UDP traffic

Datagrams matching country:ZA sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

13 datagrams from 2 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 13

Latest SNMP datagram, to 161/udp

0)·public·8D·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 44 8d ea 02 01 00  02 01 00 30 0e 30 0c 06  |.8D........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

Other services

14 datagrams from 12 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 14

Latest SOCKS5 datagram, to 26944/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

25 datagrams from 19 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 25

Latest Unrecognised datagram, to 40650/udp

·O·ُ·4Vxg·-৖V

payload bytes

00000000  01 4f 8e d9 8f d4 7f a3  ae 00 ff ff 00 fe fe fe  |.O..............|
00000010  fe fd fd fd fd 12 34 56  78 67 a6 15 2d e0 a7 96  |......4Vxg..-...|
00000020  56                                                |V|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	13	2	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP13
443/udp SOCKS52
34740/udp SOCKS51
64443/udp1
5969/udp SOCKS51
9231/udp SOCKS51
12559/udp1
16764/udp1
20036/udp1
20829/udp SOCKS51
3264/udp SOCKS51
23910/udp SOCKS51

Networks

AS3741 Dimension Data from 1 source7
AS5713 Telkom SA Ltd. from 1 source6
AS37053 RSAWEB (PTY) LTD from 3 sources6
AS328471 HERO TELECOMS (PTY) LTD from 3 sources5
AS329126 IIP1 Pty Ltd from 4 sources4
AS16637 MTN SA from 2 sources4
AS20011 Dimension Data from 2 sources3
AS37680 Cool Ideas Service Provider (Pty) Ltd from 1 source3
AS327693 Echotel Pty Ltd from 3 sources3
AS37457 Telkom SA Ltd. from 2 sources2

Countries

ZA South Africa52

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
196.34.146.69	AS3741 Dimension Data	ZA	SNMP	7	2026-10-11 01:30
196.15.210.36	AS5713 Telkom SA Ltd.	ZA	SNMP	6	2026-10-09 07:02
102.132.178.204	AS37680 Cool Ideas Service Provider (Pty) Ltd	ZA	Unrecognised	3	2026-10-10 22:24
41.71.48.31	AS37053 RSAWEB (PTY) LTD	ZA	Unrecognised	3	2026-10-08 00:49
102.66.147.247	AS328471 HERO TELECOMS (PTY) LTD	ZA	Unrecognised	3	2026-10-09 08:57
105.214.54.155	AS16637 MTN SA	ZA	Unrecognised	3	2026-10-09 18:04
102.39.57.215	AS11845 Vox Telecom Ltd	ZA	SOCKS5	2	2026-10-07 19:40
197.87.5.184	AS20011 Dimension Data	ZA	SOCKS5	2	2026-10-08 06:23
102.221.250.175	AS328760 ZTEL PTY LTD	ZA	SOCKS5	2	2026-10-10 07:39
102.141.69.47	AS328638 Letaba Networks (Pty) Ltd	ZA	Unrecognised	2	2026-10-10 03:12
102.217.33.214	AS37053 RSAWEB (PTY) LTD	ZA	Unrecognised	2	2026-10-08 09:47
102.206.95.136	AS329126 IIP1 Pty Ltd	ZA	Unrecognised	1	2026-10-10 01:17
105.185.158.222	AS37457 Telkom SA Ltd.	ZA	Unrecognised	1	2026-10-10 10:20
102.206.93.88	AS329126 IIP1 Pty Ltd	ZA	SOCKS5	1	2026-10-06 09:55
41.198.164.247	AS327693 Echotel Pty Ltd	ZA	SOCKS5	1	2026-10-06 07:48
102.206.93.226	AS329126 IIP1 Pty Ltd	ZA	Unrecognised	1	2026-10-07 10:51
152.110.239.218	AS20011 Dimension Data	ZA	Unrecognised	1	2026-10-05 15:37
102.182.221.83	AS37611 AFRIHOST SP (PTY) LTD	ZA	SOCKS5	1	2026-10-09 18:07
105.244.130.45	AS36994 Vodacom	ZA	Unrecognised	1	2026-10-07 23:53
102.66.145.113	AS328471 HERO TELECOMS (PTY) LTD	ZA	SOCKS5	1	2026-10-05 16:39

Latest datagrams

2026-10-11 01:30:11196.34.146.69to 161/udpSNMPZA

0)·public·8D·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 44 8d ea 02 01 00  02 01 00 30 0e 30 0c 06  |.8D........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-10 23:38:51196.34.146.69to 161/udpSNMPZA

0)·public·8@·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 40 04 fa 02 01 00  02 01 00 30 0e 30 0c 06  |.8@........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-10 22:24:53102.132.178.204to 40650/udpUnrecognisedZA

·O·ُ·4Vxg·-৖V

payload bytes

00000000  01 4f 8e d9 8f d4 7f a3  ae 00 ff ff 00 fe fe fe  |.O..............|
00000010  fe fd fd fd fd 12 34 56  78 67 a6 15 2d e0 a7 96  |......4Vxg..-...|
00000020  56                                                |V|

2026-10-10 10:20:42105.185.158.222to 53859/udpUnrecognisedZA

·"W·E·b·4VxW·_y·

payload bytes

00000000  01 ce 22 57 fb ec 45 8c  62 00 ff ff 00 fe fe fe  |.."W..E.b.......|
00000010  fe fd fd fd fd 12 34 56  78 57 f1 a0 b7 5f 79 d9  |......4VxW..._y.|
00000020  c4                                                |.|

