UDP traffic

Datagrams matching country:IN sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

6 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 5 DNS 1

Latest NetBIOS datagram, to 137/udp

NetBIOS node status query *

payload bytes

00000000  80 62 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.b.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Other services

2 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 2

Latest SOCKS5 datagram, to 10221/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

23 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 23

Latest Unrecognised datagram, to 443/udp

8·4'·nV·

payload bytes

00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	5	3	3.8
DNS	53/udp	1	1	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

8080/udp6
137/udp NetBIOS5
443/udp QUIC3
53/udp DNS2
1195/udp2
8082/udp2
9201/udp2
80/udp1
1194/udp OpenVPN1
4500/udp IPsec NAT-T1
6881/udp BitTorrent1
10221/udp SOCKS51

Networks

AS14061 DigitalOcean, LLC from 3 sources12
AS9829 National Internet Backbone from 1 source7
AS45916 Gujarat Telelink Pvt Ltd from 2 sources5
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 1 source3
AS18209 Atria Convergence Technologies Ltd., from 1 source1
AS133661 Netplus Broadband Services Private Limit from 1 source1
AS17488 Hathway IP Over Cable Internet from 1 source1
AS45769 D-Vois Broadband Pvt Ltd from 1 source1
AS135139 Skylink Fibernet Private Limited from 1 source1

Countries

IN India32

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
117.242.191.241	AS9829 National Internet Backbone	IN	Unrecognised	7	2026-10-10 09:54
165.232.177.49	AS14061 DigitalOcean, LLC	IN	Unrecognised	6	2026-10-11 04:25
64.227.143.97	AS14061 DigitalOcean, LLC	IN	Unrecognised	5	2026-10-07 15:33
163.53.179.50	AS45916 Gujarat Telelink Pvt Ltd	IN	Unrecognised	4	2026-10-10 12:18
152.32.156.136	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	IN	NetBIOS	3	2026-10-08 08:06
124.123.161.84	AS18209 Atria Convergence Technologies Ltd.,	IN	Unrecognised	1	2026-10-05 18:39
182.48.201.142	AS45769 D-Vois Broadband Pvt Ltd	IN	NetBIOS	1	2026-10-06 08:39
167.71.228.11	AS14061 DigitalOcean, LLC	IN	Unrecognised	1	2026-10-11 01:23
103.238.108.241	AS45916 Gujarat Telelink Pvt Ltd	IN	SOCKS5	1	2026-10-05 15:52
38.137.32.238	AS133661 Netplus Broadband Services Private Limit	IN	Unrecognised	1	2026-10-05 14:04
103.99.149.67	AS135139 Skylink Fibernet Private Limited	IN	NetBIOS	1	2026-10-10 02:35
116.73.207.7	AS17488 Hathway IP Over Cable Internet	IN	Unrecognised	1	2026-10-05 11:05

Latest datagrams

2026-10-11 04:25:13165.232.177.49to 443/udpUnrecognisedIN
8·4'·nV·
payload bytes
```
00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|
```
2026-10-11 04:24:57165.232.177.49to 8080/udpUnrecognisedIN
8·0·
payload bytes
```
00000000  38 fa 30 06 b6 8a a4 13  e6 00 00 00 00 00        |8.0...........|
```
2026-10-11 04:24:41165.232.177.49to 9201/udpUnrecognisedIN
8·>·U·]·{·
payload bytes
```
00000000  38 d2 3e c9 55 a7 5d a6  7b 00 00 00 00 00        |8.>.U.].{.....|
```
2026-10-11 04:24:32165.232.177.49to 1195/udpUnrecognisedIN
8·#·P·\·
payload bytes
```
00000000  38 ba 23 c3 50 db fc a4  5c 00 00 00 00 00        |8.#.P...\.....|
```
2026-10-11 04:24:16165.232.177.49to 53/udpUnrecognisedIN
8·9·}·
payload bytes
```
00000000  38 a8 39 e2 fe 7d 87 e3  88 00 00 00 00 00        |8.9..}........|
```
2026-10-11 04:24:00165.232.177.49to 1194/udpUnrecognisedIN
8·7·^)·
payload bytes
```
00000000  38 f6 37 db fe ee 5e 29  f8 00 00 00 00 00        |8.7...^)......|
```

