UDP traffic

Datagrams matching country:BR sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

682

Datagrams

103

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

32 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 6 SNMP 6 NetBIOS 4 NTP 4 DNS 4 CoAP 4 Sun RPC 4

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 HOST: 239.255.255.250:1900 MAN: "ssdp:discover" MX: 1 ST: upnp:rootdevice

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 20 32 33 39 2e 32  |1.1..HOST: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 41 4e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.MAN: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 31 0d 0a 53 54  |over"..MX: 1..ST|
00000050  3a 20 75 70 6e 70 3a 72  6f 6f 74 64 65 76 69 63  |: upnp:rootdevic|
00000060  65 0d 0a 0d 0a                                    |e....|

Other services

49 datagrams from 42 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 41 SIP 8

Latest SOCKS5 datagram, to 48384/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

69 datagrams from 47 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 69

Latest Unrecognised datagram, to 17025/udp

·r·bZ·I·4Vx-·9O

payload bytes

00000000  01 72 be 62 5a b2 d1 49  c1 00 ff ff 00 fe fe fe  |.r.bZ..I........|
00000010  fe fd fd fd fd 12 34 56  78 2d 9e 85 10 86 f4 39  |......4Vx-.....9|
00000020  4f                                                |O|

Peer-to-peer

532 datagrams from 16 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 532

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	6	2	6.3
WS-Discovery	3702/udp	8	1	10 to 500
SSDP	1900/udp	6	1	30.8
Portmap	111/udp	4	1	7 to 28
DNS	53/udp	4	1	28 to 54
NTP	123/udp	4	1	556.9
NetBIOS	137/udp	4	1	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent532
3702/udp WS-Discovery8
1434/udp MSSQL Browser8
5060/udp SIP8
161/udp SNMP6
1900/udp SSDP6
443/udp SOCKS55
123/udp NTP4
137/udp NetBIOS4
53/udp DNS4
111/udp Sun RPC4
5683/udp CoAP4

DNS questions

wisc.edu ANY4

DNS record types

ANY4

Networks

AS28573 Claro NXT Telecomunicacoes Ltda from 20 sources203
AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S. from 3 sources93
AS262847 DBUG TELECOM LTDA from 1 source85
AS265973 R7 TELECOMUNICACOES EIRELI ME from 1 source69
AS215925 Vpsvault.host Ltd from 1 source49
AS263981 DAVID DE SALLES BRASIL JUNIOR - ME from 1 source36
AS18881 TELEFONICA BRASIL S.A from 4 sources24
AS262481 VERO S.A from 2 sources21
AS52927 IBIPAR S/A from 1 source10
AS13335 Cloudflare, Inc. from 1 source10

Countries

BR Brazil682

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
191.177.175.168	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	115	2026-10-11 00:55
45.163.2.14	AS262847 DBUG TELECOM LTDA	BR	BitTorrent	85	2026-10-10 21:39
177.221.120.9	AS265973 R7 TELECOMUNICACOES EIRELI ME	BR	BitTorrent	69	2026-10-10 18:34
187.19.130.242	AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S.	BR	BitTorrent	61	2026-10-10 20:39
187.39.118.69	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	51	2026-10-11 04:30
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Unrecognised	49	2026-10-11 04:18
168.232.229.68	AS263981 DAVID DE SALLES BRASIL JUNIOR - ME	BR	BitTorrent	36	2026-10-10 17:54
187.19.255.232	AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S.	BR	BitTorrent	22	2026-10-10 17:40
45.166.204.185	AS262481 VERO S.A	BR	BitTorrent	20	2026-10-11 03:00
179.180.44.219	AS18881 TELEFONICA BRASIL S.A	BR	BitTorrent	20	2026-10-10 21:15
179.223.203.112	AS28573 Claro NXT Telecomunicacoes Ltda	BR	BitTorrent	17	2026-10-10 09:06
187.19.159.116	AS28126 BRISANET SERVICOS DE TELECOMUNICACOES S.	BR	BitTorrent	10	2026-10-10 23:28
104.28.163.3	AS13335 Cloudflare, Inc.	BR	BitTorrent	10	2026-10-10 05:32
177.185.39.123	AS52927 IBIPAR S/A	BR	BitTorrent	10	2026-10-10 21:46
177.21.80.185	AS53088 FORNET COMUNICACOES LTDA	BR	BitTorrent	4	2026-10-11 03:01
189.6.238.21	AS28573 Claro NXT Telecomunicacoes Ltda	BR	SOCKS5	3	2026-10-10 17:44
143.137.117.207	AS263966 WORLD WIFI TELECOMUNICACOES LTDA - ME	BR	SOCKS5	2	2026-10-10 12:21
201.48.108.11	AS16735 ALGAR TELECOM S/A	BR	Unrecognised	2	2026-10-10 19:47
177.16.65.37	AS18881 TELEFONICA BRASIL S.A	BR	Unrecognised	2	2026-10-10 23:23
45.234.212.72	AS267373 AGIL TECOMUNICACOES LTDA	BR	SIP	2	2026-10-10 07:34

