UDP traffic
Datagrams matching port:11211 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
Your plan searches up to 7d, so 30d was shortened. Plans
142
Datagrams
79
Source addresses
39
Networks
17
Countries
1
Destination ports
Traffic by type
Unrecognised
142 datagrams from 79 sourcesDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 11211/udp
payload bytes
00000000 00 01 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| Memcached | 11211/udp | 142 | 79 | 10,000 to 51,000 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Destination ports
- 11211/udp Memcached142
Networks
- AS209588 Flyservers S.A. from 1 source25
- AS6939 Hurricane Electric LLC from 21 sources22
- AS20052 Arbor Networks, Inc. from 5 sources8
- AS51115 HLL LLC from 1 source8
- AS213412 ONYPHE SAS from 4 sources6
- AS34984 Superonline Iletisim Hizmetleri A.S. from 1 source6
- AS63949 Akamai Connected Cloud from 2 sources5
- AS14618 Amazon.com, Inc. from 4 sources4
- AS198545 Flex Network Sarl from 1 source4
- AS150968 PT Jaringanku Media Telekomunikasi from 1 source4
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 141.98.83.48 | AS209588 Flyservers S.A. | PA | Unrecognised | 25 | 2026-10-11 04:17 |
| 185.94.111.1 | AS51115 HLL LLC | RU | Unrecognised | 8 | 2026-10-09 03:14 |
| 195.33.200.58 | AS34984 Superonline Iletisim Hizmetleri A.S. | TR | Unrecognised | 6 | 2026-10-10 03:44 |
| 50.116.25.179 | AS63949 Akamai Connected Cloud | US | Unrecognised | 4 | 2026-10-08 22:20 |
| 45.205.1.148 | AS215925 Vpsvault.host Ltd | BR | Unrecognised | 4 | 2026-10-10 02:23 |
| 103.123.175.6 | AS150968 PT Jaringanku Media Telekomunikasi | ID | Unrecognised | 4 | 2026-10-10 22:57 |
| 217.71.127.125 | AS198545 Flex Network Sarl | FR | Unrecognised | 4 | 2026-10-10 23:07 |
| 147.203.255.20 | AS11320 LightEdge Solutions | US | Unrecognised | 3 | 2026-10-11 01:39 |
| 94.154.43.251 | AS219502 Storm Industries LLC | NL | Unrecognised | 3 | 2026-10-06 16:42 |
| 185.191.236.38 | AS264617 GRUPO PANAGLOBAL 15 S.A | CH | Unrecognised | 3 | 2026-10-10 21:12 |
| 91.230.168.219 | AS213412 ONYPHE SAS | US | Unrecognised | 2 | 2026-10-10 16:19 |
| 146.88.241.60 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-10 06:56 |
| 91.231.89.91 | AS213412 ONYPHE SAS | FR | Unrecognised | 2 | 2026-10-10 16:34 |
| 146.88.241.160 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-10 05:06 |
| 174.138.216.234 | AS11814 Distributel Communications Limited | CA | Unrecognised | 2 | 2026-10-10 19:44 |
| 146.88.241.140 | AS20052 Arbor Networks, Inc. | US | Unrecognised | 2 | 2026-10-07 09:48 |
| 38.99.239.208 | AS398991 X99 | US | Unrecognised | 2 | 2026-10-11 03:32 |
| 62.210.89.150 | AS12876 Scaleway SAS | FR | Unrecognised | 2 | 2026-10-08 20:25 |
| 64.62.156.17 | AS6939 Hurricane Electric LLC | US | Unrecognised | 2 | 2026-10-08 04:28 |
| 64.62.197.113 | AS6939 Hurricane Electric LLC | US | Unrecognised | 1 | 2026-10-06 05:01 |
Latest datagrams
payload bytes
00000000 00 01 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 01 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 01 00 00 00 01 00 00 73 74 61 74 73 0d 0a |........stats..|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0a |........stats.|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0a |........stats.|
payload bytes
00000000 7e 2e 0f 48 33 43 06 6f 2f 62 01 27 42 2c d0 93 |~..H3C.o/b.'B,..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 0d 0a |ZM......stats..|
payload bytes
00000000 00 00 00 00 00 01 00 00 73 74 61 74 73 0a |........stats.|
payload bytes
00000000 45 2e 25 27 78 2a 0e 4c 21 2e 2d 27 18 3d 37 16 |E.%'x*.L!.-'.=7.| 00000010 05 79 0b 58 62 42 4f 1e 5d 77 1c 63 08 5c 79 4d |.y.XbBO.]w.c.\yM| 00000020 55 1f 4d 36 |U.M6|
payload bytes
00000000 44 2e 7b 6d 4d 47 72 1e 1c 6b 5f 36 7a 0d 0e 38 |D.{mMGr..k_6z..8| 00000010 2c 6d 19 06 52 42 20 |,m..RB |payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 20 69 74 |ZM......stats it| 00000010 65 6d 73 0d 0a |ems..|
payload bytes
00000000 5a 4d 00 00 00 01 00 00 73 74 61 74 73 20 69 74 |ZM......stats it| 00000010 65 6d 73 0d 0a |ems..|
payload bytes
00000000 5e 2e 0e 27 34 70 48 3c 1e 74 37 04 19 75 72 25 |^..'4pH<.t7..ur%| 00000010 5f 4a 10 20 34 3b 3d 24 38 3a 00 56 0e 71 3c 6c |_J. 4;=$8:.V.q<l| 00000020 10 4a 14 44 3a 5c 00 58 50 37 5c 69 2c 4e 0f 0c |.J.D:\.XP7\i,N..| 00000030 19 1f 2c 4d 5a 69 71 12 23 71 69 32 62 25 1e 72 |..,MZiq.#qi2b%.r| 00000040 6f 32 37 29 0f 37 01 5f 6f 5d 49 1b 2c 58 27 45 |o27).7._o]I.,X'E| 00000050 77 53 12 51 ec 31 |wS.Q.1|