2026-10-11 01:23:17167.71.228.11to 4500/udpUnrecognisedIN

·FM·~a ·! "·"· ·

payload bytes

00000000  00 00 00 00 b5 99 46 4d  88 7e 61 0a 00 00 00 00  |......FM.~a.....|
00000010  00 00 00 00 21 20 22 08  00 00 00 00 00 00 01 88  |....! ".........|
00000020  22 00 00 c8 00 00 00 c4  01 01 00 16 03 00 00 0c  |"...............|
00000030  01 00 00 0c 80 0e 00 80  03 00 00 0c 01 00 00 0c  |................|
00000040  80 0e 00 c0 03 00 00 0c  01 00 00 0c 80 0e 01 00  |................|
00000050  03 00 00 08 01 00 00 03  03 00 00 08 03 00 00 0c  |................|
00000060  03 00 00 08 03 00 00 0d  03 00 00 08 03 00 00 0e  |................|
00000070  03 00 00 08 03 00 00 05  03 00 00 08 03 00 00 08  |................|
00000080  03 00 00 08 03 00 00 02  03 00 00 08 02 00 00 04  |................|
00000090  03 00 00 08 02 00 00 08  03 00 00 08 02 00 00 05  |................|
000000a0  03 00 00 08 02 00 00 06  03 00 00 08 02 00 00 07  |................|
000000b0  03 00 00 08 02 00 00 02  03 00 00 08 04 00 00 1f  |................|
000000c0  03 00 00 08 04 00 00 0f  03 00 00 08 04 00 00 10  |................|
000000d0  03 00 00 08 04 00 00 11  03 00 00 08 04 00 00 12  |................|
000000e0  00 00 00 08 04 00 00 0e  28 00 00 28 00 1f 00 00  |........(..(....|
000000f0  b2 1e ff ac 56 fd 06 54  bc e1 11 f5 e6 ab 7e 30  |....V..T......~0|
... 396 bytes shown in part

2026-10-10 12:18:14163.53.179.50to 56700/udpUnrecognisedIN

·HD·&·#·O[H·,·cl·Ƀ·&·k6z:·z·x·b·Ѣ·I7·k·K·a·>xL·ͭ·'A·G·+·Bu·Yv·

payload bytes

00000000  8f c3 06 a0 f8 d2 48 44  a3 26 f1 ce 23 f9 c4 1a  |......HD.&..#...|
00000010  4f 5b 48 8c 2c 87 95 8e  63 6c 16 c9 83 99 26 f4  |O[H.,...cl....&.|
00000020  6b 36 7a 3a ef 7a f4 18  e6 78 fb 62 bb 1f d1 a2  |k6z:.z...x.b....|
00000030  e4 ac f3 49 37 84 6b f2  d4 ee ee 4b d5 0c e8 61  |...I7.k....K...a|
00000040  80 18 a8 b5 3e 78 4c 1b  cd ad e8 27 41 83 47 06  |....>xL....'A.G.|
00000050  11 f7 de f3 dc ec 2b 8b  b1 be cf e9 42 75 a8 d3  |......+.....Bu..|
00000060  59 76 ca d7 70 2d 53 03  9d 21 fd 97 45 54 6f 07  |Yv..p-S..!..ETo.|
00000070  4f 92 93 83 e0 17 31 19  92 2c be 67 5c 91 0e 1a  |O.....1..,.g\...|
00000080  b8 79 10 05 ed e0 0f 94  42 94 43 02 27 61 a9 6c  |.y......B.C.'a.l|
00000090  b3 08 f2 ea 88 95 11 01  6c f0 ee 1f ef 0a 69 38  |........l.....i8|
000000a0  c1 2a a4 42 c8 4a 94 cf  c6 ae 91 a7 a9 f6 df d7  |.*.B.J..........|
000000b0  b1 3c 4e b4 fa e2 e1 d9  9e 80 2c f3 ec 4a 6e db  |.<N.......,..Jn.|
000000c0  84 4e 00 1e 8c 89 20 c8  66 c8 9f 5f 53 d0 0f f6  |.N.... .f.._S...|
000000d0  78 d4 67 ea 51 4c c7 26  17 6c ba 87 fb b9 bf 0f  |x.g.QL.&.l......|
000000e0  60 68 af db 80 12 16 c7  a1 04 98 93 48 07 1a 61  |`h..........H..a|
000000f0  63 8f 56 c1 db 07 a3 b6  a2 a0 4d e5 04 db dc 54  |c.V.......M....T|
... 512 bytes shown in part

