UDP traffic

Datagrams matching country:ID sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 2

Latest SOCKS5 datagram, to 13523/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

41 datagrams from 11 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 41

Latest Unrecognised datagram, to 11211/udp

D.{mMGr·k_6z ·8,m·RB

payload bytes

00000000  44 2e 7b 6d 4d 47 72 1e  1c 6b 5f 36 7a 0d 0e 38  |D.{mMGr..k_6z..8|
00000010  2c 6d 19 06 52 42 20                              |,m..RB |

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	4	1	10,000 to 51,000
SSDP	1900/udp	2	1	30.8
mDNS	5353/udp	1	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

52193/udp20
11211/udp Memcached4
27015/udp Steam3
1900/udp SSDP2
1434/udp MSSQL Browser1
2695/udp1
4000/udp1
5353/udp mDNS1
7175/udp1
8080/udp1
13523/udp SOCKS51
16637/udp1

Networks

AS4761 INDOSAT Internet Network Provider from 1 source20
AS150968 PT Jaringanku Media Telekomunikasi from 1 source9
AS149665 PT Cybernet Data Multimedia from 1 source3
AS139994 PT XL Axiata Tbk from 3 sources3
AS149915 PT Lintas Daya Nusantara from 1 source2
AS4800 PT Aplikanusa Lintasarta from 1 source1
AS7713 PT Telekomunikasi Indonesia from 1 source1
AS46023 PT Quantum Tera Network from 1 source1
AS9341 PT INDONESIA COMNETS PLUS from 1 source1
AS23700 Linknet-Fastnet ASN from 1 source1

Countries

ID Indonesia43

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
114.12.11.55	AS4761 INDOSAT Internet Network Provider	ID	Unrecognised	20	2026-10-09 21:33
103.123.175.6	AS150968 PT Jaringanku Media Telekomunikasi	ID	Unrecognised	9	2026-10-10 22:57
103.182.79.149	AS149665 PT Cybernet Data Multimedia	ID	Unrecognised	3	2026-10-10 11:24
103.189.254.40	AS149915 PT Lintas Daya Nusantara	ID	Unrecognised	2	2026-10-07 06:00
103.106.78.53	AS46023 PT Quantum Tera Network	ID	Unrecognised	1	2026-10-09 02:21
157.85.208.162	AS139994 PT XL Axiata Tbk	ID	Unrecognised	1	2026-10-08 09:39
110.92.72.90	AS17995 PT iForte Global Internet	ID	Unrecognised	1	2026-10-06 00:31
220.247.168.178	AS9341 PT INDONESIA COMNETS PLUS	ID	Unrecognised	1	2026-10-07 13:37
103.3.220.19	AS139994 PT XL Axiata Tbk	ID	SOCKS5	1	2026-10-06 09:15
118.137.6.176	AS23700 Linknet-Fastnet ASN	ID	Unrecognised	1	2026-10-08 04:02
36.94.146.11	AS7713 PT Telekomunikasi Indonesia	ID	Unrecognised	1	2026-10-09 05:22
123.231.189.211	AS4800 PT Aplikanusa Lintasarta	ID	Unrecognised	1	2026-10-10 06:01
157.85.207.244	AS139994 PT XL Axiata Tbk	ID	SOCKS5	1	2026-10-07 19:04

Latest datagrams

2026-10-10 22:57:47103.123.175.6to 11211/udpUnrecognisedID

D.{mMGr·k_6z ·8,m·RB

payload bytes

00000000  44 2e 7b 6d 4d 47 72 1e  1c 6b 5f 36 7a 0d 0e 38  |D.{mMGr..k_6z..8|
00000010  2c 6d 19 06 52 42 20                              |,m..RB |

