UDP traffic

Datagrams matching proto:raw sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

2.5K

Datagrams

799

Source addresses

166

Networks

Countries

538

Destination ports

Traffic by type

Unrecognised

2,512 datagrams from 799 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 2,512

Latest Unrecognised datagram, to 53/udp

8·9·}·

payload bytes

00000000  38 a8 39 e2 fe 7d 87 e3  88 00 00 00 00 00        |8.9..}........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	30	23	10,000 to 51,000
WS-Discovery	3702/udp	41	10	10 to 500
CharGEN	19/udp	16	8	358.8
mDNS	5353/udp	9	8	2 to 10
SSDP	1900/udp	8	8	30.8
QOTD	17/udp	7	6	140.3
RIPv1	520/udp	4	4	131.24
CLDAP	389/udp	16	3	56 to 70
SNMPv2	161/udp	3	3	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

500/udp IKE55
1434/udp MSSQL Browser49
3702/udp WS-Discovery41
1194/udp OpenVPN41
63629/udp40
63574/udp40
61345/udp40
58994/udp40
57197/udp40
56489/udp40
53109/udp40
52852/udp40

Networks

AS7552 Viettel Group from 22 sources1,021
AS398324 Censys, Inc. from 63 sources170
AS396982 Google LLC from 133 sources148
AS14061 DigitalOcean, LLC from 25 sources136
AS8075 Microsoft Corporation from 123 sources132
AS6939 Hurricane Electric LLC from 113 sources122
AS13335 Cloudflare, Inc. from 3 sources82
AS20052 Arbor Networks, Inc. from 16 sources67
AS202425 IP Volume inc from 7 sources47
AS45899 VNPT Corp from 3 sources45

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
117.3.123.242	AS7552 Viettel Group	VN	Unrecognised	143	2026-10-11 01:49
27.68.152.94	AS7552 Viettel Group	VN	Unrecognised	120	2026-10-10 14:15
27.66.49.95	AS7552 Viettel Group	VN	Unrecognised	89	2026-10-10 14:12
27.67.72.112	AS7552 Viettel Group	VN	Unrecognised	80	2026-10-10 13:56
125.234.228.207	AS7552 Viettel Group	VN	Unrecognised	78	2026-10-11 04:01
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	67	2026-10-10 20:31
125.235.172.252	AS7552 Viettel Group	VN	Unrecognised	58	2026-10-10 23:46
125.234.229.115	AS7552 Viettel Group	VN	Unrecognised	56	2026-10-11 03:59
116.110.224.132	AS7552 Viettel Group	VN	Unrecognised	55	2026-10-11 01:28
117.3.120.162	AS7552 Viettel Group	VN	Unrecognised	51	2026-10-11 03:20
171.244.211.211	AS7552 Viettel Group	VN	Unrecognised	47	2026-10-11 01:57
171.254.139.104	AS7552 Viettel Group	VN	Unrecognised	40	2026-10-11 02:39
171.254.139.187	AS7552 Viettel Group	VN	Unrecognised	40	2026-10-11 04:06
104.28.210.247	AS13335 Cloudflare, Inc.	VN	Unrecognised	40	2026-10-10 09:46
141.98.83.48	AS209588 Flyservers S.A.	PA	Unrecognised	38	2026-10-11 04:17
14.191.245.6	AS45899 VNPT Corp	VN	Unrecognised	38	2026-10-10 12:58
171.254.130.133	AS7552 Viettel Group	VN	Unrecognised	28	2026-10-10 07:58
171.254.178.44	AS7552 Viettel Group	VN	Unrecognised	28	2026-10-11 03:31
116.110.224.62	AS7552 Viettel Group	VN	Unrecognised	28	2026-10-11 04:02
104.28.163.53	AS13335 Cloudflare, Inc.	HK	Unrecognised	28	2026-10-11 01:15

Latest datagrams

2026-10-11 04:24:16165.232.177.49to 53/udpUnrecognisedIN
8·9·}·
payload bytes
```
00000000  38 a8 39 e2 fe 7d 87 e3  88 00 00 00 00 00        |8.9..}........|
```
2026-10-11 04:24:0066.132.172.245to 32679/udpUnrecognisedUS
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```
2026-10-11 04:24:00165.232.177.49to 1194/udpUnrecognisedIN
8·7·^)·
payload bytes
```
00000000  38 f6 37 db fe ee 5e 29  f8 00 00 00 00 00        |8.7...^)......|
```

2026-10-11 04:23:57175.163.103.77to 31065/udpUnrecognisedCN

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

2026-10-11 04:22:5845.194.70.251to 162/udpUnrecognisedSC

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-11 04:22:55185.242.226.97to 40902/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-11 04:22:4564.62.197.68to 34980/udpUnrecognisedUS

·0·

payload bytes

00000000  0e 10 07 02 00 00 30 01  02 00 00 00 00 00 00 00  |......0.........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-11 04:22:3264.62.197.203to 5351/udpUnrecognisedUS
·
payload bytes
```
00000000  00 00                                             |..|
```

2026-10-11 04:22:1645.194.70.248to 1701/udpUnrecognisedSC

·<·nxn-spxn· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6e 78 6e 2d 73 70  78 6e 80 0a 00 00 00 03  |..nxn-spxn......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-11 04:22:0064.62.156.32to 10001/udpUnrecognisedUS
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-11 04:21:0291.34.37.59to 5060/udpUnrecognisedDE

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

2026-10-11 04:17:08141.98.83.48to 11211/udpUnrecognisedPA

·stats

payload bytes

00000000  00 01 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|

2026-10-11 04:17:0065.49.20.122to 3389/udpUnrecognisedUS

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:16:39216.226.77.30to 1701/udpUnrecognisedUS

·X·Vigor· · 陀 · ·Draytek

payload bytes

00000000  c8 02 00 58 00 00 00 00  00 00 00 01 80 08 00 00  |...X............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0b 00 00  |................|
00000020  00 07 56 69 67 6f 72 80  0a 00 00 00 03 00 00 00  |..Vigor.........|
00000030  03 80 08 00 00 00 09 e9  99 80 0a 00 00 00 04 00  |................|
00000040  00 00 03 00 08 00 00 00  06 00 01 00 0d 00 00 00  |................|
00000050  08 44 72 61 79 74 65 6b                           |.Draytek|

2026-10-11 04:16:1664.62.197.20to 53413/udpUnrecognisedUS
payload bytes
```
00000000  0a                                                |.|
```