UDP traffic

Datagrams matching country:BE sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

134

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

129 datagrams from 18 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 129

Latest NTP datagram, to 123/udp

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

5 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 5

Latest Unrecognised datagram, to 11880/udp

F*·Jز·!·x·\·;·o,·1·"·~#·dJq·x/!·M7·#·Ϯ·Q·U·:·j-·)·'·Ef·gj·Zԯ·X U·u²O·#· v· ·+R3)·~%R·i·ڟ9·,^·cU·}OA·8·о·7Q·e ,·GBH·)·!·/·K

payload bytes

00000000  46 2a 8c 4a d8 b2 9b 21  98 9c 78 80 9e 16 f0 ec  |F*.J...!..x.....|
00000010  5c cf 05 c7 16 a8 f4 3b  ac 6f 2c 7f 31 c2 04 13  |\......;.o,.1...|
00000020  22 90 92 fa 7e 23 b8 64  4a 71 f5 78 2f 21 d5 4d  |"...~#.dJq.x/!.M|
00000030  37 bb a8 23 ef cf ae 86  51 81 02 55 87 0e 3a b1  |7..#....Q..U..:.|
00000040  94 6a 2d d7 29 16 0c 27  90 13 45 66 e9 67 6a 07  |.j-.)..'..Ef.gj.|
00000050  5a d4 af bb 58 20 55 fc  d1 75 c2 b2 4f 19 c3 e6  |Z...X U..u..O...|
00000060  c9 0c 0b 23 10 bf 09 76  fd 20 c4 d7 2b 52 33 29  |...#...v. ..+R3)|
00000070  80 7e 25 52 eb ba ef 69  e3 bc da 9f 39 07 cb 2c  |.~%R...i....9..,|
00000080  5e ad 63 55 fb 7d 4f 41  95 ec 38 0b 04 d0 be 7f  |^.cU.}OA..8.....|
00000090  f0 8b ff 37 51 88 65 0d  2c 91 f5 c1 e6 47 42 48  |...7Q.e.,....GBH|
000000a0  15 e5 29 83 21 d2 2f a2  b9 4b 3e cf cf 58 19 95  |..).!./..K>..X..|
000000b0  34 06 d4 59 f5 69 b6 85  79 99 e8 b8 8b 71 68 e7  |4..Y.i..y....qh.|
000000c0  f4 2e 74 1e 0e 15 bb 28  31 62 64 d4 1f b5 24 70  |..t....(1bd...$p|
000000d0  61 36 98 cf f9 59 7b 3f  cd c1 f9 c8 80 19 20 9d  |a6...Y{?...... .|
000000e0  7b 1f 05 93 73 28 54 76  dd 78 a5 70 50 83 d4 ed  |{...s(Tv.x.pP...|
000000f0  56 a7 91 56 47 0a 51 81  20 e9 69 da 3e 3f ee 93  |V..VG.Q. .i.>?..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	129	18	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

123/udp NTP129
10001/udp Ubiquiti discovery2
11880/udp1
16000/udp1
65413/udp1

Networks

AS396982 Google LLC from 18 sources129
AS5432 Proximus NV from 2 sources2
AS6848 Telenet BV from 1 source2
AS47377 Orange Belgium SA from 1 source1

Countries

BE Belgium134

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
34.38.244.230	AS396982 Google LLC	BE	NTP	14	2026-10-06 09:28
130.211.71.27	AS396982 Google LLC	BE	NTP	11	2026-10-06 12:24
34.156.255.194	AS396982 Google LLC	BE	NTP	10	2026-10-08 12:22
34.140.212.21	AS396982 Google LLC	BE	NTP	10	2026-10-09 09:19
35.187.52.176	AS396982 Google LLC	BE	NTP	9	2026-10-07 11:52
34.22.199.123	AS396982 Google LLC	BE	NTP	8	2026-10-10 11:58
35.187.14.234	AS396982 Google LLC	BE	NTP	8	2026-10-10 12:04
34.14.16.0	AS396982 Google LLC	BE	NTP	7	2026-10-08 10:04
34.156.239.157	AS396982 Google LLC	BE	NTP	7	2026-10-07 11:25
34.78.66.238	AS396982 Google LLC	BE	NTP	7	2026-10-06 09:59
34.76.171.232	AS396982 Google LLC	BE	NTP	7	2026-10-08 10:51
35.233.119.243	AS396982 Google LLC	BE	NTP	7	2026-10-07 09:44
104.155.71.231	AS396982 Google LLC	BE	NTP	5	2026-10-10 06:12
35.187.115.138	AS396982 Google LLC	BE	NTP	5	2026-10-11 05:05
35.233.53.61	AS396982 Google LLC	BE	NTP	5	2026-10-11 05:21
34.140.57.160	AS396982 Google LLC	BE	NTP	4	2026-10-09 05:35
34.22.173.50	AS396982 Google LLC	BE	NTP	3	2026-10-09 05:26
84.197.90.237	AS6848 Telenet BV	BE	Unrecognised	2	2026-10-07 11:51
34.22.219.27	AS396982 Google LLC	BE	NTP	2	2026-10-11 04:39
109.131.249.216	AS5432 Proximus NV	BE	Unrecognised	1	2026-10-08 07:01

Latest datagrams

2026-10-11 05:21:2935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:19:3335.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:05:5335.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:05:4635.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 05:04:0235.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:39:4134.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:35:0435.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:34:5735.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:23:2535.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:13:5534.22.219.27to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:35:0935.233.53.61to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-11 02:34:2535.187.115.138to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-10 12:04:3535.187.14.234to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-10 11:58:3134.22.199.123to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

2026-10-10 10:02:1635.187.14.234to 123/udpNTPBE

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|