2026-10-10 10:04:39102.132.178.204to 32152/udpUnrecognisedZA

·-·k·4Vx\$·%·f

payload bytes

00000000  01 13 7f 2d e2 6b 14 ab  9e 00 ff ff 00 fe fe fe  |...-.k..........|
00000010  fe fd fd fd fd 12 34 56  78 5c 24 e0 25 f0 90 02  |......4Vx\$.%...|
00000020  66                                                |f|

2026-10-10 08:07:42102.206.95.152to 47097/udpUnrecognisedZA

·k㖜n·`·Y·,·#1·ʰSX·6·}·y·K·H·T·^·$x·]4a8v·#·#VQ)·V76·҂h}k_!·ƿ·G·8·`-$r·)·X·t·r·o·

payload bytes

00000000  91 c3 c6 1f f5 6b e3 96  9c 6e 07 c9 60 c8 f3 05  |.....k...n..`...|
00000010  04 59 00 2c b2 23 31 a1  86 ca b0 53 58 b8 9b c8  |.Y.,.#1....SX...|
00000020  36 10 7d e6 f8 93 79 ce  4b 94 48 1b 02 b6 04 0e  |6.}...y.K.H.....|
00000030  54 eb f6 00 e1 5e 12 02  24 78 a7 5d 34 61 38 76  |T....^..$x.]4a8v|
00000040  ec 88 23 c1 7f 23 56 51  29 17 56 37 36 e1 d2 82  |..#..#VQ).V76...|
00000050  68 7d 6b 5f 21 e0 c6 bf  af 47 ae 38 dd ca 60 2d  |h}k_!....G.8..`-|
00000060  24 72 e4 29 d1 58 ab a1  74 e0 72 eb e5 e9 6f c0  |$r.).X..t.r...o.|
00000070  9e d6 10 ca dd 72 86 31  d9 45 8b 4d 4c ad 14 f2  |.....r.1.E.ML...|
00000080  b6 31 fc be 2e ac ee bc  e7 93 5c ab 0d 35 75 fc  |.1........\..5u.|
00000090  b4 da 5b a3 2d 9d 1d 6a  22 f8 91 25 c0 7c 19 70  |..[.-..j"..%.|.p|
000000a0  0d 86 ea 0d 68 86 98 8b  d1 2f 62 21 41 a8 26 9a  |....h..../b!A.&.|
000000b0  e6 8f a5 c3 3c fa 41 8c  c2 50 6d bc ae 83 a6 13  |....<.A..Pm.....|
000000c0  83 e4 93 fc 37 71 80 7f  45 d5 bd a9 2f 88 21 8e  |....7q..E.../.!.|
000000d0  94 d2 f5 ed d4 0f 80 91  5c f7 d0 d6 59 7d 32 54  |........\...Y}2T|
000000e0  39 64 10 17 a0 37 7f 86  24 5a 44 d7 20 2d 5b 10  |9d...7..$ZD. -[.|
000000f0  be b2 fe 84 b6 57 43 fb  80 a7 23 0e 49 b9 d8 c7  |.....WC...#.I...|
... 512 bytes shown in part

2026-10-10 07:39:37102.221.250.175to 26944/udpSOCKS5ZA

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 03:12:57102.141.69.47to 39295/udpUnrecognisedZA

·xG·D·^0·4VxeKP·`·

payload bytes

00000000  01 78 47 0e 44 ec 5e 30  14 00 ff ff 00 fe fe fe  |.xG.D.^0........|
00000010  fe fd fd fd fd 12 34 56  78 65 4b 50 01 12 ef 60  |......4VxeKP...`|
00000020  7f                                                |.|

2026-10-10 02:42:56102.132.178.204to 20036/udpUnrecognisedZA

·8·P·4Vx·?·B·

payload bytes

00000000  01 a3 1b a5 9d 38 ea b2  50 00 ff ff 00 fe fe fe  |.....8..P.......|
00000010  fe fd fd fd fd 12 34 56  78 d5 fb 7f 3f 82 42 86  |......4Vx...?.B.|
00000020  e9                                                |.|

2026-10-10 01:33:14196.34.146.69to 161/udpSNMPZA

0)·public·_·+·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 81 5f b0 2b 02 01 00  02 01 00 30 0e 30 0c 06  |.._.+......0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-10 01:17:53102.206.95.136to 443/udpUnrecognisedZA

·`·`·4Vx·hVN·

payload bytes

00000000  01 d9 08 e7 60 87 a9 60  a4 00 ff ff 00 fe fe fe  |....`..`........|
00000010  fe fd fd fd fd 12 34 56  78 92 83 03 68 56 4e a6  |......4Vx...hVN.|
00000020  ca                                                |.|

2026-10-09 18:07:08102.182.221.83to 51429/udpSOCKS5ZA

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0b 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-09 18:04:33105.214.54.155to 51165/udpUnrecognisedZA

·.·ՆNs·4Vx·c·U·~f

payload bytes

00000000  01 2e fc 12 d5 86 4e 73  e6 00 ff ff 00 fe fe fe  |......Ns........|
00000010  fe fd fd fd fd 12 34 56  78 85 63 ea 55 0b 9c 7e  |......4Vx.c.U..~|
00000020  66                                                |f|

2026-10-09 08:57:12102.66.147.247to 55124/udpSOCKS5ZA

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 07 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-09 07:02:49196.15.210.36to 161/udpSNMPZA

0$·public·PZK·0 0·+·

payload bytes

00000000  30 24 02 01 00 04 06 70  75 62 6c 69 63 a1 17 02  |0$.....public...|
00000010  04 50 5a 4b d9 02 01 00  02 01 00 30 09 30 07 06  |.PZK.......0.0..|
00000020  03 2b 06 01 05 00                                 |.+....|