UDP traffic

Datagrams matching country:MX sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

5.7K

Datagrams

255

Source addresses

Networks

Countries

211

Destination ports

Traffic by type

Service queries

3 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 1 NTP 1 DNS 1

Latest NetBIOS datagram, to 137/udp

NetBIOS node status query *

payload bytes

00000000  80 62 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.b.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Other services

90 datagrams from 77 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 89 Redis 1

Latest SOCKS5 datagram, to 26574/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

130 datagrams from 99 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 130

Latest Unrecognised datagram, to 63454/udp

·hɷ·N·4Vx·g9·2·

payload bytes

00000000  01 f5 68 c9 b7 c3 f7 d3  4e 00 ff ff 00 fe fe fe  |..h.....N.......|
00000010  fe fd fd fd fd 12 34 56  78 b0 ff 67 39 08 32 ab  |......4Vx..g9.2.|
00000020  df                                                |.|

Peer-to-peer

5,451 datagrams from 89 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 5,451

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NTP	123/udp	2	1	556.9
DNS	53/udp	1	1	28 to 54
NetBIOS	137/udp	1	1	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent5,449
41103/udp7
15234/udp SOCKS53
4000/udp2
58934/udp SOCKS52
21489/udp2
123/udp NTP2
10553/udp SOCKS52
8083/udp2
6881/udp BitTorrent2
53/udp DNS1
52250/udp SOCKS51

DNS questions

gsu.edu ANY1

DNS record types

ANY1

Networks

AS8151 UNINET from 92 sources2,650
AS13999 Mega Cable, S.A. de C.V. from 41 sources1,148
AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. from 44 sources843
AS28509 Cablemas Telecomunicaciones SA de CV from 3 sources179
AS270207 MULTICARRIER JE S. DE R.L. DE C.V. from 2 sources170
AS272378 ESTEVEZ.JOR SERVICIOS S.A. de C.V. from 1 source137
AS7438 PEGASO PCS from 2 sources95
AS265561 LANTOINTERNET SA DE CV from 3 sources77
AS28548 Cablevision, S.A. de C.V. from 9 sources77
AS270158 Wantelco SAS de CV from 4 sources60

Countries

MX Mexico5,674

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
189.232.114.55	AS8151 UNINET	MX	BitTorrent	750	2026-10-10 23:03
187.150.213.206	AS8151 UNINET	MX	BitTorrent	668	2026-10-10 22:43
177.245.175.54	AS13999 Mega Cable, S.A. de C.V.	MX	BitTorrent	322	2026-10-10 19:33
187.188.220.141	AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I.	MX	BitTorrent	277	2026-10-10 14:47
189.190.173.169	AS8151 UNINET	MX	BitTorrent	269	2026-10-10 18:04
189.214.156.224	AS28509 Cablemas Telecomunicaciones SA de CV	MX	BitTorrent	177	2026-10-07 05:03
187.247.155.250	AS13999 Mega Cable, S.A. de C.V.	MX	BitTorrent	162	2026-10-10 03:57
177.226.65.249	AS13999 Mega Cable, S.A. de C.V.	MX	BitTorrent	149	2026-10-10 23:04
189.174.70.29	AS8151 UNINET	MX	BitTorrent	138	2026-10-07 07:29
31.207.91.123	AS272378 ESTEVEZ.JOR SERVICIOS S.A. de C.V.	MX	BitTorrent	137	2026-10-11 01:52
205.164.193.239	AS270207 MULTICARRIER JE S. DE R.L. DE C.V.	MX	BitTorrent	129	2026-10-10 21:29
177.245.237.51	AS13999 Mega Cable, S.A. de C.V.	MX	BitTorrent	119	2026-10-10 21:13
187.189.123.10	AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I.	MX	BitTorrent	111	2026-10-08 23:04
187.190.185.130	AS17072 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I.	MX	BitTorrent	104	2026-10-11 04:21
177.227.72.189	AS13999 Mega Cable, S.A. de C.V.	MX	BitTorrent	95	2026-10-07 21:19
201.166.169.121	AS7438 PEGASO PCS	MX	BitTorrent	93	2026-10-07 05:57
187.150.79.32	AS8151 UNINET	MX	BitTorrent	88	2026-10-11 02:15
201.102.182.75	AS8151 UNINET	MX	BitTorrent	79	2026-10-06 02:46
189.223.139.134	AS8151 UNINET	MX	BitTorrent	66	2026-10-11 00:53
189.188.216.159	AS8151 UNINET	MX	BitTorrent	66	2026-10-09 02:56

Latest datagrams

2026-10-11 04:22:41201.97.176.15to 39131/udpBitTorrentMX

A·T·|·x·

payload bytes

00000000  41 00 54 cd 7c ea aa d6  00 00 00 00 00 10 00 00  |A.T.|...........|
00000010  78 ff 00 00                                       |x...|

2026-10-11 04:22:35201.97.176.15to 39131/udpBitTorrentMX

A·T·|·g·x·

payload bytes

00000000  41 00 54 cd 7c 8e 67 d2  00 00 00 00 00 10 00 00  |A.T.|.g.........|
00000010  78 ff 00 00                                       |x...|

2026-10-11 04:22:31201.97.176.15to 39131/udpBitTorrentMX

A·T·|[·x·

payload bytes

00000000  41 00 54 cd 7c 5b 18 d9  00 00 00 00 00 10 00 00  |A.T.|[..........|
00000010  78 ff 00 00                                       |x...|

