UDP traffic

Datagrams matching country:BR sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

7.1K

Datagrams

1.0K

Source addresses

458

Networks

Countries

1.1K

Destination ports

Traffic by type

Service queries

400 datagrams from 19 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 225 DNS 42 SSDP 35 NetBIOS 28 Sun RPC 21 CoAP 20 NTP 19 TFTP 5 SOAP 5

Latest SNMP datagram, to 161/udp

0'·public·7·0·0 ·+·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a1 1a 02  |0'.....public...|
00000010  04 37 ad d0 ff 02 01 00  02 01 00 30 0c 30 0a 06  |.7.........0.0..|
00000020  06 2b 06 01 02 01 2b 05  00                       |.+....+..|

Other services

552 datagrams from 409 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 452 SIP 79 STUN 17 Redis 2 XDMCP 1 OOKLA 1

Latest SOCKS5 datagram, to 29306/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

942 datagrams from 617 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 942

Latest Unrecognised datagram, to 1434/udp

payload bytes

00000000  02                                                |.|

Peer-to-peer

5,170 datagrams from 65 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 5,170

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	225	17	6.3
DNS	53/udp +3	39	4	28 to 54
SSDP	1900/udp	38	4	30.8
Memcached	11211/udp	6	3	10,000 to 51,000
NetBIOS	137/udp	28	2	3.8
Portmap	111/udp	21	2	7 to 28
mDNS	5353/udp	4	2	2 to 10
CLDAP	389/udp	23	1	56 to 70
WS-Discovery	3702/udp	20	1	10 to 500
NTP	123/udp	19	1	556.9
TFTP	69/udp	5	1	60
RIPv1	520/udp	3	1	131.24
CharGEN	19/udp	3	1	358.8
QOTD	17/udp	3	1	140.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent5,165
161/udp SNMP225
5060/udp SIP82
1900/udp SSDP38
443/udp QUIC37
137/udp NetBIOS28
53/udp DNS27
389/udp CLDAP23
1434/udp MSSQL Browser21
111/udp Sun RPC21
5103/udp20
5683/udp CoAP20

DNS questions

DNS record types

ANY28
NS4
PTR3

Networks

AS28573 Claro NXT Telecomunicacoes Ltda from 143 sources1,991
AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S. from 6 sources948
AS271130 WABA PROVEDOR DE INTERNET LTDA from 1 source329
AS8167 V tal from 25 sources306
AS215925 Vpsvault.host Ltd from 3 sources282
AS13335 Cloudflare, Inc. from 2 sources261
AS262460 Ubannet Internet e Informatica Ltda ME from 1 source172
AS28598 DB3 SERVICOS DE TELECOMUNICACOES S.A from 2 sources168
AS52793 Kelvyn Sat Comercio e telecomunicacoes L from 1 source162
AS401661 EMBNEX, LLC from 1 source160

Countries

BR Brazil7,064

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
177.140.104.35	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	688	2026-10-09 22:30
187.19.130.242	AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S.	BR	BitTorrent	534	2026-10-10 20:39
187.39.118.69	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	413	2026-10-11 03:26
187.19.159.116	AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S.	BR	BitTorrent	386	2026-10-10 23:28
179.42.70.205	AS271130 WABA PROVEDOR DE INTERNET LTDA	BR	BitTorrent	329	2026-10-08 02:00
200.96.50.24	AS8167 V tal	BR	BitTorrent	271	2026-10-09 13:46
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Unrecognised	271	2026-10-11 03:13
179.223.203.112	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	237	2026-10-10 09:06
104.28.161.78	AS13335 Cloudflare, Inc.	BR	BitTorrent	183	2026-10-07 21:11
143.255.75.254	AS262460 Ubannet Internet e Informatica Ltda ME	BR	BitTorrent	172	2026-10-07 23:12
201.20.127.186	AS28598 DB3 SERVICOS DE TELECOMUNICACOES S.A	BR	BitTorrent	167	2026-10-08 04:00
177.200.149.189	AS52793 Kelvyn Sat Comercio e telecomunicacoes L	BR	BitTorrent	162	2026-10-05 21:29
16.5.0.234	AS401661 EMBNEX, LLC	BR	Unrecognised	160	2026-10-10 07:10
191.177.175.0	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	159	2026-10-09 09:55
177.82.218.228	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	155	2026-10-08 01:05
191.177.175.168	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	131	2026-10-11 00:55
167.250.155.119	AS262316 Ateky Internet Eireli Me	BR	BitTorrent	119	2026-10-09 20:02
179.49.197.118	AS271261 CAIO DE OLIVEIRA LIMA - ME	BR	BitTorrent	103	2026-10-05 21:06
177.128.84.73	AS262365 IBI TELECOM EIRELI	BR	BitTorrent	90	2026-10-08 21:50
45.163.2.14	AS262847 DBUG TELECOM LTDA	BR	BitTorrent	85	2026-10-10 21:39

