UDP traffic

Datagrams matching asn:57044 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

OpenVPN 1

Latest OpenVPN datagram, to 5353/udp

\.% z·~#p</·~:qTC$HCF Q·k·gX,R5*wU$}SHn·wz·1kct·+8U4 `6ub·M·p·8gW]d+%R;·MIM8,·

payload bytes

00000000  5c 2e 25 20 7a 06 7e 23  70 3c 2f 0c 7e 3a 71 54  |\.% z.~#p</.~:qT|
00000010  43 24 48 43 46 09 51 0b  02 6b 02 67 58 2c 52 35  |C$HCF.Q..k.gX,R5|
00000020  2a 77 55 24 7d 53 48 6e  10 77 7a 0e 31 6b 63 74  |*wU$}SHn.wz.1kct|
00000030  0f 2b 38 55 34 09 60 36  75 62 1e 4d 0e 70 02 38  |.+8U4.`6ub.M.p.8|
00000040  67 57 5d 64 2b 25 52 3b  1c 4d 49 4d 38 2c c3 f4  |gW]d+%R;.MIM8,..|

Unrecognised

27 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 27

Latest Unrecognised datagram, to 1434/udp

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	7	4	2 to 10
Memcached	11211/udp	3	3	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5353/udp mDNS7
1027/udp4
1434/udp MSSQL Browser4
8081/udp3
11211/udp Memcached3
8080/udp2
4000/udp1
5060/udp SIP1
6881/udp BitTorrent1
8000/udp1
8083/udp1
30301/udp1

Networks

AS57044 JSC ER-Telecom Holding from 5 sources29

Countries

RU Russia29

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	10	2026-10-10 09:33
31.132.169.138	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	8	2026-10-11 03:17
37.112.63.117	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	5	2026-10-08 07:22
37.112.57.95	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	4	2026-10-10 11:00
37.112.57.53	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	2	2026-10-08 05:32

Latest datagrams

2026-10-11 03:17:2131.132.169.138to 1434/udpUnrecognisedRU

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

2026-10-11 02:14:4031.132.169.138to 8080/udpUnrecognisedRU

;.:rub`h2|· n·ibNX)·l$·V c·U":G·(·N$·[·DtT·e9 A`·c·

payload bytes

00000000  3b 2e 3a 72 75 62 60 68  32 7c 01 0d 6e 05 69 62  |;.:rub`h2|..n.ib|
00000010  4e 58 29 11 1c 6c 24 08  56 09 63 1e 1a 15 00 55  |NX)..l$.V.c....U|
00000020  22 3a 47 17 1c 28 7f 4e  24 00 5b 12 06 44 74 54  |":G..(.N$.[..DtT|
00000030  1d 1e 65 39 0a 09 41 60  12 63 af                 |..e9..A`.c.|

2026-10-11 02:13:0431.132.169.138to 8081/udpUnrecognisedRU

V.;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·puym*·u28370tn99g·u·0d·

payload bytes

00000000  56 2e 3b 3e 3e 7b 0e 52  72 34 6f 61 7d 35 07 08  |V.;>>{.Rr4oa}5..|
00000010  08 38 3e 05 77 41 36 09  45 79 56 3b 1a 21 6f 70  |.8>.wA6.EyV;.!op|
00000020  76 2a 2e 34 26 3c 06 18  70 75 79 6d 2a 00 75 32  |v*.4&<..puym*.u2|
00000030  38 33 37 30 74 6e 39 39  67 0f 75 01 30 64 86 aa  |8370tn99g.u.0d..|

