UDP traffic
Datagrams matching country:MY sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
16
Datagrams
13
Source addresses
3
Networks
1
Countries
13
Destination ports
Traffic by type
Service queries
1 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest SOAP datagram, to 3702/udp
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 |.0" encoding="UT| 00000020 46 2d 38 22 3f 3e 3c 73 6f 61 70 2d 65 6e 76 3a |F-8"?><soap-env:| 00000030 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 |Envelope xmlns:s| 00000040 6f 61 70 2d 65 6e 76 3d 22 68 74 74 70 3a 2f 2f |oap-env="http://| 00000050 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f |www.w3.org/2003/| 00000060 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 |05/soap-envelope| 00000070 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 2d 65 6e 63 |" xmlns:soap-enc| 00000080 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000090 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 000000a0 2d 65 6e 63 6f 64 69 6e 67 22 20 78 6d 6c 6e 73 |-encoding" xmlns| 000000b0 3a 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d |:a="http://schem| 000000c0 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 |as.xmlsoap.org/w| 000000d0 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 65 73 |s/2004/08/addres| 000000e0 73 69 6e 67 22 3e 3c 73 6f 61 70 2d 65 6e 76 3a |sing"><soap-env:| 000000f0 48 65 61 64 65 72 3e 3c 61 3a 41 63 74 69 6f 6e |Header><a:Action|
Other services
2 datagrams from 2 sourcesFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SOCKS5 datagram, to 13281/udp
payload bytes
00000000 05 00 ff ff 00 fe fe fe fe fd fd fd fd 12 34 56 |..............4V| 00000010 78 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |x...............| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
Unrecognised
13 datagrams from 11 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 6969/udp
payload bytes
00000000 00 00 04 17 27 10 19 80 00 00 00 00 6f 0b 11 36 |....'.......o..6|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| WS-Discovery | 3702/udp | 1 | 1 | 10 to 500 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS45102 Alibaba (US) Technology Co., Ltd. from 11 sources13
- AS9534 Binariang Berhad from 1 source2
- AS10030 Celcom Axiata Berhad from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 47.250.83.149 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 2 | 2026-10-09 20:19 |
| 47.250.120.163 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 2 | 2026-10-07 11:19 |
| 113.211.214.144 | AS9534 Binariang Berhad | MY | SOCKS5 | 2 | 2026-10-09 19:44 |
| 47.250.38.169 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-10 16:13 |
| 47.250.93.212 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-06 19:49 |
| 47.254.195.162 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-07 10:08 |
| 47.250.37.179 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-05 20:25 |
| 47.250.130.240 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | SOAP | 1 | 2026-10-08 00:15 |
| 183.171.249.218 | AS10030 Celcom Axiata Berhad | MY | Unrecognised | 1 | 2026-10-07 11:27 |
| 47.254.255.111 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-06 13:38 |
| 47.254.192.136 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-06 05:22 |
| 47.254.206.59 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | Unrecognised | 1 | 2026-10-07 14:45 |
| 47.250.94.249 | AS45102 Alibaba (US) Technology Co., Ltd. | MY | RADIUS | 1 | 2026-10-06 22:03 |
Latest datagrams
payload bytes
00000000 00 00 04 17 27 10 19 80 00 00 00 00 6f 0b 11 36 |....'.......o..6|
payload bytes
00000000 06 00 ff 06 00 00 11 be 80 00 00 00 |............|
payload bytes
00000000 06 00 ff 06 00 00 11 be 80 00 00 00 |............|
payload bytes
00000000 01 fd 58 e3 3a f5 33 31 44 00 ff ff 00 fe fe fe |..X.:.31D.......| 00000010 fe fd fd fd fd 12 34 56 78 5d b2 08 32 d4 aa 3b |......4Vx]..2..;| 00000020 5d |]|
payload bytes
00000000 05 00 ff ff 00 fe fe fe fe fd fd fd fd 12 34 56 |..............4V| 00000010 78 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |x...............| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| ... 512 bytes shown in part
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 |.0" encoding="UT| 00000020 46 2d 38 22 3f 3e 3c 73 6f 61 70 2d 65 6e 76 3a |F-8"?><soap-env:| 00000030 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 |Envelope xmlns:s| 00000040 6f 61 70 2d 65 6e 76 3d 22 68 74 74 70 3a 2f 2f |oap-env="http://| 00000050 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f |www.w3.org/2003/| 00000060 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 |05/soap-envelope| 00000070 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 2d 65 6e 63 |" xmlns:soap-enc| 00000080 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000090 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 000000a0 2d 65 6e 63 6f 64 69 6e 67 22 20 78 6d 6c 6e 73 |-encoding" xmlns| 000000b0 3a 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d |:a="http://schem| 000000c0 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 |as.xmlsoap.org/w| 000000d0 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 65 73 |s/2004/08/addres| 000000e0 73 69 6e 67 22 3e 3c 73 6f 61 70 2d 65 6e 76 3a |sing"><soap-env:| 000000f0 48 65 61 64 65 72 3e 3c 61 3a 41 63 74 69 6f 6e |Header><a:Action| ... 512 bytes shown in part
payload bytes
00000000 47 61 72 64 61 73 6f 66 74 2c 50 50 35 32 30 2c |Gardasoft,PP520,| 00000010 30 31 32 33 34 35 2c 30 30 30 42 37 35 30 31 38 |012345,000B75018| 00000020 30 39 39 2c 30 61 30 61 30 61 61 39 |099,0a0a0aa9|
payload bytes
00000000 01 9e 01 49 0a c4 d5 0e 5a 00 ff ff 00 fe fe fe |...I....Z.......| 00000010 fe fd fd fd fd 12 34 56 78 55 11 8d 3e f3 a8 8d |......4VxU..>...| 00000020 e7 |.|
payload bytes
00000000 06 00 ff 06 00 00 11 be 80 00 00 00 |............|
payload bytes
00000000 06 00 ff 06 00 00 11 be 80 00 00 00 |............|
payload bytes
00000000 47 61 72 64 61 73 6f 66 74 2c 50 50 35 32 30 2c |Gardasoft,PP520,| 00000010 30 31 32 33 34 35 2c 30 30 30 42 37 35 30 31 38 |012345,000B75018| 00000020 30 39 39 2c 30 61 30 61 30 61 61 39 |099,0a0a0aa9|
payload bytes
00000000 01 31 00 2d 98 05 c0 49 d2 05 e4 c0 ce 31 15 5d |.1.-...I.....1.]| 00000010 d6 1f 7c 4f 01 07 68 65 6c 6c 6f 02 12 45 d7 cc |..|O..hello..E..| 00000020 e9 6c 82 1f c8 4b 4f 69 65 8b 47 cf 1a |.l...KOie.G..|
payload bytes
00000000 47 61 72 64 61 73 6f 66 74 2c 50 50 35 32 30 2c |Gardasoft,PP520,| 00000010 30 31 32 33 34 35 2c 30 30 30 42 37 35 30 31 38 |012345,000B75018| 00000020 30 39 39 2c 30 61 30 61 30 61 61 39 |099,0a0a0aa9|
payload bytes
00000000 47 61 72 64 61 73 6f 66 74 2c 50 50 35 32 30 2c |Gardasoft,PP520,| 00000010 30 31 32 33 34 35 2c 30 30 30 42 37 35 30 31 38 |012345,000B75018| 00000020 30 39 39 2c 30 61 30 61 30 61 61 39 |099,0a0a0aa9|
payload bytes
00000000 00 00 00 f6 |....|