73 69 70 3a 6e 6d 40 6e  |.From: <sip:nm@n|
00000070  6d 3e 3b 74 61 67 3d 72  6f 6f 74 0d 0a 43 61 6c  |m>;tag=root..Cal|
00000080  6c 2d 49 44 3a 20 35 30  30 30 30 0d 0a 43 53 65  |l-ID: 50000..CSe|
00000090  71 3a 20 36 33 31 30 34  20 4f 50 54 49 4f 4e 53  |q: 63104 OPTIONS|
000000a0  0d 0a 43 6f 6e 74 61 63  74 3a 20 3c 73 69 70 3a  |..Contact: <sip:|
000000b0  6e 6d 40 6e 6d 3e 0d 0a  41 63 63 65 70 74 3a 20  |nm@nm>..Accept: |
000000c0  61 70 70 6c 69 63 61 74  69 6f 6e 2f 73 64 70 0d  |application/sdp.|
000000d0  0a 43 6f 6e 74 65 6e 74  2d 4c 65 6e 67 74 68 3a  |.Content-Length:|
000000e0  20 30 0d 0a 0d 0a                                 | 0....|

2026-10-10 22:27:28123.144.21.9to 520/udpUnrecognisedCN

·D·

payload bytes

00000000  01 01 00 00 00 02 00 00  44 00 00 00 00 00 00 00  |........D.......|
00000010  00 00 00 00 00 00 00 0f                           |........|

2026-10-10 17:06:26113.206.146.178to 5008/udpUnrecognisedCN

·@P·]·(·|·@·9·B7e·

payload bytes

00000000  00 40 50 00 00 00 00 85  5d b4 91 28 00 00 00 00  |.@P.....]..(....|
00000010  00 01 7c 91 40 00 00 00  aa 39 da 42 37 65 cf 01  |..|.@....9.B7e..|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-10 13:46:26123.14.125.191to 5050/udpUnrecognisedCN
· · S·
payload bytes
```
00000000  00 00 00 0d 01 00 00 01  00 0a 20 53 18           |.......... S.|
```

2026-10-10 13:10:48122.136.26.139to 22140/udpSOCKS5CN

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 10:18:35115.63.190.167to 4000/udpUnrecognisedCN

·.· Nc·rfMm? 6coy Ynk·246 w·E·`·iarrSX?@·`wzOp·(^r7·'n·c"·C\%

payload bytes

00000000  1a 2e 0c 09 4e 63 08 72  66 4d 6d 3f 20 36 63 6f  |....Nc.rfMm? 6co|
00000010  79 0d 59 6e 6b 0f 32 34  36 0d 77 1a 45 04 02 60  |y.Ynk.246.w.E..`|
00000020  13 0e 69 61 72 72 53 58  3f 40 17 60 77 7a 4f 70  |..iarrSX?@.`wzOp|
00000030  07 28 5e 72 37 10 27 6e  1e 1e 08 63 22 0b 43 5c  |.(^r7.'n...c".C\|
00000040  25                                                |%|

2026-10-10 08:53:1860.16.213.143to 443/udpUnrecognisedCN
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 06:28:40139.170.73.194to 443/udpUnrecognisedCN
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 04:52:00116.168.37.64to 8083/udpUnrecognisedCN

X.gx4|!`c/·:2Cq·Y+6·`·|!0 5WU t<·(8& ·Ue·

payload bytes

00000000  58 2e 67 78 34 7c 21 60  63 2f 19 3a 32 43 71 18  |X.gx4|!`c/.:2Cq.|
00000010  1c 10 59 2b 36 03 60 1b  7c 21 30 0a 35 57 55 0d  |..Y+6.`.|!0.5WU.|
00000020  74 3c 05 28 38 26 09 1c  55 65 d8                 |t<.(8&..Ue.|

2026-10-10 04:01:25211.90.189.217to 53/udpDNSCN

DNS query TXT/CH version.bind

payload bytes

00000000  ac 2b 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |.+. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

2026-10-10 00:55:22116.171.164.207to 47048/udpSOCKS5CN

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-09 20:05:1158.16.215.47to 27015/udpUnrecognisedCN

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-09 13:16:43124.88.113.72to 2424/udpUnrecognisedCN

· ·,· |·

payload bytes

00000000  15 19 00 18 00 00 00 00  00 00 00 0f 0a 04 02 2c  |...............,|
00000010  00 00 09 7c 00 00 00 00  00 00 00 00              |...|........|

2026-10-09 10:27:231.24.16.39to 53/udpDNSCN

DNS query TXT/CH version.bind

payload bytes

00000000  57 a3 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |W.. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|