UDP traffic

Datagrams matching asn:50219 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

20 datagrams from 9 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 11 SNMP 4 NetBIOS 2 NTP 1 SSDP 1 SOAP 1

Latest DNS datagram, to 53/udp

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

Other services

9 datagrams from 6 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

GTP-U 4 GTP-C 4 SIP 1

Latest GTP-U datagram, to 2152/udp

2·=·

payload bytes

00000000  32 01 00 04 00 00 00 00  0c 3d 00 00              |2........=..|

QUIC

2 datagrams from 2 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 2

Latest QUIC datagram, to 443/udp

QUIC version 0xfa1a1a1a probe

Unrecognised

22 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 22

Latest Unrecognised datagram, to 1701/udp

·X·Vigor· · 陀 · ·Draytek

payload bytes

00000000  c8 02 00 58 00 00 00 00  00 00 00 01 80 08 00 00  |...X............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0b 00 00  |................|
00000020  00 07 56 69 67 6f 72 80  0a 00 00 00 03 00 00 00  |..Vigor.........|
00000030  03 80 08 00 00 00 09 e9  99 80 0a 00 00 00 04 00  |................|
00000040  00 00 03 00 08 00 00 00  06 00 01 00 0d 00 00 00  |................|
00000050  08 44 72 61 79 74 65 6b                           |.Draytek|

Peer-to-peer

2 datagrams from 2 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 2

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	10	5	2 to 10
SNMPv2	161/udp	4	2	6.3
NetBIOS	137/udp	2	2	3.8
DNS	53/udp	1	1	28 to 54
NTP	123/udp	1	1	556.9
SSDP	1900/udp	1	1	30.8
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

2152/udp GTP-U12
5353/udp DNS10
2123/udp GTP-C6
161/udp SNMP4
1701/udp L2TP3
4500/udp IPsec NAT-T3
137/udp NetBIOS2
443/udp QUIC2
500/udp IKE2
6881/udp BitTorrent2
10161/udp2
53/udp DNS1

DNS questions

DNS record types

PTR10
A1

QUIC versions

0xfa1a1a1a2

Networks

AS50219 Valence Technology Co. from 11 sources55

Countries

US United States55

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.226.76.20	AS50219 Valence Technology Co.	US	Unrecognised	8	2026-10-10 22:25
216.226.78.10	AS50219 Valence Technology Co.	US	Unrecognised	8	2026-10-08 21:51
216.226.78.20	AS50219 Valence Technology Co.	US	DNS	7	2026-10-09 14:12
216.226.76.30	AS50219 Valence Technology Co.	US	Unrecognised	6	2026-10-10 14:15
194.164.107.5	AS50219 Valence Technology Co.	US	SNMP	5	2026-10-07 12:06
216.226.77.20	AS50219 Valence Technology Co.	US	Unrecognised	5	2026-10-09 00:28
216.226.77.30	AS50219 Valence Technology Co.	US	Unrecognised	4	2026-10-11 04:16
216.226.78.30	AS50219 Valence Technology Co.	US	Unrecognised	4	2026-10-09 09:41
216.226.76.10	AS50219 Valence Technology Co.	US	QUIC	4	2026-10-10 14:04
194.164.107.4	AS50219 Valence Technology Co.	US	DNS	3	2026-10-10 02:01
194.164.107.6	AS50219 Valence Technology Co.	US	NetBIOS	1	2026-10-08 13:46

Latest datagrams

2026-10-11 04:16:39216.226.77.30to 1701/udpUnrecognisedUS

·X·Vigor· · 陀 · ·Draytek

payload bytes

00000000  c8 02 00 58 00 00 00 00  00 00 00 01 80 08 00 00  |...X............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0b 00 00  |................|
00000020  00 07 56 69 67 6f 72 80  0a 00 00 00 03 00 00 00  |..Vigor.........|
00000030  03 80 08 00 00 00 09 e9  99 80 0a 00 00 00 04 00  |................|
00000040  00 00 03 00 08 00 00 00  06 00 01 00 0d 00 00 00  |................|
00000050  08 44 72 61 79 74 65 6b                           |.Draytek|

