UDP traffic

Datagrams matching proto:raw sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

10.4K

Datagrams

3.4K

Source addresses

700

Networks

Countries

2.5K

Destination ports

Traffic by type

Unrecognised

10,430 datagrams from 3.4K sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 10,430

Latest Unrecognised datagram, to 31065/udp

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Memcached	11211/udp	142	79	10,000 to 51,000
CharGEN	19/udp	80	50	358.8
mDNS	5353/udp	65	49	2 to 10
QOTD	17/udp	54	43	140.3
WS-Discovery	3702/udp	181	37	10 to 500
RIPv1	520/udp	54	34	131.24
SSDP	1900/udp	44	32	30.8
SNMPv2	161/udp	32	27	6.3
CLDAP	389/udp	118	7	56 to 70
TFTP	69/udp	9	7	60
Portmap	111/udp	8	5	7 to 28
NetBIOS	137/udp	9	3	3.8
NTP	123/udp	1	1	556.9

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

500/udp IKE311
1194/udp OpenVPN231
1434/udp MSSQL Browser224
3702/udp WS-Discovery181
11211/udp Memcached142
47808/udp BACnet139
4500/udp IPsec NAT-T134
3283/udp ARMS124
389/udp CLDAP118
27015/udp Steam117
5351/udp NAT-PMP115
443/udp QUIC113

Networks

AS7552 Viettel Group from 37 sources1,296
AS398324 Censys, Inc. from 94 sources1,008
AS8075 Microsoft Corporation from 488 sources765
AS396982 Google LLC from 463 sources666
AS6939 Hurricane Electric LLC from 402 sources615
AS14061 DigitalOcean, LLC from 57 sources530
AS20052 Arbor Networks, Inc. from 23 sources379
AS202425 IP Volume inc from 9 sources262
AS63949 Akamai Connected Cloud from 36 sources241
AS37963 Hangzhou Alibaba Advertising Co.,Ltd. from 30 sources220

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
141.98.83.48	AS209588 Flyservers S.A.	PA	Unrecognised	198	2026-10-11 04:17
117.3.123.242	AS7552 Viettel Group	VN	Unrecognised	143	2026-10-11 01:49
46.101.133.66	AS14061 DigitalOcean, LLC	DE	Unrecognised	135	2026-10-10 20:31
27.68.152.94	AS7552 Viettel Group	VN	Unrecognised	120	2026-10-10 14:15
27.66.49.95	AS7552 Viettel Group	VN	Unrecognised	89	2026-10-10 14:12
27.67.72.112	AS7552 Viettel Group	VN	Unrecognised	80	2026-10-10 13:56
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Unrecognised	79	2026-10-11 03:13
16.5.0.234	AS401661 EMBNEX, LLC	BR	Unrecognised	79	2026-10-05 19:17
125.234.228.207	AS7552 Viettel Group	VN	Unrecognised	78	2026-10-11 04:01
45.198.224.251	AS215925 Vpsvault.host Ltd	US	Unrecognised	76	2026-10-10 22:19
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	Unrecognised	74	2026-10-11 03:47
185.242.226.97	AS202425 IP Volume inc	US	Unrecognised	70	2026-10-11 04:22
185.242.226.68	AS202425 IP Volume inc	US	Unrecognised	69	2026-10-11 03:42
185.242.226.166	AS202425 IP Volume inc	US	Unrecognised	64	2026-10-11 02:56
171.255.158.106	AS7552 Viettel Group	VN	Unrecognised	62	2026-10-10 03:46
125.235.172.252	AS7552 Viettel Group	VN	Unrecognised	58	2026-10-10 23:46
66.132.172.247	AS398324 Censys, Inc.	US	Unrecognised	57	2026-10-10 23:16
125.234.229.115	AS7552 Viettel Group	VN	Unrecognised	56	2026-10-11 03:59
116.110.224.132	AS7552 Viettel Group	VN	Unrecognised	55	2026-10-11 01:28
104.237.240.112	AS16628 DedFiberCo	US	Unrecognised	53	2026-10-07 16:25

Latest datagrams

2026-10-11 04:23:57175.163.103.77to 31065/udpUnrecognisedCN

·&NT^·TY{·4Vx3·̅Kg&·

payload bytes

00000000  01 26 4e 54 5e da 54 59  7b 00 ff ff 00 fe fe fe  |.&NT^.TY{.......|
00000010  fe fd fd fd fd 12 34 56  78 33 de cc 85 4b 67 26  |......4Vx3...Kg&|
00000020  d9                                                |.|

