UDP traffic

Datagrams matching country:AR sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

18.6K

Datagrams

231

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

9 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 9

Latest NetBIOS datagram, to 137/udp

NetBIOS node status query *

payload bytes

00000000  eb d0 00 10 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Other services

7 datagrams from 7 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 6 OOKLA 1

Latest SOCKS5 datagram, to 9100/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 09 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

25 datagrams from 22 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 25

Latest Unrecognised datagram, to 9100/udp

·f·4VxO·<&k·

payload bytes

00000000  01 12 aa 66 a7 1b c1 91  a4 00 ff ff 00 fe fe fe  |...f............|
00000010  fe fd fd fd fd 12 34 56  78 4f f9 f6 3c 26 6b f3  |......4VxO..<&k.|
00000020  12                                                |.|

Peer-to-peer

18,587 datagrams from 206 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 18,587

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	9	1	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent18,587
137/udp NetBIOS9
9100/udp4
443/udp SOCKS52
22313/udp1
7860/udp1
6881/udp BitTorrent1
7510/udp1
6091/udp1
8080/udp OOKLA1
8082/udp1
4605/udp SOCKS51

Networks

AS7303 Telecom Argentina S.A. from 31 sources5,799
AS22927 Telefonica de Argentina from 51 sources5,001
AS27747 Telecentro S.A. from 27 sources2,578
AS11664 Techtel LMDS Comunicaciones Interactivas from 21 sources1,794
AS267874 ALBORNOZ GUIDO RUBEN from 1 source622
AS264738 Sebastian Souto (SSSERVICIOS) from 2 sources443
AS264712 MONICA E. SENORANS from 1 source294
AS264758 ISP GROUP SRL from 4 sources270
AS52307 CORPICO LTDA from 1 source264
AS14593 Space Exploration Technologies Corporati from 6 sources218

Countries

AR Argentina18,628

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
201.213.9.2	AS7303 Telecom Argentina S.A.	AR	BitTorrent	1,808	2026-10-11 04:15
181.24.210.22	AS22927 Telefonica de Argentina	AR	BitTorrent	1,208	2026-10-11 04:31
190.226.255.101	AS7303 Telecom Argentina S.A.	AR	BitTorrent	1,092	2026-10-11 03:22
201.254.10.253	AS22927 Telefonica de Argentina	AR	BitTorrent	1,063	2026-10-09 07:00
190.189.32.222	AS7303 Telecom Argentina S.A.	AR	BitTorrent	1,040	2026-10-11 04:07
186.18.255.4	AS27747 Telecentro S.A.	AR	BitTorrent	791	2026-10-08 20:07
181.116.201.242	AS11664 Techtel LMDS Comunicaciones Interactivas	AR	BitTorrent	645	2026-10-10 22:29
45.175.153.225	AS267874 ALBORNOZ GUIDO RUBEN	AR	BitTorrent	622	2026-10-10 23:08
201.177.249.71	AS22927 Telefonica de Argentina	AR	BitTorrent	574	2026-10-08 22:34
181.191.142.57	AS264738 Sebastian Souto (SSSERVICIOS)	AR	BitTorrent	439	2026-10-10 21:47
186.18.255.8	AS27747 Telecentro S.A.	AR	BitTorrent	399	2026-10-11 04:31
186.158.237.2	AS11664 Techtel LMDS Comunicaciones Interactivas	AR	BitTorrent	299	2026-10-08 01:08
186.57.27.105	AS22927 Telefonica de Argentina	AR	BitTorrent	297	2026-10-11 03:12
201.254.0.12	AS22927 Telefonica de Argentina	AR	BitTorrent	295	2026-10-11 04:23
170.150.8.147	AS264712 MONICA E. SENORANS	AR	BitTorrent	294	2026-10-10 05:30
181.46.39.210	AS27747 Telecentro S.A.	AR	BitTorrent	290	2026-10-10 03:12
38.159.65.146	AS52307 CORPICO LTDA	AR	BitTorrent	264	2026-10-10 23:07
181.46.164.126	AS27747 Telecentro S.A.	AR	BitTorrent	256	2026-10-09 14:33
181.44.184.225	AS27747 Telecentro S.A.	AR	BitTorrent	235	2026-10-11 04:31
201.253.52.200	AS7303 Telecom Argentina S.A.	AR	BitTorrent	226	2026-10-09 20:08

Latest datagrams

2026-10-11 04:31:27181.44.184.225to 39131/udpBitTorrentAR

A·|·

payload bytes

00000000  41 00 fe 0f ea 86 da ce  00 00 00 00 00 10 00 00  |A...............|
00000010  7c b3 00 00                                       ||...|

2026-10-11 04:31:21181.44.184.225to 39131/udpBitTorrentAR

A·+·|·

payload bytes

00000000  41 00 fe 0f ea 2b 10 cb  00 00 00 00 00 10 00 00  |A....+..........|
00000010  7c b3 00 00                                       ||...|

