UDP traffic

Datagrams matching port:443 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

274

Datagrams

180

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

79 datagrams from 50 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 32 DTLS 24 GOOGLE 23

Latest SOCKS5 datagram, to 443/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

QUIC

83 datagrams from 65 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 83

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

112 datagrams from 78 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 112

Latest Unrecognised datagram, to 443/udp

8· |·

payload bytes

00000000  38 ca c5 d8 0a 7c ac cb  f0 00 00 00 00 00        |8....|........|

Destination ports

443/udp QUIC274

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 16 sources16
q13i0307h9_55b375c5d22e_2f871f65fa7d from 8 sources8
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 8 sources8
q13i0311h3_55b375c5d22e_c183556c78e2 from 4 sources8
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 8 sources8
q13i0308h3_55b375c5d22e_bc854dc9d3af from 8 sources8
q13i0310h3_55b375c5d22e_df5b9e597968 from 1 source4
q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 3 sources3

QUIC transport parameters

60647680e335 from 23 sources24
1f7a23748abd from 16 sources16
4c2cac1ef1cb from 8 sources8
12d07494ae7c from 4 sources8
94dccb934778 from 1 source4
5826be32c2d4 from 2 sources2
24dc672a03ab from 1 source1

QUIC versions

Networks

AS211298 Driftnet Ltd from 51 sources55
AS14061 DigitalOcean, LLC from 16 sources34
AS9009 M247 Europe SRL from 1 source23
AS45102 Alibaba (US) Technology Co., Ltd. from 8 sources18
AS54290 Hostwinds LLC. from 2 sources16
AS398324 Censys, Inc. from 9 sources10
AS8075 Microsoft Corporation from 9 sources9
AS12816 Leibniz-Rechenzentrum from 2 sources8
AS28573 Claro NXT Telecomunicacoes Ltda from 7 sources8
AS213412 ONYPHE SAS from 6 sources8

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	23	2026-10-10 22:30
104.168.132.113	AS54290 Hostwinds LLC.	US	Unrecognised	12	2026-10-09 15:44
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	5	2026-10-09 17:23
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	5	2026-10-07 00:19
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	5	2026-10-05 13:50
138.246.253.137	AS12816 Leibniz-Rechenzentrum	DE	QUIC	4	2026-10-08 16:13
138.246.253.7	AS12816 Leibniz-Rechenzentrum	DE	QUIC	4	2026-10-07 22:40
83.7.114.2	AS5617 Orange Polska Spolka Akcyjna	PL	SOCKS5	4	2026-10-10 02:42
147.182.167.155	AS14061 DigitalOcean, LLC	US	QUIC	4	2026-10-07 20:04
104.168.140.86	AS54290 Hostwinds LLC.	US	Unrecognised	4	2026-10-05 15:34
69.55.59.201	AS14061 DigitalOcean, LLC	US	Unrecognised	4	2026-10-08 00:50
47.90.213.222	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	3	2026-10-06 16:44
82.127.126.14	AS3215 Orange	FR	SOCKS5	3	2026-10-09 20:38
165.154.182.223	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	3	2026-10-07 05:01
47.251.106.55	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	3	2026-10-06 15:56
8.208.76.228	AS45102 Alibaba (US) Technology Co., Ltd.	GB	Unrecognised	3	2026-10-06 15:59
185.100.87.136	AS200651 FlokiNET ehf	RO	Unrecognised	3	2026-10-08 23:06
24.152.28.238	AS270563 INVINET PROVEDOR LTDA - ME	BR	SOCKS5	2	2026-10-08 11:07
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	QUIC	2	2026-10-08 01:37
47.89.154.16	AS45102 Alibaba (US) Technology Co., Ltd.	US	QUIC	2	2026-10-08 06:03

Latest datagrams

2026-10-11 01:07:52164.90.135.205to 443/udpUnrecognisedUS
8· |·
payload bytes
```
00000000  38 ca c5 d8 0a 7c ac cb  f0 00 00 00 00 00        |8....|........|
```
2026-10-11 01:00:41146.190.30.184to 443/udpUnrecognisedNL
8̣·7V·m·
payload bytes
```
00000000  38 cc a3 ef 37 56 8d 6d  f3 00 00 00 00 00        |8...7V.m......|
```
2026-10-11 00:56:07178.128.184.235to 443/udpUnrecognisedUS
8· ·p·
payload bytes
```
00000000  38 b3 18 96 0d bd 70 8a  1c 00 00 00 00 00        |8.....p.......|
```
2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:34:2891.230.168.112to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 22:36:12191.177.197.126to 443/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 22:30:40185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 22:24:33185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 443/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 20:59:1791.231.89.90to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 20:44:0191.230.168.218to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 20:10:10185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 18:33:2966.132.224.23to 443/udpDTLSUS

·f·Z·Z·)5+·t·{·ҹwc·d`a·8·2·,̩· ·+· ·0̨·/·5·/·̪·9·3·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 66 01 00 00  |............f...|
00000010  5a 00 00 00 00 00 00 00  5a fe fd 29 35 2b f9 c7  |Z.......Z..)5+..|
00000020  74 a8 9a 12 bf 07 b2 7b  fd d2 b9 77 63 1f 9e 9b  |t......{...wc...|
00000030  88 94 18 18 8a 1b 64 60  61 e4 38 00 00 00 32 c0  |......d`a.8...2.|
00000040  2c cc a9 c0 ad c0 0a c0  2b c0 ac c0 09 c0 30 cc  |,.......+.....0.|
00000050  a8 c0 14 c0 2f c0 13 00  9d c0 9d 00 35 00 9c c0  |..../.......5...|
00000060  9c 00 2f 00 9f cc aa c0  9f 00 39 00 9e c0 9e 00  |../.......9.....|
00000070  33 01 00                                          |3..|

2026-10-10 18:26:20185.247.137.106to 443/udpQUICGB
QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co
2026-10-10 18:25:4287.236.176.107to 443/udpQUICGB
QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co