UDP traffic

Datagrams matching asn:58466 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

1 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 1

Latest SNMP datagram, to 162/udp

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

Other services

2 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

XDMCP 1 GTP-U 1

Latest XDMCP datagram, to 177/udp

payload bytes

00000000  00 01 00 02 00 01 00                              |.......|

Unrecognised

16 datagrams from 7 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 16

Latest Unrecognised datagram, to 5554/udp

payload bytes

00000000  01 00 00 00                                       |....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	162/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS58466 CHINANET Guangdong province network from 7 sources19

Countries

CN China19

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
106.75.176.152	AS58466 CHINANET Guangdong province network	CN	Unrecognised	4	2026-10-10 21:17
106.75.174.117	AS58466 CHINANET Guangdong province network	CN	GTP-U	4	2026-10-09 16:22
106.75.174.230	AS58466 CHINANET Guangdong province network	CN	Unrecognised	3	2026-10-10 11:49
106.75.175.147	AS58466 CHINANET Guangdong province network	CN	Unrecognised	3	2026-10-10 05:32
106.75.143.177	AS58466 CHINANET Guangdong province network	CN	Unrecognised	2	2026-10-07 11:51
106.75.177.59	AS58466 CHINANET Guangdong province network	CN	Unrecognised	2	2026-10-10 13:34
106.75.148.246	AS58466 CHINANET Guangdong province network	CN	Unrecognised	1	2026-10-06 19:44

Latest datagrams

2026-10-10 21:17:54106.75.176.152to 5554/udpUnrecognisedCN
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-10 13:34:16106.75.177.59to 5094/udpUnrecognisedCN

payload bytes

00000000  01 00 00 00 00 00 00 00  00 00 00                 |...........|

2026-10-10 11:49:25106.75.174.230to 623/udpUnrecognisedCN

· ·ȁ·8·

payload bytes

00000000  06 00 ff 07 00 00 00 00  00 00 00 00 00 09 20 18  |.............. .|
00000010  c8 81 00 38 8e 04 b5                              |...8...|

2026-10-10 08:08:41106.75.176.152to 6502/udpUnrecognisedCN

ց·0 ·B· ·

payload bytes

00000000  d6 81 81 06 01 00 00 f7  1f ea 01 04 00 00 00 00  |................|
00000010  00 00 01 30 09 fc 11 13  11 42 ff 01 00 00 02 05  |...0.....B......|
00000020  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  |                |
00000030  20 20 20 20 20 20 20 20  20 20 20 20 20 20 20 20  |                |
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 288 bytes shown in part

2026-10-10 05:32:44106.75.175.147to 3333/udpUnrecognisedCN

ESDD· ·A·B·C·D

payload bytes

00000000  45 53 44 44 10 20 04 00  0c fe ff 41 fe ff 42 fe  |ESDD. .....A..B.|
00000010  ff 43 fe ff 44                                    |.C..D|

2026-10-09 16:22:17106.75.174.117to 162/udpSNMPCN

0:·0·Ji·0·0·7·0·

payload bytes

00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

2026-10-09 12:50:52106.75.175.147to 30310/udpUnrecognisedCN

Gardasoft,PP520,012345,000B75018099,0a0a0aa9

payload bytes

00000000  47 61 72 64 61 73 6f 66  74 2c 50 50 35 32 30 2c  |Gardasoft,PP520,|
00000010  30 31 32 33 34 35 2c 30  30 30 42 37 35 30 31 38  |012345,000B75018|
00000020  30 39 39 2c 30 61 30 61  30 61 61 39              |099,0a0a0aa9|

2026-10-09 05:16:34106.75.175.147to 32414/udpUnrecognisedCN
M
payload bytes
```
00000000  4d                                                |M|
```

2026-10-09 00:02:46106.75.174.117to 2123/udpUnrecognisedCN

@·

payload bytes

00000000  40 01 00 00 00 00 00 00  00 00 00 00              |@...........|

2026-10-08 12:46:58106.75.176.152to 6003/udpUnrecognisedCN

{·13911111112·{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 c0  |{...13911111112.|
00000010  a8 01 01 13 90 7b                                 |.....{|

2026-10-08 10:57:59106.75.174.230to 64738/udpUnrecognisedCN
· ·t
payload bytes
```
00000000  00 00 00 00 00 00 00 00  00 09 c1 74              |...........t|
```

2026-10-07 18:23:11106.75.174.230to 626/udpUnrecognisedCN

SNQUERY: 127.0.0.1:AAAAAA:xsvr

payload bytes

00000000  53 4e 51 55 45 52 59 3a  20 31 32 37 2e 30 2e 30  |SNQUERY: 127.0.0|
00000010  2e 31 3a 41 41 41 41 41  41 3a 78 73 76 72        |.1:AAAAAA:xsvr|

2026-10-07 11:51:05106.75.143.177to 33848/udpUnrecognisedCN
payload bytes
```
00000000  0a                                                |.|
```

2026-10-07 07:16:08106.75.176.152to 5405/udpUnrecognisedCN

payload bytes

00000000  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 80 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00                                    |.....|

2026-10-07 06:11:57106.75.177.59to 5050/udpUnrecognisedCN
· · S·
payload bytes
```
00000000  00 00 00 0d 01 00 00 01  00 0a 20 53 18           |.......... S.|
```