2026-10-11 04:22:24189.51.168.102to 39131/udpBitTorrentMX

d1:ad2:id20: ·d·y·)l·9·~·<·9:info_hash20: ·a*·G?ؖY·=·+· C=e1:q9:get_peers1:t2:rp1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 0d d1 64 f8  |d1:ad2:id20:..d.|
00000010  ad 79 aa 29 6c f3 39 c3  7e 93 3c a9 cb ef 01 19  |.y.)l.9.~.<.....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 0d d1  |9:info_hash20:..|
00000030  61 2a c6 47 3f d8 96 59  c6 d9 3d 8c f1 2b 1a 0d  |a*.G?..Y..=..+..|
00000040  43 3d 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |C=e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 72 70  31 3a 76 34 3a 4c 54 01  |s1:t2:rp1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 04:21:25187.190.185.130to 39131/udpBitTorrentMX

A· ·J·S·

payload bytes

00000000  41 00 88 0d 17 4a ce e1  00 00 00 00 00 10 00 00  |A....J..........|
00000010  dc 53 00 00                                       |.S..|

2026-10-11 04:21:19187.190.185.130to 39131/udpBitTorrentMX

A· ·=·S·

payload bytes

00000000  41 00 88 0d 16 ef 3d af  00 00 00 00 00 10 00 00  |A.....=.........|
00000010  dc 53 00 00                                       |.S..|

2026-10-11 04:21:16187.190.185.130to 39131/udpBitTorrentMX

A· ·Z·S·

payload bytes

00000000  41 00 88 0d 16 bf c1 5a  00 00 00 00 00 10 00 00  |A......Z........|
00000010  dc 53 00 00                                       |.S..|

2026-10-11 04:18:07201.97.176.15to 39131/udpBitTorrentMX

A·l·6·

payload bytes

00000000  41 00 03 07 6c a1 36 a7  00 00 00 00 00 10 00 00  |A...l.6.........|
00000010  ef 9b 00 00                                       |....|

2026-10-11 04:18:01201.97.176.15to 39131/udpBitTorrentMX

A·lE<m·

payload bytes

00000000  41 00 03 07 6c 45 3c 6d  00 00 00 00 00 10 00 00  |A...lE<m........|
00000010  ef 9b 00 00                                       |....|

2026-10-11 04:17:58201.97.176.15to 39131/udpBitTorrentMX

A·l·

payload bytes

00000000  41 00 03 07 6c 15 fa a7  00 00 00 00 00 10 00 00  |A...l...........|
00000010  ef 9b 00 00                                       |....|

2026-10-11 04:17:10189.51.168.102to 39131/udpBitTorrentMX

d1:ad2:id20: ·d·y·)l·9·~·<·9:info_hash20: ·L·12·n·t·]o'·e1:q9:get_peers1:t2:|91:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 0d d1 64 f8  |d1:ad2:id20:..d.|
00000010  ad 79 aa 29 6c f3 39 c3  7e 93 3c a9 cb ef 01 19  |.y.)l.9.~.<.....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 0d d1  |9:info_hash20:..|
00000030  4c e8 31 32 0c 6e a5 04  c1 74 15 8b c0 08 5d 6f  |L.12.n...t....]o|
00000040  27 e0 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |'.e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 7c 39  31 3a 76 34 3a 4c 54 01  |s1:t2:|91:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|

2026-10-11 04:16:42187.190.185.130to 39131/udpBitTorrentMX

A·ħ·q·͞·

payload bytes

00000000  41 00 c4 a7 06 71 9d c2  00 00 00 00 00 10 00 00  |A....q..........|
00000010  cd 9e 00 00                                       |....|

2026-10-11 04:16:36187.190.185.130to 39131/udpBitTorrentMX

A·ħ·%·͞·

payload bytes

00000000  41 00 c4 a7 06 15 c4 25  00 00 00 00 00 10 00 00  |A......%........|
00000010  cd 9e 00 00                                       |....|

2026-10-11 04:16:33187.190.185.130to 39131/udpBitTorrentMX

A·ħ·m·͞·

payload bytes

00000000  41 00 c4 a7 05 e1 a7 6d  00 00 00 00 00 10 00 00  |A......m........|
00000010  cd 9e 00 00                                       |....|

2026-10-11 04:15:05189.51.168.102to 39131/udpBitTorrentMX

d1:ad2:id20: ·d·y·)l·9·~·<·9:info_hash20: ·y·<4·MbC·xɇe1:q9:get_peers1:t2:f·1:v4:LT·1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 0d d1 64 f8  |d1:ad2:id20:..d.|
00000010  ad 79 aa 29 6c f3 39 c3  7e 93 3c a9 cb ef 01 19  |.y.)l.9.~.<.....|
00000020  39 3a 69 6e 66 6f 5f 68  61 73 68 32 30 3a 0d d1  |9:info_hash20:..|
00000030  79 b4 f0 d5 01 f4 3c 34  f7 f2 e0 4d 62 43 fa 78  |y.....<4...MbC.x|
00000040  c9 87 65 31 3a 71 39 3a  67 65 74 5f 70 65 65 72  |..e1:q9:get_peer|
00000050  73 31 3a 74 32 3a 66 c1  31 3a 76 34 3a 4c 54 01  |s1:t2:f.1:v4:LT.|
00000060  02 31 3a 79 31 3a 71 65                           |.1:y1:qe|