UDP traffic

Datagrams matching port:80 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 80/udp

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 08 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

59 datagrams from 44 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 59

Latest Unrecognised datagram, to 80/udp

8·c·+O·N·

payload bytes

00000000  38 aa 63 c9 1d 2b 4f 1f  4e 00 00 00 00 00        |8.c..+O.N.....|

Destination ports

80/udp60

Networks

AS8075 Microsoft Corporation from 17 sources17
AS14061 DigitalOcean, LLC from 8 sources11
AS54290 Hostwinds LLC. from 1 source8
AS45102 Alibaba (US) Technology Co., Ltd. from 5 sources5
AS10439 CariNet, Inc. from 2 sources4
AS202425 IP Volume inc from 1 source3
AS4134 Chinanet from 2 sources2
AS19429 Colombia from 2 sources2
AS1221 Telstra Limited from 1 source2
AS137266 CHINATELECOM Hubei province Wuhan 5G net from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
104.168.132.113	AS54290 Hostwinds LLC.	US	Unrecognised	8	2026-10-07 20:41
71.6.199.23	AS10439 CariNet, Inc.	US	Unrecognised	3	2026-10-06 22:26
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	3	2026-10-07 20:25
167.71.102.181	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-07 13:57
144.130.164.158	AS1221 Telstra Limited	AU	Unrecognised	2	2026-10-09 17:03
146.190.72.24	AS14061 DigitalOcean, LLC	US	Unrecognised	2	2026-10-06 17:05
59.49.230.168	AS4134 Chinanet	CN	Unrecognised	1	2026-10-10 11:17
167.71.143.137	AS14061 DigitalOcean, LLC	GB	Unrecognised	1	2026-10-07 14:05
27.17.76.93	AS137266 CHINATELECOM Hubei province Wuhan 5G net	CN	Unrecognised	1	2026-10-08 00:03
165.22.171.137	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-07 14:04
20.150.195.3	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-11 01:05
20.51.195.80	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-05 19:06
186.30.136.232	AS19429 Colombia	CO	Unrecognised	1	2026-10-08 21:46
4.249.18.138	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-05 19:10
40.76.250.59	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-07 13:13
51.8.82.35	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-09 06:47
20.55.39.105	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-07 13:11
47.253.100.60	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	1	2026-10-08 14:25
47.251.171.192	AS45102 Alibaba (US) Technology Co., Ltd.	US	Unrecognised	1	2026-10-08 14:04
57.154.208.126	AS8075 Microsoft Corporation	US	Unrecognised	1	2026-10-11 01:04

Latest datagrams

2026-10-11 01:07:54164.90.135.205to 80/udpUnrecognisedUS
8·c·+O·N·
payload bytes
```
00000000  38 aa 63 c9 1d 2b 4f 1f  4e 00 00 00 00 00        |8.c..+O.N.....|
```
2026-10-11 01:05:0720.150.195.3to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-11 01:04:0357.154.208.126to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-11 00:56:08178.128.184.235to 80/udpUnrecognisedUS
8·O·@·N·
payload bytes
```
00000000  38 ce 7f 4f 85 18 40 b5  4e 00 00 00 00 00        |8..O..@.N.....|
```
2026-10-10 22:18:222604:a880:cad:d0:0:1:ba2b:9001to 80/udpUnrecognisedCA
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```
2026-10-10 11:17:5359.49.230.168to 80/udpUnrecognisedCN
·*·Q999·
payload bytes
```
00000000  0d 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |.....*...Q999.|
```

2026-10-10 05:59:2566.240.192.138to 80/udpUnrecognisedUS

·'·I%

payload bytes

00000000  00 00 04 17 27 10 19 80  00 00 00 00 00 03 49 25  |....'.........I%|

2026-10-10 03:50:0220.51.209.165to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-10 03:45:344.249.18.29to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-10 03:45:084.249.17.189to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-10 03:43:5420.14.75.205to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.

2026-10-09 17:03:30144.130.164.158to 80/udpUnrecognisedAU

·x·W·١·v·JK%f·*·C·:·-·0·Rdl·7·$·6lWL·{·)T· *a·N#f·`·,·Ҍ·3·B3·Vgّ·0·Ac=·:·0· ·

payload bytes

00000000  8b 0c 78 e1 0b 57 15 a5  d9 a1 17 0e 9a 02 76 04  |..x..W........v.|
00000010  cb 4a 4b 25 66 ec e9 2a  8b 99 43 99 eb 3a 95 2d  |.JK%f..*..C..:.-|
00000020  80 30 f7 52 64 6c 18 37  cd 24 12 b2 06 12 d4 36  |.0.Rdl.7.$.....6|
00000030  6c 57 4c dd ed 7b c3 29  54 06 d4 0a 2a 61 06 9c  |lWL..{.)T...*a..|
00000040  f1 b2 4e 23 66 b9 60 11  b8 fb 2c bb c6 d2 8c 14  |..N#f.`...,.....|
00000050  9c 33 03 42 33 19 bc 56  67 d9 91 8a 11 30 f9 f8  |.3.B3..Vg....0..|
00000060  41 63 3d a3 94 83 fe 15  ad 3a a0 11 30 f9 e8 20  |Ac=......:..0.. |
00000070  07 b1 87 68 a0 7d 84 89  6f 4b e1 99 1a 00 a7 fe  |...h.}..oK......|
00000080  40 99 fd ab e2 98 3e 01  99 11 17 92 11 74 76 54  |@.....>......tvT|
00000090  46 d0 06 13 4c a3 0a e6  cd fd bb cc b7 ce 8a 2b  |F...L..........+|
000000a0  60 af 2b 0e 2a 7d 88 bd  c3 aa ce ae db 36 4c d3  |`.+.*}.......6L.|
000000b0  7d d3 4f 80 73 8f d0 7e  d8 aa 93 a5 5f aa db 17  |}.O.s..~...._...|
000000c0  e2 47 f1 e9 b8 e6 a0 13  7e 4b 5d 2b 18 95 1e e1  |.G......~K]+....|
000000d0  8e 10 b3 82 46 b3 32 96  45 1c f5 57 f6 f5 56 42  |....F.2.E..W..VB|
000000e0  52 aa 7b 58 98 8a d0 5b  93 a2 38 a4 a7 0a 34 51  |R.{X...[..8...4Q|
000000f0  e9 13 98 d4 a8 c7 c3 0b  79 d0 8e 6a bd 8e 1e 9b  |........y..j....|
... 512 bytes shown in part

2026-10-09 06:48:45172.203.217.224to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-09 06:48:2357.154.210.72to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.
2026-10-09 06:47:5051.8.82.35to 80/udpUnrecognisedUS
MGLNDD_<HONEYPOT>_80
Payload bytes withheld: they contain the sensor's address.