UDP traffic

Datagrams matching port:443 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

283

Datagrams

188

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

81 datagrams from 52 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 32 DTLS 26 GOOGLE 23

Latest SOCKS5 datagram, to 443/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

QUIC

83 datagrams from 65 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 83

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=http/0.9,http/1.0,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2c,webrtc,c-webrtc,ftp,imap,pop3,managesieve,coap,co

Unrecognised

119 datagrams from 84 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 119

Latest Unrecognised datagram, to 443/udp

·|·>·(·4Vx ·;ʧ·

payload bytes

00000000  01 7c 06 3e f1 28 f6 1d  e2 00 ff ff 00 fe fe fe  |.|.>.(..........|
00000010  fe fd fd fd fd 12 34 56  78 20 9d c5 3b ca a7 1e  |......4Vx ..;...|
00000020  f1                                                |.|

Destination ports

443/udp QUIC283

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_3db21c8b774f from 16 sources16
q13i0307h9_55b375c5d22e_2f871f65fa7d from 8 sources8
q13i0307h9_55b375c5d22e_39d5f8cd0d4d from 8 sources8
q13i0311h3_55b375c5d22e_c183556c78e2 from 4 sources8
q13i0207h9_62ed6f6ca7ad_95b521733d99 from 8 sources8
q13i0308h3_55b375c5d22e_bc854dc9d3af from 8 sources8
q13i0310h3_55b375c5d22e_df5b9e597968 from 1 source4
q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 3 sources3

QUIC transport parameters

60647680e335 from 23 sources24
1f7a23748abd from 16 sources16
4c2cac1ef1cb from 8 sources8
12d07494ae7c from 4 sources8
94dccb934778 from 1 source4
5826be32c2d4 from 2 sources2
24dc672a03ab from 1 source1

QUIC versions

Networks

AS211298 Driftnet Ltd from 52 sources56
AS14061 DigitalOcean, LLC from 20 sources38
AS9009 M247 Europe SRL from 1 source23
AS45102 Alibaba (US) Technology Co., Ltd. from 8 sources18
AS54290 Hostwinds LLC. from 2 sources16
AS8075 Microsoft Corporation from 11 sources11
AS398324 Censys, Inc. from 10 sources11
AS12816 Leibniz-Rechenzentrum from 2 sources8
AS28573 Claro NXT Telecomunicacoes Ltda from 7 sources8
AS213412 ONYPHE SAS from 6 sources8

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.200.118.46	AS9009 M247 Europe SRL	GB	GOOGLE	23	2026-10-10 22:30
104.168.132.113	AS54290 Hostwinds LLC.	US	Unrecognised	12	2026-10-09 15:44
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	5	2026-10-07 00:19
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	5	2026-10-09 17:23
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	5	2026-10-05 13:50
147.182.167.155	AS14061 DigitalOcean, LLC	US	QUIC	4	2026-10-07 20:04
138.246.253.137	AS12816 Leibniz-Rechenzentrum	DE	QUIC	4	2026-10-08 16:13
83.7.114.2	AS5617 Orange Polska Spolka Akcyjna	PL	SOCKS5	4	2026-10-10 02:42
69.55.59.201	AS14061 DigitalOcean, LLC	US	Unrecognised	4	2026-10-08 00:50
138.246.253.7	AS12816 Leibniz-Rechenzentrum	DE	QUIC	4	2026-10-07 22:40
104.168.140.86	AS54290 Hostwinds LLC.	US	Unrecognised	4	2026-10-05 15:34
47.90.213.222	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	3	2026-10-06 16:44
8.208.76.228	AS45102 Alibaba (US) Technology Co., Ltd.	GB	Unrecognised	3	2026-10-06 15:59
165.154.182.223	AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMIT	US	Unrecognised	3	2026-10-07 05:01
82.127.126.14	AS3215 Orange	FR	SOCKS5	3	2026-10-09 20:38
47.251.106.55	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	3	2026-10-06 15:56
185.100.87.136	AS200651 FlokiNET ehf	RO	Unrecognised	3	2026-10-08 23:06
47.91.125.252	AS45102 Alibaba (US) Technology Co., Ltd.	AE	QUIC	2	2026-10-08 08:29
179.63.90.154	AS271540 J C V A LEAL INFORMATICA LTDA	BR	Unrecognised	2	2026-10-09 14:42
47.89.154.16	AS45102 Alibaba (US) Technology Co., Ltd.	US	QUIC	2	2026-10-08 06:03

