UDP traffic

Datagrams matching asn:51167 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

4 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 4

Latest SNMP datagram, to 161/udp

0;·0·SNMP·0·0·0·

payload bytes

00000000  30 3b 02 01 03 30 11 02  04 53 4e 4d 50 02 03 00  |0;...0...SNMP...|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 11 04 00 04 00  |..........0.....|
00000030  a0 0b 02 01 00 02 01 00  02 01 00 30 00           |...........0.|

Unrecognised

13 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 13

Latest Unrecognised datagram, to 8000/udp

x.jy·iC/T)·X·R·]M*&Pf ·aaR%b·.·0vzO_=~3f·n·c;> ·$·xb*ZjXgj·]dW="Vp·r|·`·q·Nz(r·7w ·"c·zJn·(·

payload bytes

00000000  78 2e 6a 79 1f 69 43 2f  54 29 1d 58 1f 52 08 5d  |x.jy.iC/T).X.R.]|
00000010  4d 2a 26 50 66 0d 03 61  61 52 25 62 08 2e 0c 00  |M*&Pf..aaR%b....|
00000020  30 76 7a 4f 5f 3d 7e 33  66 1c 0b 06 6e 14 63 3b  |0vzO_=~3f...n.c;|
00000030  3e 09 0c 24 16 0f 05 78  62 2a 5a 6a 58 67 6a 08  |>..$...xb*ZjXgj.|
00000040  5d 64 57 3d 22 56 70 08  72 7c 0e 60 10 71 1c 4e  |]dW="Vp.r|.`.q.N|
00000050  7a 28 72 11 37 77 09 19  22 63 03 7a 4a 6e 03 28  |z(r.7w.."c.zJn.(|
00000060  9d 11                                             |..|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	4	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS51167 Contabo GmbH from 4 sources18

Countries

FR France18

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
169.58.136.173	AS51167 Contabo GmbH	FR	Unrecognised	6	2026-10-08 04:46
169.58.11.22	AS51167 Contabo GmbH	FR	Unrecognised	6	2026-10-10 08:23
161.97.174.218	AS51167 Contabo GmbH	FR	SNMP	4	2026-10-07 22:16
158.220.107.11	AS51167 Contabo GmbH	FR	BitTorrent	2	2026-10-06 10:51

Latest datagrams

2026-10-10 08:23:59169.58.11.22to 8000/udpUnrecognisedFR

x.jy·iC/T)·X·R·]M*&Pf ·aaR%b·.·0vzO_=~3f·n·c;> ·$·xb*ZjXgj·]dW="Vp·r|·`·q·Nz(r·7w ·"c·zJn·(·

payload bytes

00000000  78 2e 6a 79 1f 69 43 2f  54 29 1d 58 1f 52 08 5d  |x.jy.iC/T).X.R.]|
00000010  4d 2a 26 50 66 0d 03 61  61 52 25 62 08 2e 0c 00  |M*&Pf..aaR%b....|
00000020  30 76 7a 4f 5f 3d 7e 33  66 1c 0b 06 6e 14 63 3b  |0vzO_=~3f...n.c;|
00000030  3e 09 0c 24 16 0f 05 78  62 2a 5a 6a 58 67 6a 08  |>..$...xb*ZjXgj.|
00000040  5d 64 57 3d 22 56 70 08  72 7c 0e 60 10 71 1c 4e  |]dW="Vp.r|.`.q.N|
00000050  7a 28 72 11 37 77 09 19  22 63 03 7a 4a 6e 03 28  |z(r.7w.."c.zJn.(|
00000060  9d 11                                             |..|

2026-10-08 23:46:43169.58.11.22to 4000/udpUnrecognisedFR

k.z-venU&·q$8k>Z·n·qN·vy·)Do%rm·Mg=CM+·sH ·uU[·C{v·l·O·;B{K·b·R/3k"|u9}j·XoQSecVQj~

payload bytes

00000000  6b 2e 7a 2d 76 65 6e 55  26 1d 71 24 38 6b 3e 5a  |k.z-venU&.q$8k>Z|
00000010  0f 6e 1f 71 4e 07 76 79  1c 29 44 6f 25 72 6d 10  |.n.qN.vy.)Do%rm.|
00000020  4d 67 3d 43 4d 2b 18 73  48 0a 17 01 75 55 5b 04  |Mg=CM+.sH...uU[.|
00000030  43 7b 76 11 02 6c 0b 1f  16 4f 0e 3b 42 7b 4b 0f  |C{v..l...O.;B{K.|
00000040  62 08 52 2f 33 6b 22 7c  75 39 7d 6a 0e 58 6f 51  |b.R/3k"|u9}j.XoQ|
00000050  53 65 63 56 51 6a 7e                              |SecVQj~|