2026-10-10 11:24:10103.182.79.149to 62615/udpUnrecognisedID

|·,· ·Y·bYr·Ψ+.·؛-·-"·T-z·~·d·|z·tPA·f·+-·"·i·ͤ·2·&·L͟?·)·羑·π%·

payload bytes

00000000  7c d2 de 2c a3 20 15 e3  59 10 b7 c1 ac 62 59 72  ||..,. ..Y....bYr|
00000010  a9 13 ce a8 2b 2e 94 e2  f8 df d8 9b 2d 82 2d 22  |....+.......-.-"|
00000020  9a 8e a6 fa 93 02 00 b9  54 2d 7a e4 1c e7 08 aa  |........T-z.....|
00000030  99 7e 14 64 12 fc b9 dd  7c 7a 9c e8 74 50 41 05  |.~.d....|z..tPA.|
00000040  f3 06 66 c2 c1 2b 2d d0  22 e4 69 db cb cd a4 d4  |..f..+-.".i.....|
00000050  32 18 07 26 10 4c cd 9f  3f e3 11 0b 03 bd 29 f9  |2..&.L..?.....).|
00000060  9c ec f1 e7 be 91 a9 12  cf 80 25 96 ad f6 50 22  |..........%...P"|
00000070  77 6b ad 4a fd 27 d7 14  50 fe 4e ae aa 90 0e 0b  |wk.J.'..P.N.....|
00000080  6f b4 d9 2a 06 96 9c 87  db 44 f9 5e 6e 04 0d 21  |o..*.....D.^n..!|
00000090  ec b6 90 c6 9e 24 df a5  62 73 94 31 4a 2f f3 78  |.....$..bs.1J/.x|
000000a0  6e d1 97 3b 56 f9 30 67  b1 99 ad f5 31 71 c5 14  |n..;V.0g....1q..|
000000b0  66 ce 5c 91 52 6f 46 71  da 10 bf e8 05 b8 cc d7  |f.\.RoFq........|
000000c0  64 73 94 a0 db a4 ea e2  9c 41 c3 f2 51 c3 7d 40  |ds.......A..Q.}@|
000000d0  69 97 71 43 a0 2f 0a f4  1c 5f 2d 1c 83 70 e4 b2  |i.qC./..._-..p..|
000000e0  69 73 e1 7d 5a 24 33 d8  ff 55 90 ae c6 48 61 3f  |is.}Z$3..U...Ha?|
000000f0  78 0e 6d 49 fb e2 3d 08  ae 71 2e 24 95 2a 3c 11  |x.mI..=..q.$.*<.|
... 512 bytes shown in part

2026-10-10 06:01:45123.231.189.211to 7175/udpUnrecognisedID

·ׁҵ·{·ǪN·K·gx@·7w·g·<·xZ ·~·s·>·EU·%·E·mCg·JzVB^·of· ·*·;·JRX·Ǖ·ʿ·

payload bytes

00000000  84 d7 81 d2 b5 bd e5 f9  ad 7b 0b c7 aa 4e 08 4b  |.........{...N.K|
00000010  92 af d5 c1 c8 67 78 40  bd 37 77 b8 67 e1 3c 05  |.....gx@.7w.g.<.|
00000020  8b 0c ec e5 78 5a 20 bc  7e d6 12 b8 10 b9 08 73  |....xZ .~......s|
00000030  fc 3e a5 45 55 c8 25 be  9b 45 be 6d 43 67 c7 e6  |.>.EU.%..E.mCg..|
00000040  4a 7a 56 42 5e 8b 6f 66  e8 8b 04 0c 95 ae b6 0c  |JzVB^.of........|
00000050  0d fe 2a bd 08 0b 84 3b  b8 10 4a 52 58 ee 95 8a  |..*....;..JRX...|
00000060  a4 b9 f7 e8 f0 c7 95 18  ca bf 13 88 e6 d1 8d 90  |................|
00000070  8d bc 20 15 41 1f 0b ef  73 0e 73 17 19 d9 cd eb  |.. .A...s.s.....|
00000080  75 09 fa 4d cc f0 c7 70  cc 66 83 32 1b 07 b9 c0  |u..M...p.f.2....|
00000090  21 e6 f3 7f 6b 67 7b 74  93 e0 1a 39 b5 0f 78 3c  |!...kg{t...9..x<|
000000a0  a3 64 18 e9 f3 88 6b 2a  60 2a 96 b0 ae 2a cc 11  |.d....k*`*...*..|
000000b0  2d 0a 2a 6d 9d 6b c5 dd  a9 c0 5f d6 51 72 44 bb  |-.*m.k...._.QrD.|
000000c0  2d 57 55 ba ee d1 38 e0  45 44 f4 03 86 d0 37 8c  |-WU...8.ED....7.|
000000d0  11 bd 58 69 76 cc 74 86  14 4a 72 b0 13 21 4b e2  |..Xiv.t..Jr..!K.|
000000e0  e8 a4 27 ff fd d9 16 29  ba 41 24 d0 a3 26 16 21  |..'....).A$..&.!|
000000f0  6a 74 46 65 5f 29 7d 5c  ec fd b5 cd 7f f9 21 6d  |jtFe_)}\......!m|
... 512 bytes shown in part

2026-10-09 22:20:33103.123.175.6to 4000/udpUnrecognisedID

j.8/·;[x·|Z]·+CX=]·y0;·(6t$ >\O>·+6''·-/0p·mN f~H· S"2 ·V·

payload bytes

00000000  6a 2e 38 2f 00 3b 5b 78  10 7c 5a 5d 05 1e 2b 43  |j.8/.;[x.|Z]..+C|
00000010  58 3d 5d 06 79 30 3b 1c  0c 0b 1f 28 36 74 24 20  |X=].y0;....(6t$ |
00000020  3e 5c 4f 3e 17 2b 36 27  27 10 04 2d 2f 30 70 07  |>\O>.+6''..-/0p.|
00000030  6d 4e 0d 66 7e 48 03 0a  53 22 32 09 16 56 a3 a2  |mN.f~H..S"2..V..|

2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```
2026-10-09 21:33:39114.12.11.55to 52193/udpUnrecognisedID
·
payload bytes
```
00000000  95                                                |.|
```