UDP traffic

Datagrams matching port:135 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

4 datagrams from 4 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 4

Latest NetBIOS datagram, to 135/udp

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Unrecognised

5 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 5

Latest Unrecognised datagram, to 135/udp

·0·000H000·000·0000·00000·0·#Eg·#Eg·00·ܺ·vT2·#Eg·00

payload bytes

00000000  05 30 0b 03 10 30 30 30  48 30 30 30 01 30 30 30  |.0...000H000.000|
00000010  b8 10 b8 10 30 30 30 30  01 30 30 30 30 30 01 30  |....0000.00000.0|
00000020  01 23 45 67 89 ab cd ef  01 23 45 67 89 ab cd ef  |.#Eg.....#Eg....|
00000030  e7 03 30 30 fe dc ba 98  76 54 32 10 01 23 45 67  |..00....vT2..#Eg|
00000040  89 ab cd ef e7 03 30 30                           |......00|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	135/udp	4	4	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

135/udp9

Networks

AS14061 DigitalOcean, LLC from 3 sources5
AS396982 Google LLC from 4 sources4

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	2	2026-10-09 17:23
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	2	2026-10-05 13:50
162.216.150.164	AS396982 Google LLC	US	NetBIOS	1	2026-10-09 19:09
147.185.132.128	AS396982 Google LLC	US	NetBIOS	1	2026-10-10 04:02
35.203.210.208	AS396982 Google LLC	GB	NetBIOS	1	2026-10-07 23:37
216.25.89.67	AS396982 Google LLC	US	NetBIOS	1	2026-10-08 19:27
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	1	2026-10-07 00:19

Latest datagrams

2026-10-10 04:02:48147.185.132.128to 135/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-09 19:09:27162.216.150.164to 135/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-09 17:23:55157.230.83.56to 135/udpUnrecognisedUS

·0·000H000·000·0000·00000·0·#Eg·#Eg·00·ܺ·vT2·#Eg·00

payload bytes

00000000  05 30 0b 03 10 30 30 30  48 30 30 30 01 30 30 30  |.0...000H000.000|
00000010  b8 10 b8 10 30 30 30 30  01 30 30 30 30 30 01 30  |....0000.00000.0|
00000020  01 23 45 67 89 ab cd ef  01 23 45 67 89 ab cd ef  |.#Eg.....#Eg....|
00000030  e7 03 30 30 fe dc ba 98  76 54 32 10 01 23 45 67  |..00....vT2..#Eg|
00000040  89 ab cd ef e7 03 30 30                           |......00|

2026-10-09 17:23:40157.230.83.56to 135/udpUnrecognisedUS
00·000000000
payload bytes
```
00000000  30 30 10 30 30 30 30 30  30 30 30 30              |00.000000000|
```

2026-10-08 19:27:38216.25.89.67to 135/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-07 23:37:2935.203.210.208to 135/udpNetBIOSGB

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-07 00:19:16206.189.14.75to 135/udpUnrecognisedNL

·0·000H000·000·0000·00000·0·#Eg·#Eg·00·ܺ·vT2·#Eg·00

payload bytes

00000000  05 30 0b 03 10 30 30 30  48 30 30 30 01 30 30 30  |.0...000H000.000|
00000010  b8 10 b8 10 30 30 30 30  01 30 30 30 30 30 01 30  |....0000.00000.0|
00000020  01 23 45 67 89 ab cd ef  01 23 45 67 89 ab cd ef  |.#Eg.....#Eg....|
00000030  e7 03 30 30 fe dc ba 98  76 54 32 10 01 23 45 67  |..00....vT2..#Eg|
00000040  89 ab cd ef e7 03 30 30                           |......00|

2026-10-05 13:50:13137.184.210.250to 135/udpUnrecognisedUS

·0·000H000·000·0000·00000·0·#Eg·#Eg·00·ܺ·vT2·#Eg·00

payload bytes

00000000  05 30 0b 03 10 30 30 30  48 30 30 30 01 30 30 30  |.0...000H000.000|
00000010  b8 10 b8 10 30 30 30 30  01 30 30 30 30 30 01 30  |....0000.00000.0|
00000020  01 23 45 67 89 ab cd ef  01 23 45 67 89 ab cd ef  |.#Eg.....#Eg....|
00000030  e7 03 30 30 fe dc ba 98  76 54 32 10 01 23 45 67  |..00....vT2..#Eg|
00000040  89 ab cd ef e7 03 30 30                           |......00|

2026-10-05 13:49:57137.184.210.250to 135/udpUnrecognisedUS
00·000000000
payload bytes
```
00000000  30 30 10 30 30 30 30 30  30 30 30 30              |00.000000000|
```