Latest datagrams

2026-10-11 04:30:59201.32.72.104to 17025/udpUnrecognisedBR

·r·bZ·I·4Vx-·9O

payload bytes

00000000  01 72 be 62 5a b2 d1 49  c1 00 ff ff 00 fe fe fe  |.r.bZ..I........|
00000010  fe fd fd fd fd 12 34 56  78 2d 9e 85 10 86 f4 39  |......4Vx-.....9|
00000020  4f                                                |O|

2026-10-11 04:30:58187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·zC·4I·J·b)·e1:q9:get_peers1:t2:·<1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7a 43 0f a8 b5 34 49 e8  9e f4 ec 4a 86 f4 62 29  |zC...4I....J..b)|
00000040  8d a1 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a d0 3c  31 3a 76 34 3a 4c 54 01  |s1:t2:.<1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 04:18:4245.205.1.231to 161/udpSNMPBR

0%·public·-·0 0·+·

payload bytes

00000000  30 25 02 01 01 04 06 70  75 62 6c 69 63 a5 18 02  |0%.....public...|
00000010  04 db 2d 7f e5 02 01 00  02 02 07 d0 30 09 30 07  |..-.........0.0.|
00000020  06 03 2b 06 01 05 00                              |..+....|

2026-10-11 04:14:56187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·zE*·_ν·޿·>·_Ze1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7a 45 2a a8 5f ce bd eb  de bf b1 3e a2 f8 be af  |zE*._......>....|
00000040  5f 5a 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |_Ze1:q9:get_peer|
00000050  73 31 3a 74 32 3a 8d dd  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 04:06:0545.205.1.231to 161/udpSNMPBR

0%·public·-·0 0·+·

payload bytes

00000000  30 25 02 01 01 04 06 70  75 62 6c 69 63 a5 18 02  |0%.....public...|
00000010  04 db 2d 7f e5 02 01 00  02 02 07 d0 30 09 30 07  |..-.........0.0.|
00000020  06 03 2b 06 01 05 00                              |..+....|

2026-10-11 03:55:54187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·x·\'·I·8·"·e1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  78 bc a2 8f 5c 27 87 e8  ae 49 89 d4 38 9b 22 82  |x...\'...I..8.".|
00000040  94 c4 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a ba d1  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:45:3845.205.1.231to 161/udpSNMPBR

0%·public·-·0 0·+·

payload bytes

00000000  30 25 02 01 01 04 06 70  75 62 6c 69 63 a5 18 02  |0%.....public...|
00000010  04 db 2d 7f e5 02 01 00  02 02 07 d0 30 09 30 07  |..-.........0.0.|
00000020  06 03 2b 06 01 05 00                              |..+....|

2026-10-11 03:40:4345.205.1.231to 161/udpSNMPBR

0%·public·-·0 0·+·

payload bytes

00000000  30 25 02 01 01 04 06 70  75 62 6c 69 63 a5 18 02  |0%.....public...|
00000010  04 db 2d 7f e5 02 01 00  02 02 07 d0 30 09 30 07  |..-.........0.0.|
00000020  06 03 2b 06 01 05 00                              |..+....|

2026-10-11 03:30:21191.176.85.134to 48384/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-11 03:26:36187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·z·t·k·҂·7·1·#·e1:q9:get_peers1:t2:i·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7a a0 74 93 6b a8 d7 d2  82 8c 37 b5 31 1a bf 23  |z.t.k.....7.1..#|
00000040  fb fd 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 69 98  31 3a 76 34 3a 4c 54 01  |s1:t2:i.1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:23:34187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·|·x ·N·ҙ·"·j·e1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  7c 07 88 f8 9d d0 78 09  bd 4e e1 d2 99 02 22 da  ||.....x..N....".|
00000040  6a bf 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |j.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a ba cd  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:15:32187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·x·LKxМ·e1:q9:get_peers1:t2:·1:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  78 13 05 d3 4c 4b 78 d0  9c 06 dc c8 1c 06 9d af  |x...LKx.........|
00000040  03 f6 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 14 b3  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|

2026-10-11 03:13:1945.205.1.231to 1434/udpUnrecognisedBR
·
payload bytes
```
00000000  02                                                |.|
```

2026-10-11 03:12:05181.222.80.253to 29306/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-11 03:07:28187.39.118.69to 39131/udpBitTorrentBR

d1:ad2:id20:·|·!S6·/·s·Y·W·9:info_hash20:·x~·a}·ѥɖ·6·c e1:q9:get_peers1:t2:·81:v4:LT·/1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a fa b8 7c cd  |d1:ad2:id20:..|.|
00000010  21 53 36 fa 86 2f e1 73  c3 59 93 57 bc 02 e3 ce  |!S6../.s.Y.W....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a fa b8  |9:info_hash20:..|
00000030  78 7e f2 61 7d bf 84 8a  d1 a5 c9 96 f2 36 cf 1b  |x~.a}........6..|
00000040  63 0d 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |c.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a ad 38  31 3a 76 34 3a 4c 54 01  |s1:t2:.81:v4:LT.|
00000060  2f 31 3a 79 31 3a 71 65                           |/1:y1:qe|