Latest datagrams

2026-10-11 08:04:5466.132.159.42to 443/udpDTLSUS

·f·Z·Z·)5+·t·{·ҹwc·d`a·8·2·,̩· ·+· ·0̨·/·5·/·̪·9·3·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 66 01 00 00  |............f...|
00000010  5a 00 00 00 00 00 00 00  5a fe fd 29 35 2b f9 c7  |Z.......Z..)5+..|
00000020  74 a8 9a 12 bf 07 b2 7b  fd d2 b9 77 63 1f 9e 9b  |t......{...wc...|
00000030  88 94 18 18 8a 1b 64 60  61 e4 38 00 00 00 32 c0  |......d`a.8...2.|
00000040  2c cc a9 c0 ad c0 0a c0  2b c0 ac c0 09 c0 30 cc  |,.......+.....0.|
00000050  a8 c0 14 c0 2f c0 13 00  9d c0 9d 00 35 00 9c c0  |..../.......5...|
00000060  9c 00 2f 00 9f cc aa c0  9f 00 39 00 9e c0 9e 00  |../.......9.....|
00000070  33 01 00                                          |3..|

2026-10-11 07:59:54177.16.65.37to 443/udpUnrecognisedBR

·|·>·(·4Vx ·;ʧ·

payload bytes

00000000  01 7c 06 3e f1 28 f6 1d  e2 00 ff ff 00 fe fe fe  |.|.>.(..........|
00000010  fe fd fd fd fd 12 34 56  78 20 9d c5 3b ca a7 1e  |......4Vx ..;...|
00000020  f1                                                |.|

2026-10-11 07:29:22193.163.125.253to 443/udpDTLSGB

·y·y·_·3·h+ ·3k*ܵ·)u·:Lb·{T·%ʃ·+·/· · ·,·0̨̩·7· · · ·

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 5f 07 f5 ef 33  |y.......y.._...3|
00000020  0e 68 2b 09 d4 33 6b 2a  dc b5 e8 d6 0f 29 75 86  |.h+..3k*.....)u.|
00000030  3a 4c 62 d8 d6 7b 54 8e  25 ca 83 00 00 00 18 c0  |:Lb..{T.%.......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-11 05:04:49167.99.1.98to 443/udpUnrecognisedUS

8·=·

payload bytes

00000000  38 ec 3d e2 a7 e0 1e d7  d3 00 00 00 00 00        |8.=...........|

2026-10-11 04:56:41172.174.235.111to 443/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_443
Payload bytes withheld: they contain the sensor's address.
2026-10-11 04:51:38165.22.145.25to 443/udpUnrecognisedUS
8·LB`·%·
payload bytes
```
00000000  38 e0 a1 4c 42 60 0e 25  14 00 00 00 00 00        |8..LB`.%......|
```
2026-10-11 04:45:2120.102.113.3to 443/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_443
Payload bytes withheld: they contain the sensor's address.
2026-10-11 04:25:13165.232.177.49to 443/udpUnrecognisedIN
8·4'·nV·
payload bytes
```
00000000  38 93 34 27 01 6e 56 16  b8 00 00 00 00 00        |8.4'.nV.......|
```
2026-10-11 04:15:53161.35.230.3to 443/udpUnrecognisedUS
8·*·6·
payload bytes
```
00000000  38 c7 d2 07 12 2a b5 36  17 00 00 00 00 00        |8....*.6......|
```
2026-10-11 01:07:52164.90.135.205to 443/udpUnrecognisedUS
8· |·
payload bytes
```
00000000  38 ca c5 d8 0a 7c ac cb  f0 00 00 00 00 00        |8....|........|
```
2026-10-11 01:00:41146.190.30.184to 443/udpUnrecognisedNL
8̣·7V·m·
payload bytes
```
00000000  38 cc a3 ef 37 56 8d 6d  f3 00 00 00 00 00        |8...7V.m......|
```
2026-10-11 00:56:07178.128.184.235to 443/udpUnrecognisedUS
8· ·p·
payload bytes
```
00000000  38 b3 18 96 0d bd 70 8a  1c 00 00 00 00 00        |8.....p.......|
```
2026-10-10 23:49:4891.231.89.160to 443/udpUnrecognisedFR
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```
2026-10-10 23:34:2891.230.168.112to 443/udpUnrecognisedUS
request_dtls
payload bytes
```
00000000  72 65 71 75 65 73 74 5f  64 74 6c 73              |request_dtls|
```

2026-10-10 22:36:12191.177.197.126to 443/udpSOCKS5BR

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part