UDP traffic

Datagrams matching country:RS sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

4 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 4

Latest DNS datagram, to 53/udp

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 35918/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 57896/udp

·(>U·C·lv/y·1yC· F!]·`·Ǽ·V·g·y· ·$·]·+·͚·`·|&·ļ`d·>·߷·$·'·&·=·?n,·z·]#·D·(·o·pM·NJ. H:Q·2

payload bytes

00000000  ae 9c 93 28 3e 55 f0 b5  eb ed f0 43 a0 ed 6c 76  |...(>U.....C..lv|
00000010  2f 79 ae c2 e1 9d c0 f5  07 a9 9b 31 79 43 8b 20  |/y.........1yC. |
00000020  46 21 5d 91 19 89 83 60  9f c7 bc 8c fa cd 56 f6  |F!]....`......V.|
00000030  67 95 79 8e f0 0e ce f2  09 af 24 98 ea 98 5d d8  |g.y.......$...].|
00000040  2b fc cd 9a 0c d8 f6 18  fc 60 17 a5 7c 26 b9 91  |+........`..|&..|
00000050  c4 bc 60 64 fc 3e f8 ca  df b7 f6 d4 fb e1 24 8c  |..`d.>........$.|
00000060  27 ea c3 ed bd 26 c7 e6  f5 3d ee 87 ca 3f 6e 2c  |'....&...=...?n,|
00000070  b2 7a 0e de 00 5d 23 01  44 c9 d4 f7 1b 28 19 aa  |.z...]#.D....(..|
00000080  00 0c 6f 07 b0 9a bf 1c  8a ee 70 4d cf 4e 4a 2e  |..o.......pM.NJ.|
00000090  0a 48 3a 51 87 32 b0 b1  85 9e 7e 7b 13 9b 3e 07  |.H:Q.2....~{..>.|
000000a0  e6 f9 c7 84 f3 c7 d3 b4  5a ed d6 3b 30 0f c3 c8  |........Z..;0...|
000000b0  07 d7 70 73 c5 6a b6 59  94 e0 86 d5 9b cf ec 05  |..ps.j.Y........|
000000c0  ce e8 d1 f0 53 54 db 1a  dc 95 bb f8 47 0d 48 9b  |....ST......G.H.|
000000d0  78 11 a0 e4 73 b8 19 24  59 dc 28 00 2e cb d1 db  |x...s..$Y.(.....|
000000e0  fd 2a 1e 3f 4d d7 2d d6  c5 13 a1 90 44 32 7c c5  |.*.?M.-.....D2|.|
000000f0  d4 a1 fb 0b 59 88 d4 b3  dd 9a 73 2b e5 63 b9 0f  |....Y.....s+.c..|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	4	1	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS4
35918/udp SOCKS51
57896/udp1

DNS questions

duo.nl ANY4

DNS record types

ANY4

Networks

AS211619 MAXKO d.o.o. from 1 source4
AS8400 TELEKOM SRBIJA a.d. from 1 source2

Countries

RS Serbia6

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
150.40.126.53	AS211619 MAXKO d.o.o.	RS	DNS	4	2026-10-11 05:47
77.46.191.72	AS8400 TELEKOM SRBIJA a.d.	RS	Unrecognised	2	2026-10-09 10:06

Latest datagrams

2026-10-11 05:47:16150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-11 05:35:17150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-11 05:34:04150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-11 05:22:56150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-09 10:06:4977.46.191.72to 57896/udpUnrecognisedRS

·(>U·C·lv/y·1yC· F!]·`·Ǽ·V·g·y· ·$·]·+·͚·`·|&·ļ`d·>·߷·$·

payload bytes

00000000  ae 9c 93 28 3e 55 f0 b5  eb ed f0 43 a0 ed 6c 76  |...(>U.....C..lv|
00000010  2f 79 ae c2 e1 9d c0 f5  07 a9 9b 31 79 43 8b 20  |/y.........1yC. |
00000020  46 21 5d 91 19 89 83 60  9f c7 bc 8c fa cd 56 f6  |F!]....`......V.|
00000030  67 95 79 8e f0 0e ce f2  09 af 24 98 ea 98 5d d8  |g.y.......$...].|
00000040  2b fc cd 9a 0c d8 f6 18  fc 60 17 a5 7c 26 b9 91  |+........`..|&..|
00000050  c4 bc 60 64 fc 3e f8 ca  df b7 f6 d4 fb e1 24 8c  |..`d.>........$.|
00000060  27 ea c3 ed bd 26 c7 e6  f5 3d ee 87 ca 3f 6e 2c  |'....&...=...?n,|
00000070  b2 7a 0e de 00 5d 23 01  44 c9 d4 f7 1b 28 19 aa  |.z...]#.D....(..|
00000080  00 0c 6f 07 b0 9a bf 1c  8a ee 70 4d cf 4e 4a 2e  |..o.......pM.NJ.|
00000090  0a 48 3a 51 87 32 b0 b1  85 9e 7e 7b 13 9b 3e 07  |.H:Q.2....~{..>.|
000000a0  e6 f9 c7 84 f3 c7 d3 b4  5a ed d6 3b 30 0f c3 c8  |........Z..;0...|
000000b0  07 d7 70 73 c5 6a b6 59  94 e0 86 d5 9b cf ec 05  |..ps.j.Y........|
000000c0  ce e8 d1 f0 53 54 db 1a  dc 95 bb f8 47 0d 48 9b  |....ST......G.H.|
000000d0  78 11 a0 e4 73 b8 19 24  59 dc 28 00 2e cb d1 db  |x...s..$Y.(.....|
000000e0  fd 2a 1e 3f 4d d7 2d d6  c5 13 a1 90 44 32 7c c5  |.*.?M.-.....D2|.|
000000f0  d4 a1 fb 0b 59 88 d4 b3  dd 9a 73 2b e5 63 b9 0f  |....Y.....s+.c..|
... 512 bytes shown in part

2026-10-05 20:09:1677.46.191.72to 35918/udpSOCKS5RS

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part