Latest datagrams

2026-10-11 03:26:36187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·z·t·k·҂·7·1·#·e1:q9:get_peers1:t2:i·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7a a0 74 93 6b a8 d7 d2  82 8c 37 b5 31 1a bf 23  |z.t.k.....7.1..#|
00000040  fb fd 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 69 98  31 3a 76 34 3a 4c 54 01  |s1:t2:i.1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:23:34187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·|·x ·N·ҙ·"·j·e1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7c 07 88 f8 9d d0 78 09  bd 4e e1 d2 99 02 22 da  ||.....x..N....".|
00000040  6a bf 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |j.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a ba cd  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:15:32187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·x·LKxМ·e1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  78 13 05 d3 4c 4b 78 d0  9c 06 dc c8 1c 06 9d af  |x...LKx.........|
00000040  03 f6 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 14 b3  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:13:1945.205.1.231to 1434/udpUnrecognisedBR
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 03:12:05181.222.80.253to 29306/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-11 03:07:28187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·x~·a}·ѥɖ·6·c e1:q9:get_peers1:t2:·81:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  78 7e f2 61 7d bf 84 8a  d1 a5 c9 96 f2 36 cf 1b  |x~.a}........6..|
00000040  63 0d 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |c.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a ad 38  31 3a 76 34 3a 4c 54 01  |s1:t2:.81:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:01:58177.21.80.185to 39131/udpBitTorrentBR

d1:ad2:id20:'\·6N;3·R·*·9:info_hash20:'\·[·ʓ· ,j·a3&㭪·e1:q9:get_peers1:t2:·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 27 5c c6 36  |d1:ad2:id20:'\.6|
00000010  4e 3b 33 95 f6 13 bc 8f  52 85 2a 89 e6 dc 15 13  |N;3.....R.*.....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 27 5c  |9:info_hash20:'\|
00000030  c7 5b be 9e ca 93 f7 0d  2c 6a d4 61 33 26 e3 ad  |.[......,j.a3&..|
00000040  aa c1 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 18 81  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 03:00:2545.166.204.185to 39131/udpBitTorrentBR

A· @·v:·

payload bytes

00000000  41 00 de 0a 40 8f 76 3a  00 00 00 00 00 10 00 00  |A...@.v:........|
00000010  f1 e1 00 00                                       |....|

2026-10-11 03:00:1945.166.204.185to 39131/udpBitTorrentBR

A· @3·f·

payload bytes

00000000  41 00 de 0a 40 33 e7 66  00 00 00 00 00 10 00 00  |A...@3.f........|
00000010  f1 e1 00 00                                       |....|

2026-10-11 03:00:1645.166.204.185to 39131/udpBitTorrentBR

A· @·

payload bytes

00000000  41 00 de 0a 40 04 e5 14  00 00 00 00 00 10 00 00  |A...@...........|
00000010  f1 e1 00 00                                       |....|

2026-10-11 02:57:2945.205.1.231to 1434/udpUnrecognisedBR
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 02:56:23187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·y·m7·d·u·ͽe1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  79 c6 07 b6 b7 04 aa 6d  37 cf 64 c8 75 e4 c4 f5  |y......m7.d.u...|
00000040  cd bd 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a e5 f2  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 02:55:4045.166.204.185to 39131/udpBitTorrentBR

A·'·/·;·Z·

payload bytes

00000000  41 00 27 e4 2f 88 b5 3b  00 00 00 00 00 10 00 00  |A.'./..;........|
00000010  5a 9c 00 00                                       |Z...|

2026-10-11 02:55:3445.166.204.185to 39131/udpBitTorrentBR

A·'·/-C·Z·

payload bytes

00000000  41 00 27 e4 2f 2d 43 80  00 00 00 00 00 10 00 00  |A.'./-C.........|
00000010  5a 9c 00 00                                       |Z...|

2026-10-11 02:55:3045.166.204.185to 39131/udpBitTorrentBR

A·'·.·W·Z·

payload bytes

00000000  41 00 27 e4 2e f8 b7 57  00 00 00 00 00 10 00 00  |A.'....W........|
00000010  5a 9c 00 00                                       |Z...|