UDP traffic

Datagrams matching country:EC sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.7K

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

6 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 6

Latest SNMP datagram, to 161/udp

0)·public·(?·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 28 3f 05 19 02 01 00  02 01 00 30 0e 30 0c 06  |.(?........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

Other services

10 datagrams from 9 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 9 Redis 1

Latest SOCKS5 datagram, to 26103/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 09 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

9 datagrams from 9 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 31975/udp

·Tp·}1V·4Vx·"·Q·

payload bytes

00000000  01 c7 d6 54 70 f4 7d 31  56 00 ff ff 00 fe fe fe  |...Tp.}1V.......|
00000010  fe fd fd fd fd 12 34 56  78 9b 97 22 b6 cb c1 51  |......4Vx.."...Q|
00000020  e4                                                |.|

Peer-to-peer

2,677 datagrams from 61 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 2,677

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	6	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS27947 Telconet S.A from 37 sources1,217
AS263238 Eliana Vanessa Morocho Ona from 4 sources384
AS52468 UFINET PANAMA S.A. from 5 sources341
AS267684 VISIONMAGICA SOCIEDAD ANONIMA from 1 source274
AS28006 CORPORACION NACIONAL DE TELECOMUNICACION from 5 sources161
AS271911 Gavilanes Parreno Irene Del Rocio from 1 source95
AS7315 Otecel S.A. from 4 sources68
AS27738 Ecuadortelecom S.A. from 3 sources67
AS266904 ALCIVAR ESPIN DANNY ALEXANDER (OptiCom) from 2 sources17
AS271936 SERVICIOS DE TELECOMUNICACIONES ATVCABLE from 1 source15

Countries

EC Ecuador2,702

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
177.234.212.45	AS52468 UFINET PANAMA S.A.	EC	BitTorrent	333	2026-10-10 20:51
45.163.207.26	AS267684 VISIONMAGICA SOCIEDAD ANONIMA	EC	BitTorrent	274	2026-10-10 21:11
157.100.127.169	AS27947 Telconet S.A	EC	BitTorrent	256	2026-10-05 22:09
200.76.114.154	AS263238 Eliana Vanessa Morocho Ona	EC	BitTorrent	225	2026-10-09 05:02
157.100.190.46	AS27947 Telconet S.A	EC	BitTorrent	138	2026-10-10 08:56
157.100.41.54	AS27947 Telconet S.A	EC	BitTorrent	115	2026-10-10 22:46
186.178.67.171	AS28006 CORPORACION NACIONAL DE TELECOMUNICACION	EC	BitTorrent	96	2026-10-11 00:45
45.70.58.145	AS271911 Gavilanes Parreno Irene Del Rocio	EC	BitTorrent	95	2026-10-10 22:27
157.100.190.245	AS27947 Telconet S.A	EC	BitTorrent	91	2026-10-07 05:59
157.100.188.238	AS27947 Telconet S.A	EC	BitTorrent	84	2026-10-09 05:16
157.100.188.12	AS27947 Telconet S.A	EC	BitTorrent	82	2026-10-09 19:50
157.100.190.207	AS27947 Telconet S.A	EC	BitTorrent	80	2026-10-06 10:49
157.100.189.89	AS27947 Telconet S.A	EC	BitTorrent	65	2026-10-07 05:09
200.50.235.227	AS263238 Eliana Vanessa Morocho Ona	EC	BitTorrent	58	2026-10-08 04:00
200.50.235.131	AS263238 Eliana Vanessa Morocho Ona	EC	BitTorrent	55	2026-10-07 07:21
181.199.63.106	AS27947 Telconet S.A	EC	BitTorrent	47	2026-10-10 19:57
193.30.14.186	AS263238 Eliana Vanessa Morocho Ona	EC	BitTorrent	46	2026-10-09 05:39
191.99.43.144	AS27738 Ecuadortelecom S.A.	EC	BitTorrent	44	2026-10-07 02:22
157.100.190.12	AS27947 Telconet S.A	EC	BitTorrent	40	2026-10-08 21:00
181.112.9.41	AS28006 CORPORACION NACIONAL DE TELECOMUNICACION	EC	BitTorrent	37	2026-10-09 02:04

Latest datagrams

2026-10-11 03:51:0445.187.0.67to 39131/udpBitTorrentEC

A·^· · ·

payload bytes

00000000  41 00 92 5e 04 a3 09 aa  00 00 00 00 00 00 00 00  |A..^............|
00000010  20 db 00 00                                       | ...|

