UDP traffic

Datagrams matching asn:51396 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

114

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

53 datagrams from 6 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 40 SSDP 5 NetBIOS 2 NTP 2 CoAP 2 SNMP 2

Latest DNS datagram, to 53/udp

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

Unrecognised

61 datagrams from 6 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 61

Latest Unrecognised datagram, to 3702/udp

<:>

payload bytes

00000000  3c 3a 3e                                          |<:>|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	39	4	28 to 54
CharGEN	19/udp	6	2	358.8
SSDP	1900/udp	5	2	30.8
CLDAP	389/udp	25	1	56 to 70
WS-Discovery	3702/udp	24	1	10 to 500
NTP	123/udp	2	1	556.9
NetBIOS	137/udp	2	1	3.8
SNMPv2	161/udp	2	1	6.3
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS39
389/udp CLDAP25
3702/udp WS-Discovery24
19/udp CharGEN6
1900/udp SSDP5
123/udp NTP2
137/udp NetBIOS2
161/udp SNMP2
5683/udp CoAP2
53413/udp2
3283/udp ARMS1
5353/udp DNS1

DNS questions

DNS record types

ANY37
TXT2
PTR1

Networks

AS51396 Pfcloud UG (haftungsbeschrankt) from 9 sources114

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	Unrecognised	76	2026-10-11 03:59
176.65.134.60	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	12	2026-10-09 17:01
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	9	2026-10-11 00:15
176.65.149.208	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	8	2026-10-11 03:28
94.183.174.99	AS51396 Pfcloud UG (haftungsbeschrankt)	AE	Unrecognised	3	2026-10-07 19:28
176.65.149.188	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	DNS	2	2026-10-10 23:42
176.65.149.233	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	2	2026-10-11 03:04
176.65.148.78	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	Unrecognised	1	2026-10-11 01:06
176.65.149.254	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	DNS	1	2026-10-10 15:40

Latest datagrams

2026-10-11 03:59:1145.135.193.115to 3702/udpUnrecognisedDE
<:>
payload bytes
```
00000000  3c 3a 3e                                          |<:>|
```
2026-10-11 03:28:32176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 03:04:36176.65.149.233to 19/udpUnrecognisedNL
·
payload bytes
```
00000000  01                                                |.|
```
2026-10-11 02:53:45176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 02:34:12176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:06:21176.65.148.78to 47808/udpUnrecognisedNL

· ·?·KL

payload bytes

00000000  81 0a 00 11 01 04 00 05  d6 0c 0c 02 3f ff ff 19  |............?...|
00000010  4b 4c                                             |KL|

2026-10-11 00:36:1245.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 00:15:2145.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 23:42:06176.65.149.188to 3283/udpUnrecognisedNL
·
payload bytes
```
00000000  00 14 00 00                                       |....|
```

2026-10-10 23:16:5645.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-10 22:31:0845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 22:14:5845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 20:52:26176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```
2026-10-10 20:33:24176.65.149.208to 19/udpUnrecognisedNL
payload bytes
```
00000000  0a                                                |.|
```