2026-10-10 11:00:5337.112.57.95to 8000/udpUnrecognisedRU

·.d)CC·f·_· "6·NY,·+U ·0· C9ml}1·cH"BS@LuvL·D%@M7k"W ?· HKC67@g>#/ae·!2x·~·4

payload bytes

00000000  12 2e 64 29 43 43 1b 66  17 1b 5f 0b 1d 0a 22 36  |..d)CC.f.._..."6|
00000010  7f 1e 4e 59 2c 08 12 2b  55 20 1e 1c 30 00 09 43  |..NY,..+U ..0..C|
00000020  39 6d 6c 7d 31 07 63 48  22 42 53 40 4c 75 76 4c  |9ml}1.cH"BS@LuvL|
00000030  14 44 25 40 4d 37 6b 22  57 09 3f 08 09 48 4b 43  |.D%@M7k"W.?..HKC|
00000040  36 37 40 67 3e 23 2f 61  65 03 21 32 78 17 7e 0c  |67@g>#/ae.!2x.~.|
00000050  07 34                                             |.4|

2026-10-10 09:33:15212.103.118.144to 11211/udpUnrecognisedRU

·.[·;·<Lh*i/ih{w7Wd/·LS",lw·o YJ·N-P·z·Eck@Z#·>·

payload bytes

00000000  12 2e 5b 05 3b 04 1e 3c  4c 68 2a 69 2f 69 68 7b  |..[.;..<Lh*i/ih{|
00000010  77 37 57 64 2f 1b 11 4c  53 22 2c 6c 77 1b 6f 0a  |w7Wd/..LS",lw.o.|
00000020  59 4a 0f 14 4e 2d 50 1a  15 7a 03 45 63 6b 40 5a  |YJ..N-P..z.Eck@Z|
00000030  23 17 3e 93 fb                                    |#.>..|

2026-10-10 08:38:2231.132.169.138to 1434/udpUnrecognisedRU

·. ·[·M:~9·k·< 8·(q6_55·$·X,@c·Jvz]y·*3·cM|· 9·1*R·`·p0OTO·JIvC\ vm·Ci·Mr=i#h;4HBMLR=|!·L; ,

payload bytes

00000000  0b 2e 0a 12 5b 13 03 18  4d 3a 7e 39 1a 6b 1d 3c  |....[...M:~9.k.<|
00000010  0d 38 12 28 71 36 5f 35  35 07 24 08 58 2c 40 63  |.8.(q6_55.$.X,@c|
00000020  1f 4a 76 7a 5d 79 12 2a  33 11 63 4d 7c 00 0a 09  |.Jvz]y.*3.cM|...|
00000030  39 1c 31 2a 52 11 60 07  18 04 0f 70 30 4f 54 4f  |9.1*R.`....p0OTO|
00000040  19 4a 49 76 43 5c 20 76  6d 04 43 69 04 4d 72 3d  |.JIvC\ vm.Ci.Mr=|
00000050  69 23 68 3b 34 48 42 4d  4c 52 3d 7c 21 11 4c 3b  |i#h;4HBMLR=|!.L;|
00000060  0d 2c                                             |.,|

2026-10-10 05:29:22212.103.118.144to 1027/udpUnrecognisedRU

T.R7`lD-·25Ra0e[·=·8g`v3ZbzG@!·iKvU·#lBY># #~·`m·

payload bytes

00000000  54 2e 52 37 60 6c 44 2d  17 32 35 52 61 30 65 5b  |T.R7`lD-.25Ra0e[|
00000010  05 3d 04 38 67 60 76 33  5a 62 7a 47 40 21 16 14  |.=.8g`v3ZbzG@!..|
00000020  16 69 4b 76 55 0f 23 6c  42 59 3e 23 09 23 7e 0e  |.iKvU.#lBY>#.#~.|
00000030  60 6d e7                                          |`m.|

2026-10-09 23:05:5231.132.169.138to 30301/udpUnrecognisedRU

·.·f·g&t·N} ·c.·G%·

payload bytes

00000000  06 2e 1d 12 66 06 67 26  74 1a 4e 7d 0d 1e 63 2e  |....f.g&t.N}..c.|
00000010  05 11 47 25 cd                                    |..G%.|

