UDP traffic

Datagrams matching port:4000 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

Redis 1

Latest Redis datagram, to 4000/udp

*.}kd`M=\6U.B

payload bytes

00000000  2a 2e 7d 6b 64 60 4d 3d  5c 36 55 2e 42           |*.}kd`M=\6U.B|

Unrecognised

46 datagrams from 31 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 46

Latest Unrecognised datagram, to 4000/udp

x.~!P!E<@Q{·smF@|(!y0`4·?RTL·*D5(e·J*A·

payload bytes

00000000  78 2e 7e 21 50 21 45 3c  40 51 7b 18 19 73 6d 46  |x.~!P!E<@Q{..smF|
00000010  40 7c 28 21 79 30 60 34  1e 3f 52 54 4c 16 2a 44  |@|(!y0`4.?RTL.*D|
00000020  35 28 65 05 4a 2a 41 f0  1b                       |5(e.J*A..|

Destination ports

4000/udp47

Networks

AS14061 DigitalOcean, LLC from 5 sources11
AS198545 Flex Network Sarl from 1 source4
AS51167 Contabo GmbH from 2 sources4
AS3320 Deutsche Telekom AG from 2 sources3
AS12876 Scaleway SAS from 1 source2
AS19994 Rackspace Hosting from 1 source2
AS15964 CAMTEL from 1 source2
AS28423 Truxgo S. de R.L de C.V from 1 source2
AS4134 Chinanet from 1 source1
AS11814 Distributel Communications Limited from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
217.71.127.125	AS198545 Flex Network Sarl	FR	Unrecognised	4	2026-10-10 16:35
134.199.209.2	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-08 11:24
159.203.67.164	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-09 22:30
169.58.11.22	AS51167 Contabo GmbH	FR	Unrecognised	2	2026-10-08 23:46
217.239.14.187	AS3320 Deutsche Telekom AG	DE	Unrecognised	2	2026-10-05 20:14
64.226.83.235	AS14061 DigitalOcean, LLC	DE	Unrecognised	2	2026-10-09 09:08
62.210.89.150	AS12876 Scaleway SAS	FR	Unrecognised	2	2026-10-10 21:54
137.184.226.118	AS14061 DigitalOcean, LLC	US	Unrecognised	2	2026-10-06 20:14
45.170.248.29	AS28423 Truxgo S. de R.L de C.V	MX	Unrecognised	2	2026-10-10 18:12
166.78.113.115	AS19994 Rackspace Hosting	US	Unrecognised	2	2026-10-06 13:45
195.24.207.184	AS15964 CAMTEL	CM	Unrecognised	2	2026-10-10 10:47
169.58.136.173	AS51167 Contabo GmbH	FR	Unrecognised	2	2026-10-07 09:09
176.123.5.126	AS200019 Alexhost Srl	MD	Unrecognised	1	2026-10-09 07:34
212.103.118.144	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	1	2026-10-09 07:35
107.174.181.21	AS36352 HostPapa	US	Unrecognised	1	2026-10-07 21:49
84.42.46.199	AS34267 Rostelecom	RU	Unrecognised	1	2026-10-09 03:48
217.160.190.176	AS8560 IONOS SE	DE	Unrecognised	1	2026-10-11 03:55
78.107.31.154	AS8402 PVimpelCom	RU	Unrecognised	1	2026-10-07 18:28
84.247.157.60	AS141995 Contabo Asia Private Limited	JP	Unrecognised	1	2026-10-09 16:02
91.200.217.81	AS44027 Spitamen Alexander Internet LLC.	TJ	Unrecognised	1	2026-10-09 10:02

Latest datagrams

2026-10-11 03:55:27217.160.190.176to 4000/udpUnrecognisedDE

x.~!P!E<@Q{·smF@|(!y0`4·?RTL·*D5(e·J*A·

payload bytes

00000000  78 2e 7e 21 50 21 45 3c  40 51 7b 18 19 73 6d 46  |x.~!P!E<@Q{..smF|
00000010  40 7c 28 21 79 30 60 34  1e 3f 52 54 4c 16 2a 44  |@|(!y0`4.?RTL.*D|
00000020  35 28 65 05 4a 2a 41 f0  1b                       |5(e.J*A..|

2026-10-11 01:28:51116.30.9.218to 4000/udpUnrecognisedCN

z./D?oT·w7hw-·C·)·>z|·m^_C%-·RNd·=8·Y·

payload bytes

00000000  7a 2e 2f 44 3f 6f 54 01  1b 77 37 68 77 2d 7f 43  |z./D?oT..w7hw-.C|
00000010  13 0b 29 01 3e 7a 7c 12  6d 5e 5f 43 25 2d 1f 1f  |..).>z|.m^_C%-..|
00000020  52 4e 64 11 3d 38 12 59  ab 8d                    |RNd.=8.Y..|