2026-10-08 08:10:55169.58.11.22to 8081/udpUnrecognisedFR

l.jG7Y6v6\P1·XB`·=^Z}·a·

payload bytes

00000000  6c 2e 6a 47 37 59 36 76  36 5c 50 31 0f 58 42 60  |l.jG7Y6v6\P1.XB`|
00000010  7f 1b 07 3d 5e 5a 7d 0b  61 c8 dc                 |...=^Z}.a..|

2026-10-08 05:25:41169.58.11.22to 8000/udpUnrecognisedFR

·.~·_-84_HGVdl·0)j%·C·lEGc·`t~b·]·C·o·YEpEG·EW8nA]·l

payload bytes

00000000  19 2e 7e 02 16 5f 2d 38  34 5f 48 47 56 64 6c 01  |..~.._-84_HGVdl.|
00000010  18 7f 10 30 29 6a 25 17  43 14 6c 45 47 63 7f 60  |...0)j%.C.lEGc.`|
00000020  74 7e 62 0b 5d 0f 43 12  6f 0c 59 45 70 45 47 08  |t~b.].C.o.YEpEG.|
00000030  45 57 38 6e 41 5d 06 10  6c                       |EW8nA]..l|

2026-10-08 04:46:55169.58.136.173to 30301/udpUnrecognisedFR

`.· vj!5·w·e·!·/]·$C# ·*h·F·Bi!Ns·9·LS·

payload bytes

00000000  60 2e 0c 0a 76 6a 21 35  1a 05 77 17 65 1d 21 01  |`...vj!5..w.e.!.|
00000010  2f 5d 1e 24 43 23 20 16  2a 68 0f 46 08 0c 42 69  |/].$C# .*h.F..Bi|
00000020  21 4e 73 17 39 14 4c 53  f3 f4                    |!Ns.9.LS..|

2026-10-08 03:29:10169.58.11.22to 1027/udpUnrecognisedFR

·.<d`h{·>·a t>3 vJch,·ZmG#mi·n\XS<AN>F·OLnY@,·N"W1 ·&

payload bytes

00000000  01 2e 3c 64 60 68 7b 02  05 3e 10 05 61 0a 74 3e  |..<d`h{..>..a.t>|
00000010  33 0d 76 4a 63 68 2c 10  5a 6d 47 23 6d 69 1c 6e  |3.vJch,.ZmG#mi.n|
00000020  5c 58 53 3c 41 4e 3e 46  0c 4f 4c 6e 59 40 2c 0c  |\XS<AN>F.OLnY@,.|
00000030  4e 22 57 31 0a 96 26                              |N"W1..&|

2026-10-07 22:41:08169.58.136.173to 8000/udpUnrecognisedFR

I.1zU/ ·C1·B·wpS-·EYn@XH4m.j~w?/r·_· qUQu·Ql·$· 5_d#·<lS·

payload bytes

00000000  49 2e 31 7a 55 2f 20 0c  12 43 31 03 42 00 77 70  |I.1zU/ ..C1.B.wp|
00000010  53 2d 02 11 45 59 6e 40  58 48 34 6d 2e 6a 7e 77  |S-..EYn@XH4m.j~w|
00000020  3f 2f 72 14 5f 12 20 71  55 51 75 18 51 6c 08 24  |?/r._. qUQu.Ql.$|
00000030  19 0a 35 5f 64 23 1f 3c  6c 53 c6 fb              |..5_d#.<lS..|

2026-10-07 22:16:21161.97.174.218to 161/udpSNMPFR

0;·0·SNMP·0·0·0·

payload bytes

00000000  30 3b 02 01 03 30 11 02  04 53 4e 4d 50 02 03 00  |0;...0...SNMP...|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 11 04 00 04 00  |..........0.....|
00000030  a0 0b 02 01 00 02 01 00  02 01 00 30 00           |...........0.|

