UDP traffic

Datagrams matching port:502 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Unrecognised

4 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 4

Latest Unrecognised datagram, to 502/udp

U·)·sI·! "·("·l·h·(·ޠ·B|㥏·@bE·V·|ٶ·R·`c·f·n0·@}·2·x·3·rc9M9·c·ǆ·Ԩ·J

payload bytes

00000000  55 14 d8 29 aa 73 49 c0  00 00 00 00 00 00 00 00  |U..).sI.........|
00000010  21 20 22 08 00 00 00 00  00 00 01 28 22 00 00 6c  |! "........("..l|
00000020  00 00 00 68 01 01 00 0b  03 00 00 0c 01 00 00 0c  |...h............|
00000030  80 0e 01 00 03 00 00 0c  01 00 00 0c 80 0e 00 80  |................|
00000040  03 00 00 08 01 00 00 03  03 00 00 08 01 00 00 02  |................|
00000050  03 00 00 08 02 00 00 02  03 00 00 08 02 00 00 01  |................|
00000060  03 00 00 08 03 00 00 02  03 00 00 08 03 00 00 01  |................|
00000070  03 00 00 08 04 00 00 02  03 00 00 08 04 00 00 05  |................|
00000080  00 00 00 08 04 00 00 0e  28 00 00 88 00 02 00 00  |........(.......|
00000090  f1 de a0 01 e3 a1 14 42  7c e3 a5 8f 8e fb b4 e8  |.......B|.......|
000000a0  40 62 45 f6 0e b5 e7 56  98 14 a4 7c d9 b6 8c c0  |@bE....V...|....|
000000b0  d3 52 a5 a9 60 63 ad 07  66 00 6e 30 b2 40 7d f1  |.R..`c..f.n0.@}.|
000000c0  32 14 78 ab a8 85 33 84  8e 17 72 63 39 4d 39 f8  |2.x...3...rc9M9.|
000000d0  bd 18 63 ec c7 86 e8 d4  a8 df c2 12 cb 4a 12 1d  |..c..........J..|
000000e0  77 fb a1 8b e0 0c e9 89  7f e3 97 93 4d 28 fb e9  |w...........M(..|
000000f0  a3 84 49 78 1b 64 84 75  4f 31 b5 63 fd f7 24 20  |..Ix.d.uO1.c..$ |

Destination ports

502/udp4

Networks

AS396982 Google LLC from 2 sources2
AS8075 Microsoft Corporation from 2 sources2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
20.14.94.107	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-10 13:13
35.203.210.115	AS396982 Google LLC	GB	Unrecognised	1	2026-10-10 06:30
147.185.133.194	AS396982 Google LLC	US	Unrecognised	1	2026-10-10 19:07
172.180.64.129	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-10 13:17

Latest datagrams

2026-10-10 19:07:10147.185.133.194to 502/udpUnrecognisedUS

U·)·sI·! "·("·l·h·(·ޠ·B|㥏·@bE·

payload bytes

00000000  55 14 d8 29 aa 73 49 c0  00 00 00 00 00 00 00 00  |U..).sI.........|
00000010  21 20 22 08 00 00 00 00  00 00 01 28 22 00 00 6c  |! "........("..l|
00000020  00 00 00 68 01 01 00 0b  03 00 00 0c 01 00 00 0c  |...h............|
00000030  80 0e 01 00 03 00 00 0c  01 00 00 0c 80 0e 00 80  |................|
00000040  03 00 00 08 01 00 00 03  03 00 00 08 01 00 00 02  |................|
00000050  03 00 00 08 02 00 00 02  03 00 00 08 02 00 00 01  |................|
00000060  03 00 00 08 03 00 00 02  03 00 00 08 03 00 00 01  |................|
00000070  03 00 00 08 04 00 00 02  03 00 00 08 04 00 00 05  |................|
00000080  00 00 00 08 04 00 00 0e  28 00 00 88 00 02 00 00  |........(.......|
00000090  f1 de a0 01 e3 a1 14 42  7c e3 a5 8f 8e fb b4 e8  |.......B|.......|
000000a0  40 62 45 f6 0e b5 e7 56  98 14 a4 7c d9 b6 8c c0  |@bE....V...|....|
000000b0  d3 52 a5 a9 60 63 ad 07  66 00 6e 30 b2 40 7d f1  |.R..`c..f.n0.@}.|
000000c0  32 14 78 ab a8 85 33 84  8e 17 72 63 39 4d 39 f8  |2.x...3...rc9M9.|
000000d0  bd 18 63 ec c7 86 e8 d4  a8 df c2 12 cb 4a 12 1d  |..c..........J..|
000000e0  77 fb a1 8b e0 0c e9 89  7f e3 97 93 4d 28 fb e9  |w...........M(..|
000000f0  a3 84 49 78 1b 64 84 75  4f 31 b5 63 fd f7 24 20  |..Ix.d.uO1.c..$ |
... 296 bytes shown in part

2026-10-10 13:17:24172.180.64.129to 502/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_502
Payload bytes withheld: they contain the sensor's address.
2026-10-10 13:13:0120.14.94.107to 502/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_502
Payload bytes withheld: they contain the sensor's address.

2026-10-10 06:30:5935.203.210.115to 502/udpUnrecognisedGB

U·)·sI·! "·("·l·h·(·ޠ·B|㥏·@bE·

payload bytes

00000000  55 14 d8 29 aa 73 49 c0  00 00 00 00 00 00 00 00  |U..).sI.........|
00000010  21 20 22 08 00 00 00 00  00 00 01 28 22 00 00 6c  |! "........("..l|
00000020  00 00 00 68 01 01 00 0b  03 00 00 0c 01 00 00 0c  |...h............|
00000030  80 0e 01 00 03 00 00 0c  01 00 00 0c 80 0e 00 80  |................|
00000040  03 00 00 08 01 00 00 03  03 00 00 08 01 00 00 02  |................|
00000050  03 00 00 08 02 00 00 02  03 00 00 08 02 00 00 01  |................|
00000060  03 00 00 08 03 00 00 02  03 00 00 08 03 00 00 01  |................|
00000070  03 00 00 08 04 00 00 02  03 00 00 08 04 00 00 05  |................|
00000080  00 00 00 08 04 00 00 0e  28 00 00 88 00 02 00 00  |........(.......|
00000090  f1 de a0 01 e3 a1 14 42  7c e3 a5 8f 8e fb b4 e8  |.......B|.......|
000000a0  40 62 45 f6 0e b5 e7 56  98 14 a4 7c d9 b6 8c c0  |@bE....V...|....|
000000b0  d3 52 a5 a9 60 63 ad 07  66 00 6e 30 b2 40 7d f1  |.R..`c..f.n0.@}.|
000000c0  32 14 78 ab a8 85 33 84  8e 17 72 63 39 4d 39 f8  |2.x...3...rc9M9.|
000000d0  bd 18 63 ec c7 86 e8 d4  a8 df c2 12 cb 4a 12 1d  |..c..........J..|
000000e0  77 fb a1 8b e0 0c e9 89  7f e3 97 93 4d 28 fb e9  |w...........M(..|
000000f0  a3 84 49 78 1b 64 84 75  4f 31 b5 63 fd f7 24 20  |..Ix.d.uO1.c..$ |
... 296 bytes shown in part