UDP traffic

Datagrams matching country:RU sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

20 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 6 SSDP 4 SNMP 4 NetBIOS 3 NTP 3

Latest DNS datagram, to 53/udp

DNS query ANY com

payload bytes

00000000  48 53 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |HS...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|

Unrecognised

13 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 13

Latest Unrecognised datagram, to 1434/udp

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	6	2	28 to 54
SSDP	1900/udp	5	2	30.8
SNMPv2	161/udp	4	1	6.3
NTP	123/udp	3	1	556.9
NetBIOS	137/udp	3	1	3.8
mDNS	5353/udp	1	1	2 to 10
Memcached	11211/udp	1	1	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS6
1900/udp SSDP5
161/udp SNMP4
123/udp NTP3
137/udp NetBIOS3
1027/udp2
1434/udp MSSQL Browser2
5060/udp SIP1
5353/udp mDNS1
8000/udp1
8080/udp1
8081/udp1

DNS questions

DNS record types

ANY4
A2

Networks

AS51115 HLL LLC from 1 source18
AS57044 JSC ER-Telecom Holding from 3 sources7
AS13238 YANDEX LLC from 1 source2
AS8402 PVimpelCom from 1 source2
AS201848 Trader soft LLC from 1 source1
AS8749 JSC Redcom-lnternet from 1 source1
AS213182 CATV System Edver Ltd. from 1 source1
AS50257 JV A-Mobile Ltd. from 1 source1
AS34267 Rostelecom from 1 source1

Countries

RU Russia34

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.94.111.1	AS51115 HLL LLC	RU	DNS	18	2026-10-11 04:00
31.132.169.138	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	4	2026-10-11 03:17
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	2	2026-10-10 09:33
78.107.31.154	AS8402 PVimpelCom	RU	Unrecognised	2	2026-10-11 00:02
93.158.165.179	AS13238 YANDEX LLC	RU	DNS	2	2026-10-10 17:30
37.32.101.141	AS8749 JSC Redcom-lnternet	RU	Unrecognised	1	2026-10-10 23:55
212.193.59.5	AS201848 Trader soft LLC	RU	BitTorrent	1	2026-10-11 05:05
37.112.57.95	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	1	2026-10-10 11:00
213.155.195.206	AS34267 Rostelecom	RU	Unrecognised	1	2026-10-10 19:36
185.99.6.117	AS50257 JV A-Mobile Ltd.	RU	Unrecognised	1	2026-10-10 18:37
93.170.12.102	AS213182 CATV System Edver Ltd.	RU	Unrecognised	1	2026-10-10 08:40

Latest datagrams

2026-10-11 05:05:28212.193.59.5to 39131/udpBitTorrentRU

A·E·l·5·@·M·

payload bytes

00000000  41 00 45 dd 6c 82 04 35  00 00 00 00 00 0e 99 40  |A.E.l..5.......@|
00000010  ff 4d 00 00                                       |.M..|

2026-10-11 04:00:58185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  d2 a8 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:25:53185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  f9 74 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.t.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:17:2131.132.169.138to 1434/udpUnrecognisedRU

·.B_·8e·sXqRw97[·>?p=r[oA ^·#·G·h0·y0·Q!THZ·$mJc]·V8v·XU·{Td~pdf s_Pu0qJxKU·8·'VM·mK·

payload bytes

00000000  03 2e 42 5f 1d 38 65 14  0f 11 00 73 58 71 52 77  |..B_.8e....sXqRw|
00000010  39 37 5b 13 3e 3f 70 3d  72 5b 6f 41 20 5e 05 23  |97[.>?p=r[oA ^.#|
00000020  7f 47 02 1c 00 68 30 0f  79 30 02 51 21 54 48 5a  |.G...h0.y0.Q!THZ|
00000030  0b 24 6d 4a 63 5d 07 56  38 76 17 58 55 1c 7b 54  |.$mJc].V8v.XU.{T|
00000040  64 7e 70 64 66 20 73 5f  50 75 30 71 4a 78 4b 55  |d~pdf s_Pu0qJxKU|
00000050  1c 38 1f 00 15 27 56 4d  1d 6d 4b 82              |.8...'VM.mK.|