2026-10-11 04:22:5845.194.70.251to 162/udpUnrecognisedSC

0·/·public· ·L3·V·0·0·+·

payload bytes

00000000  30 82 00 2f 02 01 00 04  06 70 75 62 6c 69 63 a0  |0../.....public.|
00000010  82 00 20 02 04 4c 33 a7  56 02 01 00 02 01 00 30  |.. ..L3.V......0|
00000020  82 00 10 30 82 00 0c 06  08 2b 06 01 02 01 01 05  |...0.....+......|
00000030  00 05 00                                          |...|

2026-10-11 04:22:55185.242.226.97to 40902/udpUnrecognisedUS
·
payload bytes
```
00000000  00                                                |.|
```

2026-10-11 04:22:4564.62.197.68to 34980/udpUnrecognisedUS

·0·

payload bytes

00000000  0e 10 07 02 00 00 30 01  02 00 00 00 00 00 00 00  |......0.........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00        |..............|

2026-10-11 04:22:3264.62.197.203to 5351/udpUnrecognisedUS
·
payload bytes
```
00000000  00 00                                             |..|
```

2026-10-11 04:22:1645.194.70.248to 1701/udpUnrecognisedSC

·<·nxn-spxn· · ·

payload bytes

00000000  c8 02 00 3c 00 00 00 00  00 00 00 00 80 08 00 00  |...<............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0e 00 00  |................|
00000020  00 07 6e 78 6e 2d 73 70  78 6e 80 0a 00 00 00 03  |..nxn-spxn......|
00000030  00 00 00 03 80 08 00 00  00 09 00 00              |............|

2026-10-11 04:22:0064.62.156.32to 10001/udpUnrecognisedUS
·
payload bytes
```
00000000  01 00 00 00                                       |....|
```

2026-10-11 04:21:0291.34.37.59to 5060/udpUnrecognisedDE

c.TvM;Ckc+·/H·+6·K%mN=QNg/_OEJ2·(OYk:<·Ul_f·f0`·.In}0·\·c&1dDZ3·EnZ\CF;*]·r

payload bytes

00000000  63 2e 54 76 4d 3b 43 6b  63 2b 1b 2f 48 11 2b 36  |c.TvM;Ckc+./H.+6|
00000010  00 18 4b 25 6d 4e 3d 51  4e 67 2f 5f 4f 45 4a 32  |..K%mN=QNg/_OEJ2|
00000020  01 1e 28 4f 59 6b 3a 3c  17 55 6c 5f 66 17 15 66  |..(OYk:<.Ul_f..f|
00000030  30 60 0b 1d 2e 49 6e 7d  30 1d 5c 7f 63 26 31 64  |0`...In}0.\.c&1d|
00000040  44 5a 33 1d 45 6e 5a 5c  43 46 3b 2a 5d 9a 72     |DZ3.EnZ\CF;*].r|

2026-10-11 04:17:08141.98.83.48to 11211/udpUnrecognisedPA

·stats

payload bytes

00000000  00 01 00 00 00 01 00 00  73 74 61 74 73 0d 0a     |........stats..|

2026-10-11 04:17:0065.49.20.122to 3389/udpUnrecognisedUS

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|

2026-10-11 04:16:39216.226.77.30to 1701/udpUnrecognisedUS

·X·Vigor· · 陀 · ·Draytek

payload bytes

00000000  c8 02 00 58 00 00 00 00  00 00 00 01 80 08 00 00  |...X............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0b 00 00  |................|
00000020  00 07 56 69 67 6f 72 80  0a 00 00 00 03 00 00 00  |..Vigor.........|
00000030  03 80 08 00 00 00 09 e9  99 80 0a 00 00 00 04 00  |................|
00000040  00 00 03 00 08 00 00 00  06 00 01 00 0d 00 00 00  |................|
00000050  08 44 72 61 79 74 65 6b                           |.Draytek|

2026-10-11 04:16:1664.62.197.20to 53413/udpUnrecognisedUS
payload bytes
```
00000000  0a                                                |.|
```
2026-10-11 04:15:53161.35.230.3to 443/udpUnrecognisedUS
8·*·6·
payload bytes
```
00000000  38 c7 d2 07 12 2a b5 36  17 00 00 00 00 00        |8....*.6......|
```
2026-10-11 04:15:37161.35.230.3to 8080/udpUnrecognisedUS
8·Z8NA·
payload bytes
```
00000000  38 c2 d4 c5 5a 38 4e 41  a8 00 00 00 00 00        |8...Z8NA......|
```
2026-10-11 04:15:29161.35.230.3to 9201/udpUnrecognisedUS
8·M{Lr·2·
payload bytes
```
00000000  38 bc 15 4d 7b 4c 72 9c  32 00 00 00 00 00        |8..M{Lr.2.....|
```