HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

UDP traffic

Datagrams matching country:VN sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

1.3K

Datagrams

49

Source addresses

10

Networks

1

Countries

106

Destination ports

Traffic by type

Other services

127 datagrams from 4 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

STUN 127

Latest STUN datagram, to 57048/udp

·T!·BeuvtxSboKwvq· Gx77:Y6nJ·ں·Yj·W·)·$·n~·8·B·O·U·(·~·V

payload bytes
00000000  00 01 00 54 21 12 a4 42  65 75 76 74 78 53 62 6f  |...T!..BeuvtxSbo|
00000010  4b 77 76 71 00 06 00 09  47 78 37 37 3a 59 36 6e  |Kwvq....Gx77:Y6n|
00000020  4a 00 00 00 da ba 00 04  00 01 59 6a c0 57 00 04  |J.........Yj.W..|
00000030  00 07 03 84 80 29 00 08  00 00 00 00 00 00 00 00  |.....)..........|
00000040  00 24 00 04 6e 7e 1e ff  00 08 00 14 9d 97 b2 bf  |.$..n~..........|
00000050  b3 fb 02 8c 38 8c d4 42  f6 f6 c3 cb 16 4f ef 55  |....8..B.....O.U|
00000060  80 28 00 04 7e 87 ca 56                           |.(..~..V|

Unrecognised

1,192 datagrams from 44 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 1,192

Latest Unrecognised datagram, to 60163/udp

·(·

payload bytes
00000000  7f 00 00 9f 1d ff 28 01  00 00 04 00 00 00 00 ff  |......(.........|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
mDNS5353/udp112 to 10
SSDP1900/udp1130.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
117.3.123.242AS7552 Viettel GroupVNUnrecognised1432026-10-11 01:49
27.68.152.94AS7552 Viettel GroupVNUnrecognised1202026-10-10 14:15
27.66.49.95AS7552 Viettel GroupVNUnrecognised892026-10-10 14:12
27.67.72.112AS7552 Viettel GroupVNUnrecognised802026-10-10 13:56
171.255.158.106AS7552 Viettel GroupVNUnrecognised622026-10-10 03:46
125.235.172.252AS7552 Viettel GroupVNUnrecognised582026-10-10 23:46
116.110.224.132AS7552 Viettel GroupVNUnrecognised552026-10-11 01:28
117.3.120.162AS7552 Viettel GroupVNUnrecognised512026-10-11 03:20
171.244.211.211AS7552 Viettel GroupVNUnrecognised472026-10-11 01:57
116.96.77.130AS7552 Viettel GroupVNUnrecognised412026-10-07 12:08
116.110.224.3AS7552 Viettel GroupVNUnrecognised402026-10-10 02:32
104.28.210.247AS13335 Cloudflare, Inc.VNUnrecognised402026-10-10 09:46
171.254.139.104AS7552 Viettel GroupVNUnrecognised402026-10-11 02:39
116.110.224.176AS7552 Viettel GroupVNSTUN402026-10-10 12:44
14.191.245.6AS45899 VNPT CorpVNUnrecognised382026-10-10 12:58
113.185.109.99AS45899 VNPT CorpVNSTUN362026-10-11 00:17
14.230.133.126AS45899 VNPT CorpVNSTUN332026-10-09 15:26
171.254.130.133AS7552 Viettel GroupVNUnrecognised282026-10-10 07:58
171.254.142.160AS7552 Viettel GroupVNUnrecognised252026-10-10 11:40
125.234.229.115AS7552 Viettel GroupVNUnrecognised252026-10-11 03:26

Latest datagrams