HoneyLabs

UDP traffic

Datagrams matching country:KR sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

40

Datagrams

20

Source addresses

4

Networks

1

Countries

14

Destination ports

Traffic by type

Service queries

11 datagrams from 11 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Latest NTP datagram, to 123/udp

·

payload bytes
00000000  1c 00 00 00                                       |....|

Unrecognised

29 datagrams from 9 sources

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 27015/udp

·TSource Engine Query·

payload bytes
00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
NTP123/udp1111556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
1.215.138.43AS3786 LG DACOM CorporationKRUnrecognised112026-10-10 06:20
110.35.12.5AS38684 CMB Daejeon Broadcasting Co,.LtdKRUnrecognised72026-10-11 01:41
110.35.12.15AS38684 CMB Daejeon Broadcasting Co,.LtdKRUnrecognised32026-10-10 22:04
14.39.180.249AS4766 Korea TelecomKRUnrecognised32026-10-11 04:26
59.25.45.164AS4766 Korea TelecomKRNTP12026-10-10 15:24
14.56.250.242AS4766 Korea TelecomKRNTP12026-10-10 20:39
218.157.41.201AS4766 Korea TelecomKRUnrecognised12026-10-10 19:23
14.44.66.3AS4766 Korea TelecomKRNTP12026-10-10 11:04
14.45.214.121AS4766 Korea TelecomKRNTP12026-10-10 12:42
14.49.145.150AS4766 Korea TelecomKRNTP12026-10-10 14:37
14.49.174.230AS4766 Korea TelecomKRNTP12026-10-10 14:36
211.246.177.37AS9694 Seokyung Cable Television Co.. Ltd.KRUnrecognised12026-10-10 22:26
14.48.253.6AS4766 Korea TelecomKRNTP12026-10-10 14:49
110.35.12.16AS38684 CMB Daejeon Broadcasting Co,.LtdKRUnrecognised12026-10-11 04:43
14.51.20.89AS4766 Korea TelecomKRNTP12026-10-10 16:15
14.42.178.201AS4766 Korea TelecomKRNTP12026-10-10 09:28
14.45.162.29AS4766 Korea TelecomKRNTP12026-10-10 11:41
221.164.137.248AS4766 Korea TelecomKRUnrecognised12026-10-10 11:28
211.217.108.4AS4766 Korea TelecomKRUnrecognised12026-10-10 14:43
14.50.165.253AS4766 Korea TelecomKRNTP12026-10-10 15:20

Latest datagrams