UDP traffic

Datagrams matching country:TH sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

11 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

TFTP 11

Latest TFTP datagram, to 69/udp

·mac.cfg·octet·

payload bytes

00000000  00 01 6d 61 63 2e 63 66  67 00 6f 63 74 65 74 00  |..mac.cfg.octet.|

Other services

13 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

STUN 12 SOCKS5 1

Latest STUN datagram, to 50690/udp

·T!·BAvuYLoBk2gfb· Mbw9:bm6w·ں· `·W· ·*·$·n·Cg·9·Ҁ·f· ·(·

payload bytes

00000000  00 01 00 54 21 12 a4 42  41 76 75 59 4c 6f 42 6b  |...T!..BAvuYLoBk|
00000010  32 67 66 62 00 06 00 09  4d 62 77 39 3a 62 6d 36  |2gfb....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0d 60 c0 57 00 04  |w..........`.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 b4 cd fb 99  |.$..n...........|
00000050  43 67 14 39 d3 fa d2 80  bc eb f2 04 66 f9 20 17  |Cg.9........f. .|
00000060  80 28 00 04 f7 a7 8b 97                           |.(......|

Unrecognised

1 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1

Latest Unrecognised datagram, to 56582/udp

·QN·Y·4Vx·[

payload bytes

00000000  01 83 c8 51 4e b0 fd 59  ce 00 ff ff 00 fe fe fe  |...QN..Y........|
00000010  fe fd fd fd fd 12 34 56  78 11 cd 1b 12 c9 fd 93  |......4Vx.......|
00000020  5b                                                |[|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
TFTP	69/udp	11	1	60

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

69/udp TFTP11
50637/udp STUN3
50690/udp STUN3
58599/udp STUN3
62980/udp STUN3
34999/udp SOCKS51
56582/udp1

Networks

AS32934 Facebook, Inc. from 1 source12
AS136907 HUAWEI CLOUDS from 1 source11
AS23969 TOT Public Company Limited from 2 sources2

Countries

TH Thailand25

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
57.145.19.135	AS32934 Facebook, Inc.	TH	STUN	12	2026-10-10 12:52
122.8.156.185	AS136907 HUAWEI CLOUDS	TH	TFTP	11	2026-10-11 03:44
1.1.241.219	AS23969 TOT Public Company Limited	TH	SOCKS5	1	2026-10-10 11:36
1.20.175.54	AS23969 TOT Public Company Limited	TH	Unrecognised	1	2026-10-10 17:28

Latest datagrams

2026-10-11 03:44:22122.8.156.185to 69/udpTFTPTH

·mac.cfg·octet·

payload bytes

00000000  00 01 6d 61 63 2e 63 66  67 00 6f 63 74 65 74 00  |..mac.cfg.octet.|

2026-10-11 01:30:58122.8.156.185to 69/udpTFTPTH

·mac.cfg·octet·

payload bytes

00000000  00 01 6d 61 63 2e 63 66  67 00 6f 63 74 65 74 00  |..mac.cfg.octet.|

2026-10-10 23:13:34122.8.156.185to 69/udpTFTPTH

·spa112.cfg·octet·

payload bytes

00000000  00 01 73 70 61 31 31 32  2e 63 66 67 00 6f 63 74  |..spa112.cfg.oct|
00000010  65 74 00                                          |et.|

2026-10-10 21:00:21122.8.156.185to 69/udpTFTPTH

·spa112.cfg·octet·

payload bytes

00000000  00 01 73 70 61 31 31 32  2e 63 66 67 00 6f 63 74  |..spa112.cfg.oct|
00000010  65 74 00                                          |et.|

2026-10-10 18:43:01122.8.156.185to 69/udpTFTPTH

·phone1.cfg·octet·

payload bytes

00000000  00 01 70 68 6f 6e 65 31  2e 63 66 67 00 6f 63 74  |..phone1.cfg.oct|
00000010  65 74 00                                          |et.|

2026-10-10 17:28:441.20.175.54to 56582/udpUnrecognisedTH

·QN·Y·4Vx·[

payload bytes

00000000  01 83 c8 51 4e b0 fd 59  ce 00 ff ff 00 fe fe fe  |...QN..Y........|
00000010  fe fd fd fd fd 12 34 56  78 11 cd 1b 12 c9 fd 93  |......4Vx.......|
00000020  5b                                                |[|

2026-10-10 16:29:51122.8.156.185to 69/udpTFTPTH

·phone1.cfg·octet·

payload bytes

00000000  00 01 70 68 6f 6e 65 31  2e 63 66 67 00 6f 63 74  |..phone1.cfg.oct|
00000010  65 74 00                                          |et.|

2026-10-10 14:12:31122.8.156.185to 69/udpTFTPTH

·config.db·octet·

payload bytes

00000000  00 01 63 6f 6e 66 69 67  2e 64 62 00 6f 63 74 65  |..config.db.octe|
00000010  74 00                                             |t.|

2026-10-10 12:52:1857.145.19.135to 50690/udpSTUNTH

·T!·BAvuYLoBk2gfb· Mbw9:bm6w·ں· `·W· ·*·$·n·Cg·9·Ҁ·f· ·(·

payload bytes

00000000  00 01 00 54 21 12 a4 42  41 76 75 59 4c 6f 42 6b  |...T!..BAvuYLoBk|
00000010  32 67 66 62 00 06 00 09  4d 62 77 39 3a 62 6d 36  |2gfb....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0d 60 c0 57 00 04  |w..........`.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 b4 cd fb 99  |.$..n...........|
00000050  43 67 14 39 d3 fa d2 80  bc eb f2 04 66 f9 20 17  |Cg.9........f. .|
00000060  80 28 00 04 f7 a7 8b 97                           |.(......|

