UDP traffic

Datagrams matching port:853 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Other services

2 datagrams from 2 sources

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 2

Latest DTLS datagram, to 853/udp

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

QUIC

4 datagrams from 4 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 4

Latest QUIC datagram, to 853/udp

QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00

Unrecognised

2 datagrams from 2 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 2

Latest Unrecognised datagram, to 853/udp

12345678Q999·

payload bytes

00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|

Destination ports

853/udp QUIC8

QUIC clients (JA4)

q13i0311dq_55b375c5d22e_c183556c78e2 from 4 sources4

QUIC transport parameters

cde977acba33 from 4 sources4

QUIC versions

Networks

AS14061 DigitalOcean, LLC from 2 sources4
AS45102 Alibaba (US) Technology Co., Ltd. from 4 sources4

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
68.183.18.163	AS14061 DigitalOcean, LLC	US	Unrecognised	2	2026-10-08 13:52
165.232.89.6	AS14061 DigitalOcean, LLC	NL	Unrecognised	2	2026-10-10 00:08
47.91.125.252	AS45102 Alibaba (US) Technology Co., Ltd.	AE	QUIC	1	2026-10-09 10:12
8.208.10.94	AS45102 Alibaba (US) Technology Co., Ltd.	GB	QUIC	1	2026-10-09 04:58
47.251.13.59	AS45102 Alibaba (US) Technology Co., Ltd.	US	QUIC	1	2026-10-09 01:10
47.245.117.221	AS45102 Alibaba (US) Technology Co., Ltd.	SG	QUIC	1	2026-10-09 01:03

Latest datagrams

2026-10-10 00:08:15165.232.89.6to 853/udpDTLSNL

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

2026-10-10 00:08:06165.232.89.6to 853/udpUnrecognisedNL
12345678Q999·
payload bytes
```
00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|
```
2026-10-09 10:12:0947.91.125.252to 853/udpQUICAE
QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00
2026-10-09 04:58:138.208.10.94to 853/udpQUICGB
QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00
2026-10-09 01:10:0047.251.13.59to 853/udpQUICUS
QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00
2026-10-09 01:03:0047.245.117.221to 853/udpQUICSG
QUIC v1 Initial alpn=doq,doq-i07,doq-i08,doq-i09,doq-i10,doq-i11,doq-i06,doq-i12,doq-i05,doq-i04,doq-i03,doq-i02,doq-i01,doq-i00

2026-10-08 13:52:2968.183.18.163to 853/udpDTLSUS

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

2026-10-08 13:52:1968.183.18.163to 853/udpUnrecognisedUS
12345678Q999·
payload bytes
```
00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|
```