2026-10-07 21:54:09161.97.174.218to 161/udpSNMPFR

0;·0·SNMP·0·0·0·

payload bytes

00000000  30 3b 02 01 03 30 11 02  04 53 4e 4d 50 02 03 00  |0;...0...SNMP...|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 11 04 00 04 00  |..........0.....|
00000030  a0 0b 02 01 00 02 01 00  02 01 00 30 00           |...........0.|

2026-10-07 12:23:56169.58.11.22to 4000/udpUnrecognisedFR
·.0g·r
payload bytes
```
00000000  16 2e 30 67 0c 0f 72                              |..0g..r|
```

2026-10-07 12:05:39161.97.174.218to 161/udpSNMPFR

0;·0·SNMP·0·0·0·

payload bytes

00000000  30 3b 02 01 03 30 11 02  04 53 4e 4d 50 02 03 00  |0;...0...SNMP...|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 11 04 00 04 00  |..........0.....|
00000030  a0 0b 02 01 00 02 01 00  02 01 00 30 00           |...........0.|

2026-10-07 11:02:26161.97.174.218to 161/udpSNMPFR

0;·0·SNMP·0·0·0·

payload bytes

00000000  30 3b 02 01 03 30 11 02  04 53 4e 4d 50 02 03 00  |0;...0...SNMP...|
00000010  ff e3 04 01 04 02 01 03  04 10 30 0e 04 00 02 01  |..........0.....|
00000020  00 02 01 00 04 00 04 00  04 00 30 11 04 00 04 00  |..........0.....|
00000030  a0 0b 02 01 00 02 01 00  02 01 00 30 00           |...........0.|

2026-10-07 09:09:51169.58.136.173to 4000/udpUnrecognisedFR

·.fD·shMN·|·jwls"JK#,Gt<·w ·.6}/fcsnW\;%_81I/·<Qh·u·OiQ``^_·\>z@1h· $<l\m5·r\tzQ I;Z)·&

payload bytes

00000000  01 2e 66 44 07 73 68 4d  4e 03 7c 0c 6a 77 6c 73  |..fD.shMN.|.jwls|
00000010  22 4a 4b 23 2c 47 74 3c  11 77 0d 7f 2e 36 7d 2f  |"JK#,Gt<.w...6}/|
00000020  66 63 73 6e 57 5c 3b 25  5f 38 31 49 2f 1e 3c 51  |fcsnW\;%_81I/.<Q|
00000030  68 08 75 15 4f 69 51 60  60 5e 5f 0e 14 5c 3e 7a  |h.u.OiQ``^_..\>z|
00000040  40 31 68 17 0d 24 3c 6c  5c 6d 35 0b 0b 72 5c 74  |@1h..$<l\m5..r\t|
00000050  7a 51 09 49 3b 5a 29 f7  26                       |zQ.I;Z).&|

2026-10-07 00:41:01169.58.136.173to 1027/udpUnrecognisedFR

R.·F1·PJ·[xQ]phVSB"<U·]t5n·&@·-F4·

payload bytes

00000000  52 2e 07 06 46 31 18 1d  50 4a 0e 1b 5b 78 51 5d  |R...F1..PJ..[xQ]|
00000010  70 68 56 53 42 22 3c 55  19 5d 74 35 6e 12 26 40  |phVSB"<U.]t5n.&@|
00000020  12 2d 46 34 93                                    |.-F4.|

2026-10-06 22:14:29169.58.136.173to 4000/udpUnrecognisedFR

,.%jLdl·?E^·0:`·F·5#1`·xgJ·!vIG`·+L'j·sB?SXUn·l T·:·

payload bytes

00000000  2c 2e 25 6a 4c 64 6c 11  3f 45 5e 08 30 3a 60 16  |,.%jLdl.?E^.0:`.|
00000010  15 1b 46 17 1b 35 23 31  60 1a 78 67 4a 14 21 76  |..F..5#1`.xgJ.!v|
00000020  49 47 60 16 2b 4c 27 6a  12 05 73 42 3f 53 58 55  |IG`.+L'j..sB?SXU|
00000030  6e 1f 6c 09 54 0f 3a c2  89                       |n.l.T.:..|