UDP traffic

Datagrams matching asn:57044 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Unrecognised

6 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 6

Latest Unrecognised datagram, to 1434/udp

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

1434/udp MSSQL Browser2
8000/udp1
8080/udp1
8081/udp1
11211/udp Memcached1

Networks

AS57044 JSC ER-Telecom Holding from 3 sources6

Countries

RU Russia6

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
31.132.169.138	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	4	2026-10-11 03:17
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	1	2026-10-10 09:33
37.112.57.95	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	1	2026-10-10 11:00

Latest datagrams

2026-10-11 03:17:2131.132.169.138to 1434/udpUnrecognisedRU

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

2026-10-11 02:14:4031.132.169.138to 8080/udpUnrecognisedRU

;.:rub`h2|· n·ibNX)·l$·V c·U":G·(·N$·[·DtT·e9 A`·c·

payload bytes

00000000  3b 2e 3a 72 75 62 60 68  32 7c 01 0d 6e 05 69 62  |;.:rub`h2|..n.ib|
00000010  4e 58 29 11 1c 6c 24 08  56 09 63 1e 1a 15 00 55  |NX)..l$.V.c....U|
00000020  22 3a 47 17 1c 28 7f 4e  24 00 5b 12 06 44 74 54  |":G..(.N$.[..DtT|
00000030  1d 1e 65 39 0a 09 41 60  12 63 af                 |..e9..A`.c.|

2026-10-11 02:13:0431.132.169.138to 8081/udpUnrecognisedRU

V.;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·puym*·u28370tn99g·u·0d·

payload bytes

00000000  56 2e 3b 3e 3e 7b 0e 52  72 34 6f 61 7d 35 07 08  |V.;>>{.Rr4oa}5..|
00000010  08 38 3e 05 77 41 36 09  45 79 56 3b 1a 21 6f 70  |.8>.wA6.EyV;.!op|
00000020  76 2a 2e 34 26 3c 06 18  70 75 79 6d 2a 00 75 32  |v*.4&<..puym*.u2|
00000030  38 33 37 30 74 6e 39 39  67 0f 75 01 30 64 86 aa  |8370tn99g.u.0d..|

2026-10-10 11:00:5337.112.57.95to 8000/udpUnrecognisedRU

·.d)CC·f·_· "6·NY,·+U ·0· C9ml}1·cH"BS@LuvL·D%@M7k"W ?· HKC67@g>#/ae·!2x·~·4

payload bytes

00000000  12 2e 64 29 43 43 1b 66  17 1b 5f 0b 1d 0a 22 36  |..d)CC.f.._..."6|
00000010  7f 1e 4e 59 2c 08 12 2b  55 20 1e 1c 30 00 09 43  |..NY,..+U ..0..C|
00000020  39 6d 6c 7d 31 07 63 48  22 42 53 40 4c 75 76 4c  |9ml}1.cH"BS@LuvL|
00000030  14 44 25 40 4d 37 6b 22  57 09 3f 08 09 48 4b 43  |.D%@M7k"W.?..HKC|
00000040  36 37 40 67 3e 23 2f 61  65 03 21 32 78 17 7e 0c  |67@g>#/ae.!2x.~.|
00000050  07 34                                             |.4|

2026-10-10 09:33:15212.103.118.144to 11211/udpUnrecognisedRU

·.[·;·<Lh*i/ih{w7Wd/·LS",lw·o YJ·N-P·z·Eck@Z#·>·

payload bytes

00000000  12 2e 5b 05 3b 04 1e 3c  4c 68 2a 69 2f 69 68 7b  |..[.;..<Lh*i/ih{|
00000010  77 37 57 64 2f 1b 11 4c  53 22 2c 6c 77 1b 6f 0a  |w7Wd/..LS",lw.o.|
00000020  59 4a 0f 14 4e 2d 50 1a  15 7a 03 45 63 6b 40 5a  |YJ..N-P..z.Eck@Z|
00000030  23 17 3e 93 fb                                    |#.>..|

2026-10-10 08:38:2231.132.169.138to 1434/udpUnrecognisedRU

·. ·[·M:~9·k·< 8·(q6_55·$·X,@c·Jvz]y·*3·cM|· 9·1*R·`·p0OTO·JIvC\ vm·Ci·Mr=i#h;4HBMLR=|!·L; ,

payload bytes

00000000  0b 2e 0a 12 5b 13 03 18  4d 3a 7e 39 1a 6b 1d 3c  |....[...M:~9.k.<|
00000010  0d 38 12 28 71 36 5f 35  35 07 24 08 58 2c 40 63  |.8.(q6_55.$.X,@c|
00000020  1f 4a 76 7a 5d 79 12 2a  33 11 63 4d 7c 00 0a 09  |.Jvz]y.*3.cM|...|
00000030  39 1c 31 2a 52 11 60 07  18 04 0f 70 30 4f 54 4f  |9.1*R.`....p0OTO|
00000040  19 4a 49 76 43 5c 20 76  6d 04 43 69 04 4d 72 3d  |.JIvC\ vm.Ci.Mr=|
00000050  69 23 68 3b 34 48 42 4d  4c 52 3d 7c 21 11 4c 3b  |i#h;4HBMLR=|!.L;|
00000060  0d 2c                                             |.,|