UDP traffic
Datagrams matching port:11211 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
136
Datagrams
77
Source addresses
39
Networks
17
Countries
1
Destination ports
Traffic by type
Unrecognised
136 datagrams from 77 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 11211/udp
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| Memcached | 11211/udp | 136 | 77 | 10,000 to 51,000 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
- 11211/udp Memcached136
Networks
- AS209588 Flyservers S.A. from 1 source22
- AS6939 Hurricane Electric LLC from 19 sources20
- AS20052 Arbor Networks, Inc. from 5 sources8
- AS51115 HLL LLC from 1 source8
- AS34984 Superonline Iletisim Hizmetleri A.S. from 1 source6
- AS213412 ONYPHE SAS from 4 sources6
- AS63949 Akamai Connected Cloud from 2 sources5
- AS150968 PT Jaringanku Media Telekomunikasi from 1 source4
- AS14618 Amazon.com, Inc. from 4 sources4
- AS198545 Flex Network Sarl from 1 source4
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 141.98.83.48 | AS209588 Flyservers S.A. | PA | Unrecognised | 22 | 2026-10-10 04:17 |
| 185.94.111.1 | AS51115 HLL LLC | RU | Unrecognised | 8 | 2026-10-09 03:14 |
| 195.33.200.58 | AS34984 Superonline Iletisim Hizmetleri A.S. | TR | Unrecognised | 6 | 2026-10-10 03:44 |
| 217.71.127.125 | AS198545 Flex Network Sarl | FR | Unrecognised | 4 | 2026-10-10 23:07 |
| 50.116.25.179 | AS63949 Akamai Connected Cloud | US | Unrecognised | 4 | 2026-10-08 22:20 |
| 45.205.1.148 | AS215925 Vpsvault.host Ltd | BR | Unrecognised | 4 | 2026-10-10 02:23 |
| 103.123.175.6 | AS150968 PT Jaringanku Media Telekomunikasi | ID | Unrecognised | 4 | 2026-10-10 22:57 |
| 94.154.43.251 | AS219502 Storm Industries LLC | NL | Unrecognised | 3 | 2026-10-06 16:42 |
| 147.203.255.20 | AS11320 LightEdge Solutions | US | Unrecognised | 3 | 2026-10-11 01:39 |
| 185.191.236.38 | AS264617 GRUPO PANAGLOBAL 15 S.A | CH | Unrecognised | 3 | 2026-10-10 21:12 |
| 91.230.168.219 | AS213412 ONYPHE SAS | US | Unrecognised | 2 | 2026-10-10 16:19 |
| 146.88.241.60 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-10 06:56 |
| 91.231.89.91 | AS213412 ONYPHE SAS | FR | Unrecognised | 2 | 2026-10-10 16:34 |
| 146.88.241.160 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-10 05:06 |
| 174.138.216.234 | AS11814 Distributel Communications Limited | CA | Unrecognised | 2 | 2026-10-10 19:44 |
| 146.88.241.140 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-07 09:48 |
| 62.210.89.150 | AS12876 Scaleway SAS | FR | Unrecognised | 2 | 2026-10-08 20:25 |
| 64.62.156.17 | AS6939 Hurricane Electric LLC | US | Unrecognised | 2 | 2026-10-08 04:28 |
| 64.62.197.113 | AS6939 Hurricane Electric LLC | US | Unrecognised | 1 | 2026-10-06 05:01 |
| 38.99.239.208 | AS398991 X99 | US | Unrecognised | 1 | 2026-10-07 04:31 |
Latest datagrams
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0a |........stats.|
payload bytes
00000000 45 2e 25 27 78 2a 0e 4c 21 2e 2d 27 18 3d 37 16 |E.%'x*.L!.-'.=7.| 00000010 05 79 0b 58 62 42 4f 1e 5d 77 1c 63 08 5c 79 4d |.y.XbBO.]w.c.\yM| 00000020 55 1f 4d 36 |U.M6|
payload bytes
00000000 44 2e 7b 6d 4d 47 72 1e 1c 6b 5f 36 7a 0d 0e 38 |D.{mMGr..k_6z..8| 00000010 2c 6d 19 06 52 42 20 |,m..RB |payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 20 69 74 |ZM......stats it| 00000010 65 6d 73 0d 0a |ems..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 20 69 74 |ZM......stats it| 00000010 65 6d 73 0d 0a |ems..|
payload bytes
00000000 5e 2e 0e 27 34 70 48 3c 1e 74 37 04 19 75 72 25 |^..'4pH<.t7..ur%| 00000010 5f 4a 10 20 34 3b 3d 24 38 3a 00 56 0e 71 3c 6c |_J. 4;=$8:.V.q<l| 00000020 10 4a 14 44 3a 5c 00 58 50 37 5c 69 2c 4e 0f 0c |.J.D:\.XP7\i,N..| 00000030 19 1f 2c 4d 5a 69 71 12 23 71 69 32 62 25 1e 72 |..,MZiq.#qi2b%.r| 00000040 6f 32 37 29 0f 37 01 5f 6f 5d 49 1b 2c 58 27 45 |o27).7._o]I.,X'E| 00000050 77 53 12 51 ec 31 |wS.Q.1|
payload bytes
00000000 00 01 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 3b 2e 36 4a 18 64 3d 7a 3d 1a 78 04 64 12 27 04 |;.6J.d=z=.x.d.'.| 00000010 68 25 43 59 7e 2d 08 5f 4b 67 0a 25 6a 5d 01 25 |h%CY~-._Kg.%j].%| 00000020 5a 37 6f 72 1b 2c 6c 59 46 65 5d 2a 77 04 2e 60 |Z7or.,lYFe]*w..`| 00000030 29 72 39 28 1f 42 07 6a 29 11 0f 13 6e 10 38 48 |)r9(.B.j)...n.8H| 00000040 47 27 d9 b8 |G'..|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 03 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 06 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|