2026-10-10 12:52:1757.145.19.135to 62980/udpSTUNTH

·T!·Bj5Pe7JdjNgik· Mbw9:bm6w·ں·W· ·*·$·n·p·8·d1·<_· ·X·(·4·:y

payload bytes

00000000  00 01 00 54 21 12 a4 42  6a 35 50 65 37 4a 64 6a  |...T!..Bj5Pe7Jdj|
00000010  4e 67 69 6b 00 06 00 09  4d 62 77 39 3a 62 6d 36  |Ngik....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0c cb c0 57 00 04  |w............W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 70 ae da c8  |.$..n.......p...|
00000050  1e 38 cc 64 31 a0 3c 5f  8f 06 83 0d 0e ba 58 10  |.8.d1.<_......X.|
00000060  80 28 00 04 34 e9 3a 79                           |.(..4.:y|

2026-10-10 12:52:1757.145.19.135to 50637/udpSTUNTH

·T!·B/Hb3/W90Aij/· Mbw9:bm6w·ں·W· ·*·$·n·ד·/PYp·HoAW·F·5·(·V

payload bytes

00000000  00 01 00 54 21 12 a4 42  2f 48 62 33 2f 57 39 30  |...T!..B/Hb3/W90|
00000010  41 69 6a 2f 00 06 00 09  4d 62 77 39 3a 62 6d 36  |Aij/....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0c fc c0 57 00 04  |w............W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 e0 d7 93 e2  |.$..n...........|
00000050  2f 50 59 70 99 b3 48 6f  41 57 c9 c2 c2 46 d2 35  |/PYp..HoAW...F.5|
00000060  80 28 00 04 9e ed e5 56                           |.(.....V|

2026-10-10 12:52:1757.145.19.135to 58599/udpSTUNTH

·T!·BSSnbjARGLRiZ· Mbw9:bm6w·ں· 0·W· ·*·$·n·M5$^Lr·~3ӃB·(·6·

payload bytes

00000000  00 01 00 54 21 12 a4 42  53 53 6e 62 6a 41 52 47  |...T!..BSSnbjARG|
00000010  4c 52 69 5a 00 06 00 09  4d 62 77 39 3a 62 6d 36  |LRiZ....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0d 30 c0 57 00 04  |w..........0.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 b4 bc 4d 35  |.$..n.........M5|
00000050  24 5e 4c 72 a0 c1 89 c0  7e 33 d3 83 42 c2 12 b4  |$^Lr....~3..B...|
00000060  80 28 00 04 e8 ca 36 d4                           |.(....6.|

2026-10-10 12:52:1657.145.19.135to 62980/udpSTUNTH

·T!·B4EE3PxL0OI6k· Mbw9:bm6w·ں·E·W· ·*·$·n·ZE·0·rK·أ·n·%/·y·(· ·e

payload bytes

00000000  00 01 00 54 21 12 a4 42  34 45 45 33 50 78 4c 30  |...T!..B4EE3PxL0|
00000010  4f 49 36 6b 00 06 00 09  4d 62 77 39 3a 62 6d 36  |OI6k....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 07 45 c0 57 00 04  |w..........E.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 5a 45 c7 cb  |.$..n.......ZE..|
00000050  30 b1 72 4b f1 d8 a3 8f  ee 6e a2 25 2f 04 1f 79  |0.rK.....n.%/..y|
00000060  80 28 00 04 8d 0d 03 65                           |.(.....e|

2026-10-10 12:52:1657.145.19.135to 50637/udpSTUNTH

·T!·Bd2npRlCeWB0p· Mbw9:bm6w·ں·w·W· ·*·$·n·J{G\·q·9·E=1·(·!·l·

payload bytes

00000000  00 01 00 54 21 12 a4 42  64 32 6e 70 52 6c 43 65  |...T!..Bd2npRlCe|
00000010  57 42 30 70 00 06 00 09  4d 62 77 39 3a 62 6d 36  |WB0p....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 07 77 c0 57 00 04  |w..........w.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 cc dc 17 08  |.$..n...........|
00000050  4a 7b 47 5c a9 b4 c5 fe  71 b9 39 dc 45 3d 31 07  |J{G\....q.9.E=1.|
00000060  80 28 00 04 21 a8 6c db                           |.(..!.l.|

2026-10-10 12:52:1657.145.19.135to 58599/udpSTUNTH

·T!·B+/haYsKM2QLy· Mbw9:bm6w·ں·W· ·*·$·n· ·!P·T·վ`·6·Ib*·(·Y{ ·

payload bytes

00000000  00 01 00 54 21 12 a4 42  2b 2f 68 61 59 73 4b 4d  |...T!..B+/haYsKM|
00000010  32 51 4c 79 00 06 00 09  4d 62 77 39 3a 62 6d 36  |2QLy....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 07 aa c0 57 00 04  |w............W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 0d b8 21 50  |.$..n.........!P|
00000050  ba 54 ef d5 be 60 cb 36  9a 8f 49 62 2a 02 ad 16  |.T...`.6..Ib*...|
00000060  80 28 00 04 59 7b 0a f0                           |.(..Y{..|