UDP traffic

Datagrams matching port:17185 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

17 datagrams from 13 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 17

Latest DNS datagram, to 17185/udp

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

Unrecognised

79 datagrams from 72 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 79

Latest Unrecognised datagram, to 17185/udp

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	17185/udp	17	13	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

17185/udp96

Networks

AS396982 Google LLC from 39 sources39
AS398324 Censys, Inc. from 23 sources27
AS213412 ONYPHE SAS from 5 sources7
AS8075 Microsoft Corporation from 6 sources6
AS401661 EMBNEX, LLC from 1 source5
AS398722 Censys, Inc. from 4 sources4
AS63949 Akamai Connected Cloud from 1 source4
AS14061 DigitalOcean, LLC from 1 source3
AS45102 Alibaba (US) Technology Co., Ltd. from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
16.5.0.234	AS401661 EMBNEX, LLC	BR	DNS	5	2026-10-05 17:19
139.162.11.39	AS63949 Akamai Connected Cloud	SG	Unrecognised	4	2026-10-10 14:09
104.248.129.131	AS14061 DigitalOcean, LLC	DE	Unrecognised	3	2026-10-05 16:14
66.132.186.251	AS398324 Censys, Inc.	US	Unrecognised	2	2026-10-08 17:08
91.231.89.93	AS213412 ONYPHE SAS	FR	Unrecognised	2	2026-10-10 23:33
66.132.186.213	AS398324 Censys, Inc.	US	Unrecognised	2	2026-10-08 09:46
66.132.172.231	AS398324 Censys, Inc.	US	Unrecognised	2	2026-10-09 04:03
91.230.168.221	AS213412 ONYPHE SAS	US	Unrecognised	2	2026-10-10 23:17
66.132.186.253	AS398324 Censys, Inc.	US	Unrecognised	2	2026-10-09 01:17
198.235.24.12	AS396982 Google LLC	US	Unrecognised	1	2026-10-08 13:39
66.132.172.225	AS398324 Censys, Inc.	US	Unrecognised	1	2026-10-10 05:26
198.235.24.90	AS396982 Google LLC	US	Unrecognised	1	2026-10-06 21:03
147.185.132.22	AS396982 Google LLC	US	Unrecognised	1	2026-10-10 06:14
66.132.159.40	AS398324 Censys, Inc.	US	Unrecognised	1	2026-10-08 02:55
66.132.172.234	AS398324 Censys, Inc.	US	Unrecognised	1	2026-10-11 00:00
20.84.164.154	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-09 22:47
205.210.31.58	AS396982 Google LLC	US	DNS	1	2026-10-05 19:00
91.230.168.119	AS213412 ONYPHE SAS	US	Unrecognised	1	2026-10-08 05:10
198.235.24.211	AS396982 Google LLC	US	DNS	1	2026-10-06 03:33
20.83.164.132	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-07 07:59

Latest datagrams

2026-10-11 09:36:13198.235.24.174to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 07:19:1066.132.172.228to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:39:01198.235.24.53to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 03:13:4566.132.224.19to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 01:29:20205.210.31.199to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-11 00:00:0666.132.172.234to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 23:33:1191.231.89.93to 17185/udpUnrecognisedFR

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 23:17:5491.230.168.221to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 19:15:52198.235.24.92to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 14:17:36147.185.132.237to 17185/udpUnrecognisedUS

·UUUU·U·0·

payload bytes

00000000  00 00 00 00 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 13 00 00 00 30  |..........U....0|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 14:09:00139.162.11.39to 17185/udpUnrecognisedSG

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 13:37:1666.132.186.245to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 13:14:45139.162.11.39to 17185/udpUnrecognisedSG

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 13:00:13198.235.24.222to 17185/udpUnrecognisedUS

r7r7·UUUU·U·<·

payload bytes

00000000  72 37 72 37 00 00 00 00  00 00 00 02 55 55 55 55  |r7r7........UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 10 00 00 00 3c  |..........U....<|
00000030  00 00 00 03 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-10 11:00:3366.132.186.243to 17185/udpUnrecognisedUS

· ·UUUU·U·<·

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|