UDP traffic
Datagrams matching country:TR sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
60
Datagrams
8
Source addresses
6
Networks
1
Countries
16
Destination ports
Traffic by type
Other services
4 datagrams from 1 sourceFirst packets of sessions with VPN, voice, tunnelling, database and management services.
Latest SIP datagram, to 5060/udp
Payload bytes withheld: they contain the sensor's address.
Unrecognised
51 datagrams from 7 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 1900/udp
payload bytes
00000000 64 2e 27 77 50 4a 5d 33 31 5f f0 |d.'wPJ]31_.|
Peer-to-peer
5 datagrams from 3 sourcesFile-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| Memcached | 11211/udp | 7 | 2 | 10,000 to 51,000 |
| SSDP | 1900/udp | 2 | 1 | 30.8 |
| mDNS | 5353/udp | 1 | 1 | 2 to 10 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
Networks
- AS9121 Turk Telekom from 2 sources21
- AS212219 Hosting Dunyam Bilisim Teknolojileri Tic from 1 source17
- AS34984 Superonline Iletisim Hizmetleri A.S. from 2 sources14
- AS44382 Fiba Cloud Operation Company, LLC from 1 source4
- AS215540 Global Connectivity Solutions Llp from 1 source3
- AS47331 Turk Telekom from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 78.177.196.31 | AS9121 Turk Telekom | TR | Unrecognised | 20 | 2026-10-09 21:33 |
| 195.85.207.31 | AS212219 Hosting Dunyam Bilisim Teknolojileri Tic | TR | Unrecognised | 17 | 2026-10-11 02:33 |
| 195.33.200.58 | AS34984 Superonline Iletisim Hizmetleri A.S. | TR | Unrecognised | 13 | 2026-10-10 17:01 |
| 45.141.148.75 | AS44382 Fiba Cloud Operation Company, LLC | TR | SIP | 4 | 2026-10-10 03:56 |
| 139.28.240.217 | AS215540 Global Connectivity Solutions Llp | TR | Unrecognised | 3 | 2026-10-05 23:05 |
| 85.105.237.220 | AS9121 Turk Telekom | TR | Unrecognised | 1 | 2026-10-09 15:03 |
| 88.238.189.226 | AS47331 Turk Telekom | TR | Unrecognised | 1 | 2026-10-07 04:22 |
| 212.252.73.26 | AS34984 Superonline Iletisim Hizmetleri A.S. | TR | Unrecognised | 1 | 2026-10-10 10:17 |
Latest datagrams
payload bytes
00000000 64 2e 27 77 50 4a 5d 33 31 5f f0 |d.'wPJ]31_.|
payload bytes
00000000 34 2e 2c 61 20 49 2e 1f 21 03 66 75 48 4d 61 29 |4.,a I..!.fuHMa)| 00000010 0c 63 3d 30 62 51 21 3d 4d 61 5c 3a 1c 35 27 50 |.c=0bQ!=Ma\:.5'P| 00000020 67 53 31 07 1d 60 26 3e 63 0d 33 2b 5a 14 54 67 |gS1..`&>c.3+Z.Tg| 00000030 77 11 d1 ba |w...|
payload bytes
00000000 07 2e 79 3c 07 3d 57 26 31 29 56 0f 47 7d 65 6a |..y<.=W&1)V.G}ej| 00000010 3d 21 07 2b 42 |=!.+B|
payload bytes
00000000 40 2e 4c 6e 50 01 1d 4a 03 7e 0f 6f 06 23 51 5f |@.LnP..J.~.o.#Q_| 00000010 77 4d 20 6b 4a 3b 04 7b 01 43 4b 5d 32 82 |wM kJ;.{.CK]2.|payload bytes
00000000 13 2e 69 46 61 76 6c 33 27 08 15 24 5b 4e 56 4b |..iFavl3'..$[NVK| 00000010 61 1e 1d 23 43 4a 1b 69 70 71 04 56 10 71 24 23 |a..#CJ.ipq.V.q$#| 00000020 60 0e 69 41 04 55 ef ca |`.iA.U..|
payload bytes
00000000 1f 2e 44 09 4e 77 1d 47 60 48 69 48 7d 3a 7b 69 |..D.Nw.G`HiH}:{i| 00000010 2f 6d 71 34 64 54 76 67 |/mq4dTvg|payload bytes
00000000 0d 2e 4a 17 17 2d 10 69 2f 20 67 4e 75 7e 2e 5a |..J..-.i/ gNu~.Z| 00000010 0d 7d 37 4d 15 7b 41 5a 44 49 68 32 58 15 4c 65 |.}7M.{AZDIh2X.Le| 00000020 75 16 7d 0c 44 0d 75 73 2d 5c 41 22 5a 6f 7c 67 |u.}.D.us-\A"Zo|g| 00000030 6c 34 35 01 2f 76 5b 74 3f 7b d2 |l45./v[t?{.|Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 58 2e 2c 50 17 08 03 58 19 18 48 55 7e 47 45 0a |X.,P...X..HU~GE.| 00000010 4f 20 67 59 46 4c 48 02 2f 6d 4d 13 37 5a 38 0f |O gYFLH./mM.7Z8.| 00000020 3f 65 60 56 6d 63 2f 07 7b 77 5c 79 3e 21 03 0d |?e`Vmc/.{w\y>!..| 00000030 41 6a 67 08 37 2f 0a 66 1c 57 7a 53 31 32 63 e4 |Ajg.7/.f.WzS12c.| 00000040 4d |M|payload bytes
00000000 42 2e 09 5e 75 27 66 35 4c 0d 38 2e 57 40 4d 08 |B..^u'f5L.8.W@M.| 00000010 1b 52 70 18 5e 19 41 0c 4b b7 42 |.Rp.^.A.K.B|
Payload bytes withheld: they contain the sensor's address.
payload bytes
00000000 15 |.|
payload bytes
00000000 15 |.|
payload bytes
00000000 15 |.|
payload bytes
00000000 15 |.|