UDP traffic

Datagrams matching proto:dns sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

185

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

185 datagrams from 76 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 185

Latest DNS datagram, to 39808/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	166	61	28 to 54
mDNS	5353/udp	19	15	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS153
5353/udp DNS19
51/udp DNS2
55/udp DNS1
2967/udp DNS1
3369/udp DNS1
5355/udp DNS1
6353/udp DNS1
15353/udp DNS1
17151/udp DNS1
20615/udp DNS1
25353/udp DNS1

DNS questions

DNS record types

TXT91
A36
ANY31
PTR24

Networks

AS396982 Google LLC from 23 sources63
AS12876 Scaleway SAS from 3 sources22
AS16509 Amazon.com, Inc. from 2 sources14
AS51396 Pfcloud UG (haftungsbeschrankt) from 4 sources11
AS398324 Censys, Inc. from 8 sources11
AS6939 Hurricane Electric LLC from 9 sources9
AS209588 Flyservers S.A. from 1 source5
AS20052 Arbor Networks, Inc. from 4 sources5
AS14061 DigitalOcean, LLC from 4 sources5
AS215925 Vpsvault.host Ltd from 2 sources5

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
18.188.181.94	AS16509 Amazon.com, Inc.	US	DNS	10	2026-10-10 12:34
216.180.246.214	AS396982 Google LLC	US	DNS	9	2026-10-10 16:32
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	6	2026-10-11 02:15
141.98.83.48	AS209588 Flyservers S.A.	PA	DNS	5	2026-10-10 05:46
185.73.23.133	AS29484 Ruhr-Universitaet Bochum	DE	DNS	4	2026-10-10 09:32
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	4	2026-10-11 00:48
13.59.254.158	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-10 14:20
185.94.111.1	AS51115 HLL LLC	RU	DNS	4	2026-10-10 18:34
144.79.70.100	AS154402 Fredyun Network	SG	DNS	4	2026-10-11 03:24
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	DNS	4	2026-10-11 01:20
66.132.172.244	AS398324 Censys, Inc.	US	DNS	3	2026-10-11 04:27
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	3	2026-10-11 00:15
141.98.11.129	AS209605 UAB Host Baltic	LT	DNS	3	2026-10-10 06:23
47.245.84.83	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	3	2026-10-10 05:05
139.162.66.65	AS63949 Akamai Connected Cloud	JP	DNS	3	2026-10-10 18:01
93.158.165.179	AS13238 YANDEX LLC	RU	DNS	2	2026-10-10 17:30
190.236.206.82	AS6147 INTEGRATEL PERU S.A.A.	PE	DNS	2	2026-10-10 23:04

Latest datagrams

2026-10-11 04:27:1666.132.172.244to 39808/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 04:18:3845.198.224.251to 53/udpDNSUS

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 04:14:57161.35.230.3to 53/udpDNSUS

8·ˣ·

payload bytes

00000000  38 87 ba e6 fb cb a3 93  0c 00 00 00 00 00        |8.............|

2026-10-11 04:13:4064.62.156.50to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 04:12:47147.185.132.198to 53/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |4............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 0a     |sion.bind......|

2026-10-11 04:00:33148.153.56.174to 2967/udpDNSUS

DNS query TXT/CH version.bind

payload bytes

00000000  00 06 01 00 00 01 00 00  00 00 00 00 07 76 65 72  |.............ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03        |sion.bind.....|

2026-10-11 03:24:22144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:23:24144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:19:10144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:09:40146.88.241.170to 53/udpDNSUS
DNS query A 00065d87e9839cd7.1059.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:09:10216.25.89.113to 53/udpDNSUS

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 03:03:48146.88.241.100to 53/udpDNSUS
DNS query A 00065d87d48e32b8.522f.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 03:01:51144.79.70.100to 53/udpDNSSG

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

2026-10-11 02:57:5866.132.224.19to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 02:25:07146.88.241.70to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|