UDP traffic

Datagrams matching country:ZA sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 2

Latest SNMP datagram, to 161/udp

0)·public·8D·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 44 8d ea 02 01 00  02 01 00 30 0e 30 0c 06  |.8D........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 26944/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

4 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 40650/udp

·O·ُ·4Vxg·-৖V

payload bytes

00000000  01 4f 8e d9 8f d4 7f a3  ae 00 ff ff 00 fe fe fe  |.O..............|
00000010  fe fd fd fd fd 12 34 56  78 67 a6 15 2d e0 a7 96  |......4Vxg..-...|
00000020  56                                                |V|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SNMPv2	161/udp	2	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS3741 Dimension Data from 1 source2
AS37680 Cool Ideas Service Provider (Pty) Ltd from 1 source2
AS37457 Telkom SA Ltd. from 1 source1
AS328760 ZTEL PTY LTD from 1 source1
AS329126 IIP1 Pty Ltd from 1 source1

Countries

ZA South Africa7

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
196.34.146.69	AS3741 Dimension Data	ZA	SNMP	2	2026-10-11 01:30
102.132.178.204	AS37680 Cool Ideas Service Provider (Pty) Ltd	ZA	Unrecognised	2	2026-10-10 22:24
105.185.158.222	AS37457 Telkom SA Ltd.	ZA	Unrecognised	1	2026-10-10 10:20
102.221.250.175	AS328760 ZTEL PTY LTD	ZA	SOCKS5	1	2026-10-10 07:39
102.206.95.152	AS329126 IIP1 Pty Ltd	ZA	Unrecognised	1	2026-10-10 08:07

Latest datagrams

2026-10-11 01:30:11196.34.146.69to 161/udpSNMPZA

0)·public·8D·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 44 8d ea 02 01 00  02 01 00 30 0e 30 0c 06  |.8D........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-10 23:38:51196.34.146.69to 161/udpSNMPZA

0)·public·8@·0·0·+·

payload bytes

00000000  30 29 02 01 00 04 06 70  75 62 6c 69 63 a0 1c 02  |0).....public...|
00000010  04 38 40 04 fa 02 01 00  02 01 00 30 0e 30 0c 06  |.8@........0.0..|
00000020  08 2b 06 01 02 01 01 01  00 05 00                 |.+.........|

2026-10-10 22:24:53102.132.178.204to 40650/udpUnrecognisedZA

·O·ُ·4Vxg·-৖V

payload bytes

00000000  01 4f 8e d9 8f d4 7f a3  ae 00 ff ff 00 fe fe fe  |.O..............|
00000010  fe fd fd fd fd 12 34 56  78 67 a6 15 2d e0 a7 96  |......4Vxg..-...|
00000020  56                                                |V|

2026-10-10 10:20:42105.185.158.222to 53859/udpUnrecognisedZA

·"W·E·b·4VxW·_y·

payload bytes

00000000  01 ce 22 57 fb ec 45 8c  62 00 ff ff 00 fe fe fe  |.."W..E.b.......|
00000010  fe fd fd fd fd 12 34 56  78 57 f1 a0 b7 5f 79 d9  |......4VxW..._y.|
00000020  c4                                                |.|

2026-10-10 10:04:39102.132.178.204to 32152/udpUnrecognisedZA

·-·k·4Vx\$·%·f

payload bytes

00000000  01 13 7f 2d e2 6b 14 ab  9e 00 ff ff 00 fe fe fe  |...-.k..........|
00000010  fe fd fd fd fd 12 34 56  78 5c 24 e0 25 f0 90 02  |......4Vx\$.%...|
00000020  66                                                |f|

2026-10-10 08:07:42102.206.95.152to 47097/udpUnrecognisedZA

·k㖜n·`·Y·,·#1·ʰSX·6·}·y·K·H·T·^·$x·]4a8v·#·#VQ)·V76·҂h}k_!·ƿ·G·8·`-$r·)·X·t·r·o·

payload bytes

00000000  91 c3 c6 1f f5 6b e3 96  9c 6e 07 c9 60 c8 f3 05  |.....k...n..`...|
00000010  04 59 00 2c b2 23 31 a1  86 ca b0 53 58 b8 9b c8  |.Y.,.#1....SX...|
00000020  36 10 7d e6 f8 93 79 ce  4b 94 48 1b 02 b6 04 0e  |6.}...y.K.H.....|
00000030  54 eb f6 00 e1 5e 12 02  24 78 a7 5d 34 61 38 76  |T....^..$x.]4a8v|
00000040  ec 88 23 c1 7f 23 56 51  29 17 56 37 36 e1 d2 82  |..#..#VQ).V76...|
00000050  68 7d 6b 5f 21 e0 c6 bf  af 47 ae 38 dd ca 60 2d  |h}k_!....G.8..`-|
00000060  24 72 e4 29 d1 58 ab a1  74 e0 72 eb e5 e9 6f c0  |$r.).X..t.r...o.|
00000070  9e d6 10 ca dd 72 86 31  d9 45 8b 4d 4c ad 14 f2  |.....r.1.E.ML...|
00000080  b6 31 fc be 2e ac ee bc  e7 93 5c ab 0d 35 75 fc  |.1........\..5u.|
00000090  b4 da 5b a3 2d 9d 1d 6a  22 f8 91 25 c0 7c 19 70  |..[.-..j"..%.|.p|
000000a0  0d 86 ea 0d 68 86 98 8b  d1 2f 62 21 41 a8 26 9a  |....h..../b!A.&.|
000000b0  e6 8f a5 c3 3c fa 41 8c  c2 50 6d bc ae 83 a6 13  |....<.A..Pm.....|
000000c0  83 e4 93 fc 37 71 80 7f  45 d5 bd a9 2f 88 21 8e  |....7q..E.../.!.|
000000d0  94 d2 f5 ed d4 0f 80 91  5c f7 d0 d6 59 7d 32 54  |........\...Y}2T|
000000e0  39 64 10 17 a0 37 7f 86  24 5a 44 d7 20 2d 5b 10  |9d...7..$ZD. -[.|
000000f0  be b2 fe 84 b6 57 43 fb  80 a7 23 0e 49 b9 d8 c7  |.....WC...#.I...|
... 512 bytes shown in part

2026-10-10 07:39:37102.221.250.175to 26944/udpSOCKS5ZA

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part