UDP traffic

Datagrams matching port:53 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

683

Datagrams

225

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

650 datagrams from 198 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 650

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 1

Latest HTTP datagram, to 53/udp

payload bytes

00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 0d 0a 0d 0a           |Host: www....|

Unrecognised

32 datagrams from 30 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 32

Latest Unrecognised datagram, to 53/udp

MGLNDD_<HONEYPOT>_53

Payload bytes withheld: they contain the sensor's address.

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	650	198	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS683

DNS questions

DNS record types

TXT302
ANY196
A143
NS4

Networks

AS396982 Google LLC from 59 sources160
AS16509 Amazon.com, Inc. from 7 sources74
AS215925 Vpsvault.host Ltd from 4 sources42
AS51396 Pfcloud UG (haftungsbeschrankt) from 4 sources39
AS12876 Scaleway SAS from 2 sources37
AS219502 Storm Industries LLC from 2 sources30
AS8075 Microsoft Corporation from 30 sources30
AS209630 LLC Vash Kredit Bank from 1 source24
AS6939 Hurricane Electric LLC from 19 sources21
AS29484 Ruhr-Universitaet Bochum from 1 source20

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	27	2026-10-11 02:15
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	DNS	24	2026-10-09 20:04
18.226.68.29	AS16509 Amazon.com, Inc.	US	DNS	23	2026-10-06 13:13
94.154.43.109	AS219502 Storm Industries LLC	NL	DNS	22	2026-10-09 08:45
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	20	2026-10-11 00:48
185.73.23.133	AS29484 Ruhr-Universitaet Bochum	DE	DNS	20	2026-10-10 09:32
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	DNS	20	2026-10-11 01:20
141.98.11.129	AS209605 UAB Host Baltic	LT	DNS	19	2026-10-10 06:23
216.180.246.217	AS396982 Google LLC	US	DNS	17	2026-10-07 16:46
216.180.246.230	AS396982 Google LLC	US	DNS	17	2026-10-07 11:04
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
216.180.246.225	AS396982 Google LLC	US	DNS	17	2026-10-07 11:15
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
141.98.83.48	AS209588 Flyservers S.A.	PA	DNS	16	2026-10-10 05:46
45.198.224.251	AS215925 Vpsvault.host Ltd	US	DNS	15	2026-10-10 00:25
13.58.25.240	AS16509 Amazon.com, Inc.	US	DNS	14	2026-10-07 13:16
52.14.245.101	AS16509 Amazon.com, Inc.	US	DNS	13	2026-10-08 12:08
185.94.111.1	AS51115 HLL LLC	RU	DNS	12	2026-10-10 18:34
18.188.181.94	AS16509 Amazon.com, Inc.	US	DNS	10	2026-10-10 12:34

Latest datagrams

2026-10-11 04:14:57161.35.230.3to 53/udpDNSUS

8·ˣ·

payload bytes

00000000  38 87 ba e6 fb cb a3 93  0c 00 00 00 00 00        |8.............|

2026-10-11 04:12:47147.185.132.198to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

2026-10-11 03:24:22144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:23:24144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:19:10144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:09:40146.88.241.170to 53/udpDNSUS
DNS query A 00065d87e9839cd7.1059.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:09:10216.25.89.113to 53/udpDNSUS

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:03:48146.88.241.100to 53/udpDNSUS
DNS query A 00065d87d48e32b8.522f.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:01:51144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 02:57:5866.132.224.19to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:54:26147.185.132.252to 53/udpDNSUS

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 01:32:5165.49.1.71to 53/udpDNSUS

DNS query A dnsscan.shadowserver.org

payload bytes

00000000  fa ce 01 00 00 01 00 00  00 00 00 00 07 64 6e 73  |.............dns|
00000010  73 63 61 6e 0c 73 68 61  64 6f 77 73 65 72 76 65  |scan.shadowserve|
00000020  72 03 6f 72 67 00 00 01  00 01                    |r.org.....|

2026-10-11 01:29:5166.132.172.227to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 01:20:1445.205.1.231to 53/udpDNSBR

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|