2026-10-11 03:06:21185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  21 4d 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |!M.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 02:25:49185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:18:51185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:14:4031.132.169.138to 8080/udpUnrecognisedRU

;.:rub`h2|· n·ibNX)·l$·V c·U":G·(·N$·[·DtT·e9 A`·c·

payload bytes

00000000  3b 2e 3a 72 75 62 60 68  32 7c 01 0d 6e 05 69 62  |;.:rub`h2|..n.ib|
00000010  4e 58 29 11 1c 6c 24 08  56 09 63 1e 1a 15 00 55  |NX)..l$.V.c....U|
00000020  22 3a 47 17 1c 28 7f 4e  24 00 5b 12 06 44 74 54  |":G..(.N$.[..DtT|
00000030  1d 1e 65 39 0a 09 41 60  12 63 af                 |..e9..A`.c.|

2026-10-11 02:13:0431.132.169.138to 8081/udpUnrecognisedRU

V.;>>{·Rr4oa}5·8>·wA6 EyV;·!opv*.4&<·puym*·u28370tn99g·u·0d·

payload bytes

00000000  56 2e 3b 3e 3e 7b 0e 52  72 34 6f 61 7d 35 07 08  |V.;>>{.Rr4oa}5..|
00000010  08 38 3e 05 77 41 36 09  45 79 56 3b 1a 21 6f 70  |.8>.wA6.EyV;.!op|
00000020  76 2a 2e 34 26 3c 06 18  70 75 79 6d 2a 00 75 32  |v*.4&<..puym*.u2|
00000030  38 33 37 30 74 6e 39 39  67 0f 75 01 30 64 86 aa  |8370tn99g.u.0d..|

2026-10-11 01:07:07185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:02:08185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 00:02:5578.107.31.154to 1027/udpUnrecognisedRU

-.J9&IWl4;)E{r p·z-,·K·q^^F!^n7·"·EHJ·4·W]DROMCSGp·^<·P·y·<W·sc'u(o?D#>·m·

payload bytes

00000000  2d 2e 4a 39 26 49 57 6c  34 3b 29 45 7b 72 09 70  |-.J9&IWl4;)E{r.p|
00000010  03 7a 2d 2c 17 4b 1b 71  5e 5e 46 21 5e 6e 37 0b  |.z-,.K.q^^F!^n7.|
00000020  22 01 45 48 4a 1c 34 7f  57 5d 44 52 4f 4d 43 53  |".EHJ.4.W]DROMCS|
00000030  47 70 7f 5e 3c 1a 50 1a  79 16 3c 57 05 73 63 27  |Gp.^<.P.y.<W.sc'|
00000040  75 28 6f 3f 44 23 3e 1b  00 02 6d 8c b7           |u(o?D#>...m..|

2026-10-10 23:55:0437.32.101.141to 8082/udpUnrecognisedRU

<.·C|·`b=:·m2T·0J,i62HX^·&21=.·s·e3x c :l· (Bi·@b·6_·!

payload bytes

00000000  3c 2e 1f 43 7c 18 60 62  3d 3a 0b 6d 32 54 0e 30  |<..C|.`b=:.m2T.0|
00000010  4a 2c 69 36 32 48 58 5e  1b 26 32 31 3d 2e 11 73  |J,i62HX^.&21=..s|
00000020  1b 65 33 78 09 63 20 3a  6c 07 0d 28 42 69 01 40  |.e3x.c :l..(Bi.@|
00000030  62 10 36 5f 04 81 21                              |b.6_..!|

2026-10-10 23:18:36185.94.111.1to 161/udpSNMPRU

0·public·A·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 41 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |.A......0.0...+.|
00000020  00                                                |.|

2026-10-10 22:32:19185.94.111.1to 161/udpSNMPRU

0·public·E·0·0·+·

payload bytes

00000000  30 1f 02 01 01 04 06 70  75 62 6c 69 63 a5 12 02  |0......public...|
00000010  01 45 02 01 00 02 01 7f  30 07 30 05 06 01 2b 05  |.E......0.0...+.|
00000020  00                                                |.|