UDP traffic

Datagrams matching port:443 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

9 datagrams from 6 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

GOOGLE 4 SOCKS5 3 DTLS 2

Latest GOOGLE datagram, to 443/udp

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS·SCLS·KEXS·XLCT·CSCT·COPT·CCRT$·IRTT(·CFCW,·SFCW0·--------------------

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|

QUIC

13 datagrams from 13 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 13

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

16 datagrams from 16 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 16

Latest Unrecognised datagram, to 443/udp

8·4'·nV·

payload bytes

00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|

Destination ports

443/udp QUIC38

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 4 sources4
q13i0307h9_55b375c5d22e_2f871f65fa7d from 2 sources2
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 2 sources2
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 2 sources2
q13i0308h3_55b375c5d22e_bc854dc9d3af from 2 sources2

QUIC transport parameters

60647680e335 from 6 sources6
1f7a23748abd from 4 sources4
4c2cac1ef1cb from 2 sources2

QUIC versions

112
0xfa1a1a1a1

Networks

AS211298 Driftnet Ltd from 12 sources12
AS14061 DigitalOcean, LLC from 6 sources6
AS213412 ONYPHE SAS from 4 sources4
AS9009 M247 Europe SRL from 1 source4
AS398324 Censys, Inc. from 2 sources2
AS4837 CHINA UNICOM China169 Backbone from 2 sources2
AS8075 Microsoft Corporation from 2 sources2
AS265141 RBT Internet from 1 source1
AS28573 Claro NXT Telecomunicacoes Ltda from 1 source1
AS53236 ACESSO Internet Fibra from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	4	2026-10-10 22:30
87.236.176.78	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:24
2604:a880:cad:d0:0:1:ba2b:9001	AS14061 DigitalOcean, LLC	CA	Unrecognised	1	2026-10-10 22:18
177.10.123.26	AS53236 ACESSO Internet Fibra	BR	SOCKS5	1	2026-10-10 07:51
195.96.139.96	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:25
161.35.230.3	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-11 04:15
4.227.178.182	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-10 07:44
87.236.176.109	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:23
185.247.137.167	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 06:01
91.231.89.90	AS213412 ONYPHE SAS	FR	Unrecognised	1	2026-10-10 20:59
195.96.139.150	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 05:59
165.232.177.49	AS14061 DigitalOcean, LLC	IN	Unrecognised	1	2026-10-11 04:25
91.231.89.160	AS213412 ONYPHE SAS	FR	Unrecognised	1	2026-10-10 23:49
185.247.137.106	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:26
87.236.176.180	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 06:00
66.132.186.249	AS398324 Censys, Inc.	US	DTLS	1	2026-10-10 11:21
60.16.213.143	AS4837 CHINA UNICOM China169 Backbone	CN	Unrecognised	1	2026-10-10 08:53
164.90.135.205	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-11 01:07
200.18.122.6	AS262907 BRASIL TECPAR AMIGO AVATO	BR	Unrecognised	1	2026-10-10 11:25
146.190.30.184	AS14061 DigitalOcean, LLC	NL	Unrecognised	1	2026-10-11 01:00

Latest datagrams

2026-10-11 04:25:13165.232.177.49to 443/udpUnrecognisedIN
8·4'·nV·
payload bytes
```
00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|
```
2026-10-11 04:15:53161.35.230.3to 443/udpUnrecognisedUS
8·*·6·
payload bytes
```
00000000  38 c7 d2 07 12 2a b5 36  17 00 00 00 00 00        |8....*.6......|
```
2026-10-11 01:07:52164.90.135.205to 443/udpUnrecognisedUS
8· |·
payload bytes
```
00000000  38 ca c5 d8 0a 7c ac cb  f0 00 00 00 00 00        |8....|........|
```
2026-10-11 01:00:41146.190.30.184to 443/udpUnrecognisedNL
8̣·7V·m·
payload bytes
```
00000000  38 cc a3 ef 37 56 8d 6d  f3 00 00 00 00 00        |8...7V.m......|
```
2026-10-11 00:56:07178.128.184.235to 443/udpUnrecognisedUS
8· ·p·
payload bytes
```
00000000  38 b3 18 96 0d bd 70 8a  1c 00 00 00 00 00        |8.....p.......|
```
2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:34:2891.230.168.112to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 22:36:12191.177.197.126to 443/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-10 22:30:40185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 22:24:33185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 443/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 20:59:1791.231.89.90to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 20:44:0191.230.168.218to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 20:10:10185.200.118.46to 443/udpGOOGLEGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-10 18:33:2966.132.224.23to 443/udpDTLSUS

·f·Z·Z·)5+·t·{·ҹwc·d`a·8·2·,̩· ·+· ·0̨·/·5·/·̪·9·3·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 66 01 00 00  |............f...|
00000010  5a 00 00 00 00 00 00 00  5a fe fd 29 35 2b f9 c7  |Z.......Z..)5+..|
00000020  74 a8 9a 12 bf 07 b2 7b  fd d2 b9 77 63 1f 9e 9b  |t......{...wc...|
00000030  88 94 18 18 8a 1b 64 60  61 e4 38 00 00 00 32 c0  |......d`a.8...2.|
00000040  2c cc a9 c0 ad c0 0a c0  2b c0 ac c0 09 c0 30 cc  |,.......+.....0.|
00000050  a8 c0 14 c0 2f c0 13 00  9d c0 9d 00 35 00 9c c0  |..../.......5...|
00000060  9c 00 2f 00 9f cc aa c0  9f 00 39 00 9e c0 9e 00  |../.......9.....|
00000070  33 01 00                                          |3..|