HoneyLabs

UDP traffic

Datagrams matching country:VE sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

2.4K

Datagrams

67

Source addresses

22

Networks

1

Countries

12

Destination ports

Traffic by type

Service queries

33 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Latest SNMP datagram, to 161/udp

0:·0·Ji·0·0·7·0·

payload bytes
00000000  30 3a 02 01 03 30 0f 02  02 4a 69 02 03 00 ff e3  |0:...0...Ji.....|
00000010  04 01 04 02 01 03 04 10  30 0e 04 00 02 01 00 02  |........0.......|
00000020  01 00 04 00 04 00 04 00  30 12 04 00 04 00 a0 0c  |........0.......|
00000030  02 02 37 f0 02 01 00 02  01 00 30 00              |..7.......0.|

Other services

3 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

Latest SOCKS5 datagram, to 62720/udp

·4Vx·

payload bytes
00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

13 datagrams from 6 sources

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 57256/udp

·c·f· 6q$>[·n·jQ·[·܌jJ`;·`·1g·jʼn·e·Uu·.·y^·*+·K^·چ·ȡ·g·e J͸·.·:·:·l·ċm!·L·es·4yW8·v·aw·7·g·չ·@·ΔM·qҞl·

payload bytes
00000000  1e 63 ca 1a 99 f4 a5 66  07 ee 20 36 71 24 3e 5b  |.c.....f.. 6q$>[|
00000010  9b 6e a5 12 6a 51 ed 5b  c6 dc 8c 6a 4a 60 3b c0  |.n..jQ.[...jJ`;.|
00000020  60 1f d3 f9 31 67 84 c8  0b f8 e2 c4 ed e9 c0 df  |`...1g..........|
00000030  6a c5 89 be 65 80 df 55  75 08 2e 86 dc 16 79 5e  |j...e..Uu.....y^|
00000040  ec 2a 2b ae e4 4b 5e 07  da 86 c5 f1 c8 a1 9c 67  |.*+..K^........g|
00000050  9d 9b 17 90 10 e3 e3 65  20 4a cd b8 10 2e dd 3a  |.......e J.....:|
00000060  a5 91 3a 16 11 0b bb 6c  ec d0 f5 be 8c c4 8b 6d  |..:....l.......m|
00000070  21 c7 fe af 4c b2 a9 1b  65 73 cb 0b 34 79 57 38  |!...L...es..4yW8|
00000080  d0 76 c9 61 77 93 a4 37  bd 9e a4 67 a4 d5 b9 e4  |.v.aw..7...g....|
00000090  15 40 ec ce 94 4d c0 dd  e7 71 d2 9e 6c 83 ec b4  |.@...M...q..l...|
000000a0  0c 91 ac 18 60 d3 df c7  35 df 8f ca eb d2 a8 1a  |....`...5.......|
000000b0  43 04 f0 66 2e 9f 8d 5f  9d 95 4f eb 95 3d 2c b7  |C..f..._..O..=,.|
000000c0  2f e5 18 51 cd 74 5f 62  66 e6 2b f5 c3 ad 3d 23  |/..Q.t_bf.+...=#|
000000d0  16 05 9a b5 74 f6 fa 2c  5b 3d 48 86 e4 cb d5 48  |....t..,[=H....H|
000000e0  5d c5 02 2d df df b0 d6  b7 82 d5 11 82 e1 b9 f7  |]..-............|
000000f0  05 fa aa cc 68 8a b4 9c  73 63 c9 21 39 23 44 19  |....h...sc.!9#D.|

Peer-to-peer

2,359 datagrams from 59 sources

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
SNMPv2161/udp3216.3
NetBIOS137/udp113.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
186.188.79.49AS21826 Corporacion Telemic C.A.VEBitTorrent7892026-10-10 23:05
153.51.231.80AS264628 CORPORACION FIBEX TELECOM, C.A.VEBitTorrent1772026-10-10 08:51
38.92.22.162AS273010 TECNOSYSTEM IO, C.AVEBitTorrent1222026-10-09 06:37
201.211.28.211AS8048 CANTV Servicios, VenezuelaVEBitTorrent1182026-10-08 23:22
200.8.10.210AS21826 Corporacion Telemic C.A.VEBitTorrent922026-10-10 22:53
190.103.29.163AS264628 CORPORACION FIBEX TELECOM, C.A.VEBitTorrent872026-10-09 02:04
190.142.154.99AS21826 Corporacion Telemic C.A.VEBitTorrent832026-10-09 12:13
66.9.161.242AS14593 Space Exploration Technologies CorporatiVEBitTorrent822026-10-06 10:45
190.153.51.69AS11562 Net Uno, C.A.VEBitTorrent762026-10-11 00:08
156.255.166.59AS61461 Airtek Solutions C.A.VEBitTorrent632026-10-07 23:21
38.61.240.181AS272122 TELECOMUNICACIONES G-NETWORK, C.A.VEBitTorrent602026-10-08 02:18
190.103.29.78AS264628 CORPORACION FIBEX TELECOM, C.A.VEBitTorrent472026-10-09 21:45
38.224.158.28AS273203 CABLE PAR, C.A.VEBitTorrent422026-10-09 05:17
38.41.27.154AS269832 MDS TELECOM C.A.VESNMP412026-10-07 04:02
190.89.30.112AS264628 CORPORACION FIBEX TELECOM, C.A.VEBitTorrent402026-10-06 03:34
38.224.158.45AS273203 CABLE PAR, C.A.VEBitTorrent302026-10-09 19:47
190.142.225.216AS21826 Corporacion Telemic C.A.VEBitTorrent282026-10-11 02:56
38.52.136.109AS264837 CORPORACION VISUAL NUEVA ESPARTA, C.AVEBitTorrent262026-10-10 18:15
82.86.108.47AS271791 CABLE NORTE CA.VEBitTorrent262026-10-11 03:25
200.59.191.127AS264778 TotalCom Venezuela C.A.VEBitTorrent252026-10-08 16:59

Latest datagrams