UDP traffic

Datagrams matching country:KH sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

1 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NTP 1

Latest NTP datagram, to 123/udp

·*·

payload bytes

00000000  17 00 03 2a 00 00 00 00  00 00 00 00 00 00 00 00  |...*............|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 59565/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

20 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 20

Latest Unrecognised datagram, to 11223/udp

payload bytes

00000000  da                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	1	1	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

11223/udp20
123/udp NTP1
59565/udp SOCKS51

Networks

AS38600 SMART AXIATA Co., Ltd. from 1 source20
AS38623 ISP/IXP IN CAMBODIA WITH THE BEST VERVIC from 1 source1
AS131178 EZECOM CO., LTD. from 1 source1

Countries

KH Cambodia22

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
202.56.1.206	AS38600 SMART AXIATA Co., Ltd.	KH	Unrecognised	20	2026-10-09 21:33
220.158.232.194	AS38623 ISP/IXP IN CAMBODIA WITH THE BEST VERVIC	KH	NTP	1	2026-10-09 16:39
58.97.228.0	AS131178 EZECOM CO., LTD.	KH	SOCKS5	1	2026-10-07 21:59

Latest datagrams

2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```
2026-10-09 21:33:39202.56.1.206to 11223/udpUnrecognisedKH
·
payload bytes
```
00000000  da                                                |.|
```