2026-10-10 21:54:4662.210.89.150to 4000/udpUnrecognisedFR

v.·>·xZ·dD4fC:\ rH·l·Mo·iD·fe·a~@cv·r[_&A"a·0j·xq{·xIo·24·z·

payload bytes

00000000  76 2e 19 3e 02 78 5a 0f  64 44 34 66 43 3a 5c 0d  |v..>.xZ.dD4fC:\.|
00000010  09 72 48 07 6c 07 07 4d  6f 0e 69 44 0b 66 65 02  |.rH.l..Mo.iD.fe.|
00000020  61 7e 40 63 76 1b 72 5b  5f 26 41 22 61 1d 30 6a  |a~@cv.r[_&A"a.0j|
00000030  0f 78 71 7b 00 78 49 6f  06 32 34 12 19 19 14 7a  |.xq{.xIo.24....z|
00000040  fa d1                                             |..|

2026-10-10 18:12:1845.170.248.29to 4000/udpUnrecognisedMX

^.x6|o·O·x:^L·mR.b·A#`*p']-·%;·Ue·t^NR*\k,{X~*;·k^u·N·r{"· ]"43·G'f·z·re<m>:·yO·WD·%a ·%

payload bytes

00000000  5e 2e 78 36 7c 6f 1a 4f  7f 1f 78 3a 5e 4c 0e 19  |^.x6|o.O..x:^L..|
00000010  02 1f 6d 52 2e 62 16 41  23 60 2a 70 27 5d 2d 05  |..mR.b.A#`*p']-.|
00000020  1a 25 3b 16 14 55 65 13  74 5e 4e 52 2a 5c 6b 2c  |.%;..Ue.t^NR*\k,|
00000030  7b 58 7e 2a 3b 15 6b 5e  75 15 4e 1c 72 7b 22 0c  |{X~*;.k^u.N.r{".|
00000040  20 5d 22 34 33 08 47 27  66 15 7a 10 72 65 3c 6d  | ]"43.G'f.z.re<m|
00000050  3e 3a 17 79 4f 02 57 44  18 25 61 0a 20 a0 25     |>:.yO.WD.%a. .%|

2026-10-10 16:35:28217.71.127.125to 4000/udpRedisFR
*.}kd`M=\6U.B
payload bytes
```
00000000  2a 2e 7d 6b 64 60 4d 3d  5c 36 55 2e 42           |*.}kd`M=\6U.B|
```

2026-10-10 13:37:33141.11.209.245to 4000/udpUnrecognisedNL

·.·:I?$qN*·ed^·l·6·v}kB·F9·g·$ ) 0ciok2

payload bytes

00000000  12 2e 10 3a 49 3f 24 71  4e 2a 0f 65 64 5e 0e 6c  |...:I?$qN*.ed^.l|
00000010  0b 36 0e 76 7d 6b 42 1d  46 39 16 67 17 24 20 29  |.6.v}kB.F9.g.$ )|
00000020  20 30 63 69 6f 6b 32                              | 0ciok2|

2026-10-10 10:47:36195.24.207.184to 4000/udpUnrecognisedCM

·.M·z^·^5-·-m·&·>·%·B·8&A EV?=#[B·9F|ns· !F·_G*·bl"·c·9

payload bytes

00000000  1f 2e 4d 1b 04 7a 5e 04  5e 35 2d 1f 1e 2d 6d 14  |..M..z^.^5-..-m.|
00000010  26 13 3e 00 0e 25 1b 42  1d 38 26 41 20 45 56 3f  |&.>..%.B.8&A EV?|
00000020  3d 23 5b 42 1e 39 46 7c  6e 73 1c 0c 20 09 21 46  |=#[B.9F|ns.. .!F|
00000030  1c 5f 47 2a 04 62 6c 22  1a 12 63 99 39           |._G*.bl"..c.9|

2026-10-10 10:18:35115.63.190.167to 4000/udpUnrecognisedCN

·.· Nc·rfMm? 6coy Ynk·246 w·E·`·iarrSX?@·`wzOp·(^r7·'n·c"·C\%

payload bytes

00000000  1a 2e 0c 09 4e 63 08 72  66 4d 6d 3f 20 36 63 6f  |....Nc.rfMm? 6co|
00000010  79 0d 59 6e 6b 0f 32 34  36 0d 77 1a 45 04 02 60  |y.Ynk.246.w.E..`|
00000020  13 0e 69 61 72 72 53 58  3f 40 17 60 77 7a 4f 70  |..iarrSX?@.`wzOp|
00000030  07 28 5e 72 37 10 27 6e  1e 1e 08 63 22 0b 43 5c  |.(^r7.'n...c".C\|
00000040  25                                                |%|