2026-10-10 22:25:30216.226.76.20to 500/udpUnrecognisedUS

· ·s4·$U·P·4·(·$·p·$·p·$·p·$

payload bytes

00000000  a9 0d cd 73 34 08 24 55  00 00 00 00 00 00 00 00  |...s4.$U........|
00000010  01 10 02 00 00 00 00 00  00 00 01 50 00 00 01 34  |...........P...4|
00000020  00 00 00 01 00 00 00 01  00 00 01 28 01 01 00 08  |...........(....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 03 00 01 80 04 00 02  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 70 80 03 00 00 24  02 01 00 00 80 01 00 05  |..p....$........|
00000060  80 02 00 01 80 03 00 01  80 04 00 02 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 70 80  03 00 00 24 03 01 00 00  |......p....$....|
00000080  80 01 00 01 80 02 00 02  80 03 00 01 80 04 00 02  |................|
00000090  80 0b 00 01 00 0c 00 04  00 00 70 80 03 00 00 24  |..........p....$|
000000a0  04 01 00 00 80 01 00 01  80 02 00 01 80 03 00 01  |................|
000000b0  80 04 00 02 80 0b 00 01  00 0c 00 04 00 00 70 80  |..............p.|
000000c0  03 00 00 24 05 01 00 00  80 01 00 05 80 02 00 02  |...$............|
000000d0  80 03 00 01 80 04 00 01  80 0b 00 01 00 0c 00 04  |................|
000000e0  00 00 70 80 03 00 00 24  06 01 00 00 80 01 00 05  |..p....$........|
000000f0  80 02 00 01 80 03 00 01  80 04 00 01 80 0b 00 01  |................|
... 336 bytes shown in part

2026-10-10 14:15:50216.226.76.30to 2152/udpUnrecognisedUS
@·
payload bytes
```
00000000  40 01 00 04 ff 00 00 00                           |@.......|
```

2026-10-10 14:04:04216.226.76.10to 53/udpDNSUS

DNS query A www.google.com

payload bytes

00000000  ae 0d 01 00 00 01 00 00  00 00 00 00 03 77 77 77  |.............www|
00000010  06 67 6f 6f 67 6c 65 03  63 6f 6d 00 00 01 00 01  |.google.com.....|

2026-10-10 13:51:57216.226.76.30to 2152/udpGTP-UUS

2·=·

payload bytes

00000000  32 01 00 04 00 00 00 00  0c 3d 00 00              |2........=..|

2026-10-10 13:29:17216.226.76.30to 2152/udpUnrecognisedUS

·3133·

payload bytes

00000000  10 01 00 00 00 00 00 00  00 ff ff ff 33 31 33 33  |............3133|
00000010  00 00 00 00                                       |....|

2026-10-10 13:14:18216.226.77.30to 5353/udpDNSUS

DNS query PTR _device-info._tcp.local

payload bytes

00000000  62 b9 01 20 00 01 00 00  00 00 00 01 0c 5f 64 65  |b.. ........._de|
00000010  76 69 63 65 2d 69 6e 66  6f 04 5f 74 63 70 05 6c  |vice-info._tcp.l|
00000020  6f 63 61 6c 00 00 0c 00  01 00 00 29 04 d0 00 00  |ocal.......)....|
00000030  00 00 00 0c 00 0a 00 08  83 4c 64 dd ca ac 8f 65  |.........Ld....e|

2026-10-10 12:51:57216.226.77.30to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-10 12:33:12216.226.76.10to 6881/udpBitTorrentUS

d1:ad2:id20:q·vr·Ӣ·dE·PF·3F6:target20:·\·[O·h·S·зe1:q9:find_node1:t1:a1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 71 88 80 c8  |d1:ad2:id20:q...|
00000010  76 72 f1 13 d3 a2 a4 f6  64 45 c7 50 46 0c 33 46  |vr......dE.PF.3F|
00000020  36 3a 74 61 72 67 65 74  32 30 3a be f6 01 d2 c0  |6:target20:.....|
00000030  f9 b2 5c 82 05 5b 4f c6  68 e3 53 94 d2 d0 b7 65  |..\..[O.h.S....e|
00000040  31 3a 71 39 3a 66 69 6e  64 5f 6e 6f 64 65 31 3a  |1:q9:find_node1:|
00000050  74 31 3a 61 31 3a 79 31  3a 71 65                 |t1:a1:y1:qe|

2026-10-10 02:01:36194.164.107.4to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a 0d 0a              |..MX:3......|

2026-10-09 14:12:32216.226.78.20to 5353/udpDNSUS

DNS query PTR _device-info._tcp.local

payload bytes

00000000  62 b9 01 20 00 01 00 00  00 00 00 01 0c 5f 64 65  |b.. ........._de|
00000010  76 69 63 65 2d 69 6e 66  6f 04 5f 74 63 70 05 6c  |vice-info._tcp.l|
00000020  6f 63 61 6c 00 00 0c 00  01 00 00 29 04 d0 00 00  |ocal.......)....|
00000030  00 00 00 0c 00 0a 00 08  83 4c 64 dd ca ac 8f 65  |.........Ld....e|

2026-10-09 13:50:17216.226.78.20to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-09 09:41:28216.226.78.30to 2152/udpUnrecognisedUS
@·
payload bytes
```
00000000  40 01 00 04 ff 00 00 00                           |@.......|
```

2026-10-09 09:19:20216.226.78.30to 2152/udpGTP-UUS

2·=·

payload bytes

00000000  32 01 00 04 00 00 00 00  0c 3d 00 00              |2........=..|

2026-10-09 08:57:14216.226.78.30to 2152/udpUnrecognisedUS

·3133·

payload bytes

00000000  10 01 00 00 00 00 00 00  00 ff ff ff 33 31 33 33  |............3133|
00000010  00 00 00 00                                       |....|