2026-10-11 03:15:20191.99.19.49to 39131/udpBitTorrentEC

d1:ad2:id20:·g·^·AX·j·C(·R9:info_hash20:·g·aV·]·YQ·Շ,·S+e1:q9:get_peers1:t2:u·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a a2 67 c8 f7  |d1:ad2:id20:.g..|
00000010  5e dd 41 58 a0 b3 f1 6a  b5 14 8f 43 28 a0 e1 52  |^.AX...j...C(..R|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a a2 67  |9:info_hash20:.g|
00000030  cf 14 61 56 10 80 bf 5d  a6 59 51 c9 d5 87 2c dd  |..aV...].YQ...,.|
00000040  53 2b 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |S+e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 75 95  31 3a 76 34 3a 4c 54 01  |s1:t2:u.1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 03:07:26191.99.19.49to 39131/udpBitTorrentEC

d1:ad2:id20:·g·^·AX·j·C(·R9:info_hash20:·g·m·*·%y ·e1:q9:get_peers1:t2:he1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a a2 67 c8 f7  |d1:ad2:id20:.g..|
00000010  5e dd 41 58 a0 b3 f1 6a  b5 14 8f 43 28 a0 e1 52  |^.AX...j...C(..R|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a a2 67  |9:info_hash20:.g|
00000030  cd 16 f8 83 6d 85 2a d5  13 e2 12 9a 25 79 20 f4  |....m.*.....%y .|
00000040  f5 e3 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 68 65  31 3a 76 34 3a 4c 54 01  |s1:t2:he1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 02:59:36181.199.42.24to 39131/udpBitTorrentEC

A·(·U·

payload bytes

00000000  41 00 96 8a 9a 28 97 b6  00 00 00 00 00 10 00 00  |A....(..........|
00000010  55 e1 00 00                                       |U...|

2026-10-11 02:59:30181.199.42.24to 39131/udpBitTorrentEC

A·ʌ·U·

payload bytes

00000000  41 00 96 8a 99 ca 8c f3  00 00 00 00 00 10 00 00  |A...............|
00000010  55 e1 00 00                                       |U...|

2026-10-11 02:59:27181.199.42.24to 39131/udpBitTorrentEC

A·C·U·

payload bytes

00000000  41 00 96 8a 99 9a 88 43  00 00 00 00 00 10 00 00  |A......C........|
00000010  55 e1 00 00                                       |U...|

2026-10-11 02:54:43181.199.42.24to 39131/udpBitTorrentEC

A·R·.·¼·

payload bytes

00000000  41 00 94 52 88 a5 2e a7  00 00 00 00 00 10 00 00  |A..R............|
00000010  c2 bc 00 00                                       |....|

2026-10-11 02:54:36181.199.42.24to 39131/udpBitTorrentEC

A·R·F· ·¼·

payload bytes

00000000  41 00 94 52 88 46 cf 09  00 00 00 00 00 10 00 00  |A..R.F..........|
00000010  c2 bc 00 00                                       |....|

2026-10-11 02:54:33181.199.42.24to 39131/udpBitTorrentEC

A·R·y·¼·

payload bytes

00000000  41 00 94 52 88 14 79 ce  00 00 00 00 00 10 00 00  |A..R..y.........|
00000010  c2 bc 00 00                                       |....|

2026-10-11 02:51:22181.199.42.24to 39131/udpBitTorrentEC

A·ȡ|· [·2·

payload bytes

00000000  41 00 c8 a1 7c b8 0d 5b  00 00 00 00 00 10 00 00  |A...|..[........|
00000010  af 32 00 00                                       |.2..|

2026-10-11 02:51:16181.199.42.24to 39131/udpBitTorrentEC

A·ȡ|[·2·

payload bytes

00000000  41 00 c8 a1 7c 5b 84 df  00 00 00 00 00 10 00 00  |A...|[..........|
00000010  af 32 00 00                                       |.2..|

2026-10-11 02:51:16191.99.19.49to 39131/udpBitTorrentEC

d1:ad2:id20:·g·^·AX·j·C(·R9:info_hash20:·g·.k(·>2P·V·$·e1:q9:get_peers1:t2:·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a a2 67 c8 f7  |d1:ad2:id20:.g..|
00000010  5e dd 41 58 a0 b3 f1 6a  b5 14 8f 43 28 a0 e1 52  |^.AX...j...C(..R|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a a2 67  |9:info_hash20:.g|
00000030  ce dd 2e 6b 28 1a 81 3e  32 50 d0 56 87 24 ba 96  |...k(..>2P.V.$..|
00000040  81 f5 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 0c 10  31 3a 76 34 3a 4c 54 01  |s1:t2:..1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 02:51:13181.199.42.24to 39131/udpBitTorrentEC

A·ȡ|)·2·

payload bytes

00000000  41 00 c8 a1 7c 29 13 a5  00 00 00 00 00 10 00 00  |A...|)..........|
00000010  af 32 00 00                                       |.2..|

2026-10-11 02:20:39148.227.173.86to 39131/udpBitTorrentEC

A·m·E·t·

payload bytes

00000000  41 00 85 6d 83 f4 45 ee  00 00 00 00 00 10 00 00  |A..m..E.........|
00000010  9e 74 00 00                                       |.t..|

2026-10-11 02:20:33148.227.173.86to 39131/udpBitTorrentEC

A·m·ʤ·t·

payload bytes

00000000  41 00 85 6d 83 97 ca a4  00 00 00 00 00 10 00 00  |A..m............|
00000010  9e 74 00 00                                       |.t..|