2026-10-10 09:54:40117.242.191.241to 8080/udpUnrecognisedIN

.·_}cBr· ·Lm C·l·4·~+·8%·ED#YJ·V-EHBeX·RxRh}qU·%q·P·Hu·T;\w·&zjS@2·

payload bytes

00000000  20 2e 17 13 05 5f 7d 63  42 72 14 20 0f 4c 6d 20  | ...._}cBr. .Lm |
00000010  43 16 04 1f 6c 15 34 1c  7e 2b 17 38 25 0f 0c 45  |C...l.4.~+.8%..E|
00000020  44 23 59 4a 03 56 2d 45  48 42 65 58 0e 52 78 52  |D#YJ.V-EHBeX.RxR|
00000030  68 7d 71 55 12 25 71 10  50 08 48 75 17 54 3b 5c  |h}qU.%q.P.Hu.T;\|
00000040  77 14 26 7a 6a 53 40 32  e3 b3                    |w.&zjS@2..|

2026-10-10 02:35:51103.99.149.67to 137/udpNetBIOSIN

NetBIOS node status query *

payload bytes

00000000  80 62 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.b.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-09 21:28:35117.242.191.241to 8080/udpUnrecognisedIN

^.m·h·O=·8-· uC3R%·y·g6·2L·6j{'W·^gLi·6 Yj\~oU V·( XE?B@g·Xvw?C`?HvUe·

payload bytes

00000000  5e 2e 6d 1d 68 07 4f 3d  0b 18 38 2d 15 11 20 75  |^.m.h.O=..8-.. u|
00000010  43 33 52 25 05 79 0b 67  36 1e 32 4c 1d 36 6a 7b  |C3R%.y.g6.2L.6j{|
00000020  27 57 18 0f 5e 67 4c 69  00 05 16 15 16 36 0a 59  |'W..^gLi.....6.Y|
00000030  6a 5c 7e 6f 55 0a 56 0c  28 09 58 45 3f 42 40 67  |j\~oU.V.(.XE?B@g|
00000040  19 58 76 77 3f 43 60 3f  48 76 55 65 01           |.Xvw?C`?HvUe.|

2026-10-09 16:35:12117.242.191.241to 8080/udpUnrecognisedIN

_.Fk{g'@W·{·p*,)='·/f·P9·{NP·)/Bp·=WB}.J·)PvT|·$'·

payload bytes

00000000  5f 2e 46 6b 7b 67 27 40  57 08 08 7b 06 70 2a 2c  |_.Fk{g'@W..{.p*,|
00000010  29 3d 27 07 2f 66 00 50  39 1b 7b 4e 50 0f 29 2f  |)='./f.P9.{NP.)/|
00000020  42 70 1a 3d 57 42 7d 2e  4a 05 29 50 76 54 7c 1f  |Bp.=WB}.J.)PvT|.|
00000030  11 24 27 db e1                                    |.$'..|

2026-10-08 15:38:14117.242.191.241to 8080/udpUnrecognisedIN

F.·T5·w·76Y·V·0A3,r -PI·-·, '&fR·

payload bytes

00000000  46 2e 1f 54 35 01 06 77  17 37 36 59 07 56 13 30  |F..T5..w.76Y.V.0|
00000010  41 33 2c 72 09 2d 50 49  1a 2d 14 2c 20 27 26 66  |A3,r.-PI.-., '&f|
00000020  52 fd f8                                          |R..|

2026-10-08 10:22:22117.242.191.241to 6881/udpBitTorrentIN
·.eR~>}·HX·}
payload bytes
```
00000000  1b 2e 65 52 7e 3e 7d 13  48 58 03 7d              |..eR~>}.HX.}|
```

2026-10-08 08:06:01152.32.156.136to 137/udpNetBIOSIN

NetBIOS node status query *

payload bytes

00000000  2c 49 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |,I.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|