2026-10-09 22:30:37159.203.67.164to 4000/udpUnrecognisedUS

4.E`n:]69S@·k\·}wLSdsIN·^ XA>_

payload bytes

00000000  34 2e 45 60 6e 3a 5d 36  39 53 40 16 6b 5c 05 7d  |4.E`n:]69S@.k\.}|
00000010  77 4c 53 64 73 49 4e 18  5e 09 58 41 3e 5f        |wLSdsIN.^.XA>_|

2026-10-09 22:20:33103.123.175.6to 4000/udpUnrecognisedID

j.8/·;[x·|Z]·+CX=]·y0;·(6t$ >\O>·+6''·-/0p·mN f~H· S"2 ·V·

payload bytes

00000000  6a 2e 38 2f 00 3b 5b 78  10 7c 5a 5d 05 1e 2b 43  |j.8/.;[x.|Z]..+C|
00000010  58 3d 5d 06 79 30 3b 1c  0c 0b 1f 28 36 74 24 20  |X=].y0;....(6t$ |
00000020  3e 5c 4f 3e 17 2b 36 27  27 10 04 2d 2f 30 70 07  |>\O>.+6''..-/0p.|
00000030  6d 4e 0d 66 7e 48 03 0a  53 22 32 09 16 56 a3 a2  |mN.f~H..S"2..V..|

2026-10-09 22:05:56212.23.217.3to 4000/udpUnrecognisedAE

1.·veS·DX·O?·~6NBE·Ms3n·NJF·i<l<Q·URG.Q·mo·#=Vh=#[p·a|&·(

payload bytes

00000000  31 2e 1f 76 65 53 15 16  19 01 44 58 7f 4f 3f 1d  |1..veS....DX.O?.|
00000010  7e 36 4e 42 45 7f 4d 73  33 6e 06 0c 14 4e 4a 46  |~6NBE.Ms3n...NJF|
00000020  07 69 3c 6c 3c 51 02 55  52 47 2e 51 16 6d 6f 14  |.i<l<Q.URG.Q.mo.|
00000030  23 3d 56 68 3d 23 5b 70  11 61 7c 26 92 28        |#=Vh=#[p.a|&.(|

2026-10-09 19:28:2714.225.217.73to 4000/udpUnrecognisedVN

·.EY·#_~!9 M·\lX!%:$t8·+ZFJ·2W·I·

payload bytes

00000000  08 2e 45 59 1b 23 5f 7e  21 39 20 4d 17 5c 6c 58  |..EY.#_~!9 M.\lX|
00000010  21 25 3a 24 74 38 02 2b  5a 46 4a 11 03 32 57 0b  |!%:$t8.+ZFJ..2W.|
00000020  49 ae b5                                          |I..|

2026-10-09 16:02:2884.247.157.60to 4000/udpUnrecognisedJP

>.Mwh64y"6an·-}·y1· zY·uF,·j_YaG·@·

payload bytes

00000000  3e 2e 4d 77 68 36 34 79  22 36 61 6e 17 2d 7d 05  |>.Mwh64y"6an.-}.|
00000010  79 31 16 14 0d 7a 59 0e  12 04 75 46 2c 00 0c 6a  |y1...zY...uF,..j|
00000020  5f 59 61 47 0f 16 40 11  97                       |_YaG..@..|

2026-10-09 10:10:38195.85.207.31to 4000/udpUnrecognisedTR

·.B1D>·3!1Td·Ipbx4<^rG5Q·[u'·{*T,o·7 ~{

payload bytes

00000000  06 2e 42 31 44 3e 0b 1a  7f 33 21 31 54 64 0c 49  |..B1D>...3!1Td.I|
00000010  70 62 78 34 3c 5e 72 47  35 51 1e 5b 75 27 11 7b  |pbx4<^rG5Q.[u'.{|
00000020  2a 54 2c 6f 12 37 09 7e  7b                       |*T,o.7.~{|

2026-10-09 10:02:5391.200.217.81to 4000/udpUnrecognisedTJ

`.·G$2>·tE2<$;5ka;T_Eq'<.I·J·hc<0·on·c3=·WyUBZ·:V·a·6*0L3zi·]%Kd·9pxm-·D&l·}·;S·

payload bytes

00000000  60 2e 1f 47 24 32 3e 04  74 45 32 3c 24 3b 35 6b  |`..G$2>.tE2<$;5k|
00000010  61 3b 54 5f 45 71 27 3c  2e 49 1d 16 08 4a 1d 68  |a;T_Eq'<.I...J.h|
00000020  63 3c 30 07 6f 6e 0b 63  33 3d 1f 57 79 55 42 5a  |c<0.on.c3=.WyUBZ|
00000030  10 17 3a 56 08 61 12 36  2a 30 4c 33 7a 69 1b 5d  |..:V.a.6*0L3zi.]|
00000040  25 4b 64 14 39 70 78 6d  2d 17 44 26 6c 07 01 7d  |%Kd.9pxm-.D&l..}|
00000050  1e 3b 53 9a a4                                    |.;S..|