UDP traffic

Datagrams matching port:137 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

310

Datagrams

156

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

301 datagrams from 156 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 301

Latest NetBIOS datagram, to 137/udp

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Unrecognised

9 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 9

Latest Unrecognised datagram, to 137/udp

·0·0·000000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA00!0·

payload bytes

00000000  01 91 30 10 30 01 30 30  30 30 30 30 20 43 4b 41  |..0.0.000000 CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 30 30 21  |AAAAAAAAAAAAA00!|
00000030  30 01                                             |0.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	137/udp	310	156	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

137/udp NetBIOS310

Networks

AS215925 Vpsvault.host Ltd from 2 sources38
AS8075 Microsoft Corporation from 25 sources25
AS6939 Hurricane Electric LLC from 22 sources23
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT from 4 sources23
AS396982 Google LLC from 23 sources23
AS12876 Scaleway SAS from 1 source23
AS20052 Arbor Networks, Inc. from 10 sources13
AS209630 LLC Vash Kredit Bank from 1 source12
AS14061 DigitalOcean, LLC from 3 sources12
AS398324 Censys, Inc. from 10 sources11

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
62.210.90.215	AS12876 Scaleway SAS	FR	NetBIOS	23	2026-10-11 00:37
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	NetBIOS	19	2026-10-10 23:21
45.198.224.251	AS215925 Vpsvault.host Ltd	US	NetBIOS	19	2026-10-10 17:05
165.154.164.21	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	DE	NetBIOS	13	2026-10-08 08:08
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	NetBIOS	12	2026-10-10 04:50
185.94.111.1	AS51115 HLL LLC	RU	NetBIOS	9	2026-10-11 04:00
16.5.0.234	AS401661 EMBNEX, LLC	BR	NetBIOS	9	2026-10-05 15:55
190.108.42.138	AS52308 AGUAS DEL COLORADO SAPEM	AR	NetBIOS	9	2026-10-05 20:39
185.191.236.38	AS264617 GRUPO PANAGLOBAL 15 S.A	CH	NetBIOS	6	2026-10-10 22:16
165.154.36.245	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	NetBIOS	5	2026-10-08 08:29
185.36.81.23	AS209605 UAB Host Baltic	LT	NetBIOS	5	2026-10-09 02:13
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	4	2026-10-09 17:23
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	4	2026-10-05 13:50
185.242.226.166	AS202425 IP Volume inc	US	NetBIOS	4	2026-10-08 12:50
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	4	2026-10-07 00:19
172.104.233.204	AS63949 Akamai Connected Cloud	DE	NetBIOS	4	2026-10-06 07:39
178.44.106.19	AS12389 Rostelecom	RU	NetBIOS	3	2026-10-09 05:36
71.6.232.20	AS10439 CariNet, Inc.	US	NetBIOS	3	2026-10-07 09:01
152.32.156.136	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	IN	NetBIOS	3	2026-10-08 08:06
117.104.10.130	AS10010 TOKAI Communications Corporation	JP	NetBIOS	3	2026-10-10 12:35

Latest datagrams

2026-10-11 09:00:0366.132.186.216to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:57:0720.80.93.110to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:56:47134.33.65.102to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:54:2220.55.81.197to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:52:4520.64.97.174to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:44:53146.88.241.30to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 07:31:2780.94.92.15to 137/udpNetBIOSRO

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 04:42:49146.88.241.20to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 04:00:58185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  d2 a8 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:25:53185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  f9 74 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.t.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 03:06:21185.94.111.1to 137/udpNetBIOSRU

NetBIOS node status query *

payload bytes

00000000  21 4d 01 00 00 01 00 00  00 00 00 00 20 43 4b 41  |!M.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 02:55:2964.62.156.32to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  38 f6 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |8........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 02:44:4865.49.1.27to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  38 f6 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |8........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 02:39:5965.49.1.36to 137/udpNetBIOSUS

NetBIOS node status query *

payload bytes

00000000  38 f6 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |8........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-11 00:37:3462.210.90.215to 137/udpNetBIOSFR

NetBIOS node status query *

payload bytes

00000000  52 17 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |R........... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|