HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching country:TH sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

71

Datagrams

25

Source addresses

7

Networks

1

Countries

33

Destination ports

Traffic by type

Service queries

34 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

TFTP 31 NetBIOS 1 CoAP 1 SSDP 1

Latest TFTP datagram, to 69/udp

·mac.xml·octet·

payload bytes
00000000  00 01 6d 61 63 2e 78 6d  6c 00 6f 63 74 65 74 00  |..mac.xml.octet.|

Other services

20 datagrams from 8 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

STUN 12 SOCKS5 7 GTP-C 1

Latest STUN datagram, to 50690/udp

·T!·BAvuYLoBk2gfb· Mbw9:bm6w·ں· `·W· ·*·$·n·Cg·9·Ҁ·f· ·(·

payload bytes
00000000  00 01 00 54 21 12 a4 42  41 76 75 59 4c 6f 42 6b  |...T!..BAvuYLoBk|
00000010  32 67 66 62 00 06 00 09  4d 62 77 39 3a 62 6d 36  |2gfb....Mbw9:bm6|
00000020  77 00 00 00 da ba 00 04  00 00 0d 60 c0 57 00 04  |w..........`.W..|
00000030  00 02 00 0a 80 2a 00 08  00 00 00 00 00 00 00 00  |.....*..........|
00000040  00 24 00 04 6e 7f 1e ff  00 08 00 14 b4 cd fb 99  |.$..n...........|
00000050  43 67 14 39 d3 fa d2 80  bc eb f2 04 66 f9 20 17  |Cg.9........f. .|
00000060  80 28 00 04 f7 a7 8b 97                           |.(......|

Unrecognised

17 datagrams from 15 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 17

Latest Unrecognised datagram, to 54057/udp

·M·B;k[·4Vx·M·v·

payload bytes
00000000  01 4d 08 9f 89 42 3b 6b  5b 00 ff ff 00 fe fe fe  |.M...B;k[.......|
00000010  fe fd fd fd fd 12 34 56  78 d4 4d 0c ba 76 90 f6  |......4Vx.M..v..|
00000020  92                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
TFTP69/udp31160
NetBIOS137/udp113.8
SSDP1900/udp1130.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
122.8.156.185AS136907 HUAWEI CLOUDSTHTFTP312026-10-11 06:01
57.145.19.135AS32934 Facebook, Inc.THSTUN122026-10-10 12:52
171.6.120.80AS45758 Triple T Broadband Public Company LimiteTHUnrecognised42026-10-09 05:37
27.130.60.239AS133481 AIS FibreTHUnrecognised22026-10-09 12:07
223.205.221.117AS45758 Triple T Broadband Public Company LimiteTHUnrecognised22026-10-06 19:58
118.193.57.218AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITTHGTP-C12026-10-06 09:47
1.1.241.219AS23969 TOT Public Company LimitedTHSOCKS512026-10-10 11:36
116.58.234.163AS131090 National Telecom Public Company LimitedTHUnrecognised12026-10-05 17:14
1.20.175.54AS23969 TOT Public Company LimitedTHUnrecognised12026-10-10 17:28
171.6.124.5AS45758 Triple T Broadband Public Company LimiteTHUnrecognised12026-10-11 05:45
223.204.223.43AS45758 Triple T Broadband Public Company LimiteTHSOCKS512026-10-09 03:19
125.24.129.171AS23969 TOT Public Company LimitedTHUnrecognised12026-10-07 11:57
1.20.104.73AS23969 TOT Public Company LimitedTHSOCKS512026-10-09 03:24
165.154.120.89AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITTHUnrecognised12026-10-07 01:57
118.194.250.245AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITTHUnrecognised12026-10-07 16:57
159.192.96.152AS131090 National Telecom Public Company LimitedTHNetBIOS12026-10-10 05:02
1.20.218.10AS23969 TOT Public Company LimitedTHUnrecognised12026-10-07 23:48
27.130.210.103AS133481 AIS FibreTHUnrecognised12026-10-05 18:45
118.193.56.149AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITTHCoAP12026-10-06 21:31
118.194.250.113AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITTHSSDP12026-10-06 03:58

Latest datagrams