2026-10-09 19:54:08212.103.118.144to 5353/udpUnrecognisedRU

7.·=-] ]]&y/.P·-~)fI· (·

payload bytes

00000000  37 2e 19 3d 2d 5d 0d 5d  5d 26 79 2f 2e 50 16 2d  |7..=-].]]&y/.P.-|
00000010  7e 29 66 49 05 09 28 8a                           |~)fI..(.|

2026-10-09 19:52:54212.103.118.144to 8081/udpUnrecognisedRU

x.p>;·@A2/9VLkM·/Mp+ozo·~9,·,b·$·}b@}"·/Q:·%R3T $·o·(?:T!Fx&C[f@}gpO!umFH ·hA+

payload bytes

00000000  78 2e 70 3e 3b 00 40 41  32 2f 39 56 4c 6b 4d 15  |x.p>;.@A2/9VLkM.|
00000010  2f 4d 70 2b 6f 7a 6f 04  7e 39 2c 1e 2c 62 0c 24  |/Mp+ozo.~9,.,b.$|
00000020  04 7d 62 40 7d 22 01 2f  51 3a 05 1e 25 52 33 54  |.}b@}"./Q:..%R3T|
00000030  20 24 00 0f 1e 6f 13 1c  28 3f 3a 54 21 46 78 26  | $...o..(?:T!Fx&|
00000040  43 5b 66 40 7d 67 70 4f  21 75 6d 46 48 20 1b 68  |C[f@}gpO!umFH .h|
00000050  41 2b                                             |A+|

2026-10-09 11:43:1037.112.57.95to 5353/udpUnrecognisedRU

p.2 ·lZAG -F·{A·hediN`·JlsV8c·jn·oZe0"·]h·X).@S@

payload bytes

00000000  70 2e 32 0a 09 04 6c 5a  41 47 20 2d 46 0e 7b 41  |p.2...lZAG -F.{A|
00000010  1b 68 65 64 69 4e 60 1c  00 1d 4a 6c 73 56 38 63  |.hediN`...JlsV8c|
00000020  02 6a 6e 0b 6f 5a 65 30  22 05 5d 68 13 58 29 2e  |.jn.oZe0".]h.X).|
00000030  40 53 40                                          |@S@|

2026-10-09 07:35:29212.103.118.144to 4000/udpUnrecognisedRU
U.KcL@D·I·
payload bytes
```
00000000  55 2e 4b 63 4c 40 44 08  49 ee                    |U.KcL@D.I.|
```

2026-10-09 04:31:2437.112.57.95to 1434/udpUnrecognisedRU

D.ZF8F7·3·i,gl_G4f·gRE(oAZ0RJ7b·[<T·6·brqA:%'?·y·5iE·YQzg,7;?9G[oR`RER·

payload bytes

00000000  44 2e 5a 46 38 46 37 08  33 00 69 2c 67 6c 5f 47  |D.ZF8F7.3.i,gl_G|
00000010  34 66 05 67 52 45 28 6f  41 5a 30 52 4a 37 62 0e  |4f.gRE(oAZ0RJ7b.|
00000020  5b 3c 54 13 02 0b 1c 36  0b 05 62 72 71 41 3a 25  |[<T....6..brqA:%|
00000030  27 3f 0c 79 04 35 69 45  0f 19 18 59 51 7a 67 2c  |'?.y.5iE...YQzg,|
00000040  37 3b 3f 39 47 5b 6f 52  60 52 45 52 e0 dc        |7;?9G[oR`RER..|

2026-10-09 01:28:1831.132.169.138to 1434/udpUnrecognisedRU

E.3@UO·S· $·\·t_B<·-

payload bytes

00000000  45 2e 33 40 55 4f 13 53  7f 20 24 01 5c 1d 74 5f  |E.3@UO.S. $.\.t_|
00000010  42 3c 91 2d                                       |B<.-|

2026-10-08 07:22:2237.112.63.117to 5353/udpUnrecognisedRU
I.=(RQ·s5·$
payload bytes
```
00000000  49 2e 3d 28 52 51 0f 1e  73 35 fb 24              |I.=(RQ..s5.$|
```