2026-10-11 04:31:17181.44.184.225to 39131/udpBitTorrentAR

A·̆·|·

payload bytes

00000000  41 00 fe 0f e9 f8 cc 86  00 00 00 00 00 10 00 00  |A...............|
00000010  7c b3 00 00                                       ||...|

2026-10-11 04:31:14186.18.255.8to 39131/udpBitTorrentAR

A·T?·t·n·

payload bytes

00000000  41 00 54 3f 10 88 fb 74  00 00 00 00 00 10 00 00  |A.T?...t........|
00000010  6e d4 00 00                                       |n...|

2026-10-11 04:31:08186.18.255.8to 39131/udpBitTorrentAR

A·T?·,·n·

payload bytes

00000000  41 00 54 3f 10 2c 84 e1  00 00 00 00 00 10 00 00  |A.T?.,..........|
00000010  6e d4 00 00                                       |n...|

2026-10-11 04:31:07190.173.135.41to 39131/udpBitTorrentAR

A·γĤ·

payload bytes

00000000  41 00 84 a5 ce b3 c4 a4  00 00 00 00 00 10 00 00  |A...............|
00000010  81 16 00 00                                       |....|

2026-10-11 04:31:05186.18.255.8to 39131/udpBitTorrentAR

A·T?·n·

payload bytes

00000000  41 00 54 3f 0f fa a4 a7  00 00 00 00 00 10 00 00  |A.T?............|
00000010  6e d4 00 00                                       |n...|

2026-10-11 04:31:02181.24.210.22to 39131/udpBitTorrentAR

A·,·m·i·

payload bytes

00000000  41 00 2c c1 6d a1 07 69  00 00 00 00 00 10 00 00  |A.,.m..i........|
00000010  ba 87 00 00                                       |....|

2026-10-11 04:31:01190.173.135.41to 39131/udpBitTorrentAR

A·Wԕ·

payload bytes

00000000  41 00 84 a5 ce 57 d4 95  00 00 00 00 00 10 00 00  |A....W..........|
00000010  81 16 00 00                                       |....|

2026-10-11 04:31:00190.48.14.128to 39131/udpBitTorrentAR

d1:ad2:id20:@}·ɑ·6·t·9:info_hash20:@}·|[VM·}·:·c·̈́e1:q9:get_peers1:t2:^·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 40 7d f5 c9  |d1:ad2:id20:@}..|
00000010  91 a6 36 8b b2 05 a8 9f  f9 e3 74 82 03 f6 b1 12  |..6.......t.....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 40 7d  |9:info_hash20:@}|
00000030  f0 7c 5b 56 4d ff 7d 8c  f7 3a d4 ef 63 b6 b5 c7  |.|[VM.}..:..c...|
00000040  cd 84 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 5e 98  31 3a 76 34 3a 4c 54 01  |s1:t2:^.1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 04:30:59190.31.220.203to 39131/udpBitTorrentAR

d1:ad2:id20:#·o[ ·?·z{·Ñ·9:info_hash20:#·n·'`·t·_ϐ:·^e1:q9:get_peers1:t2:·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 23 dd 6f 5b  |d1:ad2:id20:#.o[|
00000010  0d c9 3f b3 15 9e 16 7a  7b e7 c3 91 b0 e4 86 ff  |..?....z{.......|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 23 dd  |9:info_hash20:#.|
00000030  6e a3 27 60 99 e5 e3 74  e1 e5 ab 07 5f cf 90 3a  |n.'`...t...._..:|
00000040  e9 5e 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |.^e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 1c 0f  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 04:30:58190.173.135.41to 39131/udpBitTorrentAR

A·% ·

payload bytes

00000000  41 00 84 a5 ce 25 09 13  00 00 00 00 00 10 00 00  |A....%..........|
00000010  81 16 00 00                                       |....|

2026-10-11 04:30:56181.24.210.22to 39131/udpBitTorrentAR

A·,·mEd_·

payload bytes

00000000  41 00 2c c1 6d 45 64 5f  00 00 00 00 00 10 00 00  |A.,.mEd_........|
00000010  ba 87 00 00                                       |....|

2026-10-11 04:30:53181.24.210.22to 39131/udpBitTorrentAR

A·,·m·}·

payload bytes

00000000  41 00 2c c1 6d 16 7d db  00 00 00 00 00 10 00 00  |A.,.m.}.........|
00000010  ba 87 00 00                                       |....|

2026-10-11 04:29:56186.122.1.228to 39131/udpBitTorrentAR

A·]·o·-·q·

payload bytes

00000000  41 00 5d e6 03 6f cb 2d  00 00 00 00 00 10 00 00  |A.]..o.-........|
00000010  ad 71 00 00                                       |.q..|