UDP traffic

Datagrams matching qname:"Dns-udp-SCAN-0.IO.iNtERnETdAta.Io" sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

4 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 4

Latest DNS datagram, to 53/udp

DNS query A DNS-UDP-SCan-0.Io.iNtErnETdATa.io

payload bytes

00000000  14 3d 01 00 00 01 00 00  00 00 00 00 0e 44 4e 53  |.=...........DNS|
00000010  2d 55 44 50 2d 53 43 61  6e 2d 30 02 49 6f 0c 69  |-UDP-SCan-0.Io.i|
00000020  4e 74 45 72 6e 45 54 64  41 54 61 02 69 6f 00 00  |NtErnETdATa.io..|
00000030  01 00 01                                          |...|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	4	3	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS4

DNS questions

DNS record types

Networks

AS14061 DigitalOcean, LLC from 3 sources4

Countries

DE Germany4

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
46.101.178.100	AS14061 DigitalOcean, LLC	DE	DNS	2	2026-10-10 11:40
46.101.120.74	AS14061 DigitalOcean, LLC	DE	DNS	1	2026-10-06 11:11
164.92.184.210	AS14061 DigitalOcean, LLC	DE	DNS	1	2026-10-09 00:41

Latest datagrams

2026-10-10 11:40:0546.101.178.100to 53/udpDNSDE

DNS query A DNS-UDP-SCan-0.Io.iNtErnETdATa.io

payload bytes

00000000  14 3d 01 00 00 01 00 00  00 00 00 00 0e 44 4e 53  |.=...........DNS|
00000010  2d 55 44 50 2d 53 43 61  6e 2d 30 02 49 6f 0c 69  |-UDP-SCan-0.Io.i|
00000020  4e 74 45 72 6e 45 54 64  41 54 61 02 69 6f 00 00  |NtErnETdATa.io..|
00000030  01 00 01                                          |...|

2026-10-09 17:18:2846.101.178.100to 53/udpDNSDE

DNS query A DNS-UDP-SCan-0.Io.iNtErnETdATa.io

payload bytes

00000000  14 3d 01 00 00 01 00 00  00 00 00 00 0e 44 4e 53  |.=...........DNS|
00000010  2d 55 44 50 2d 53 43 61  6e 2d 30 02 49 6f 0c 69  |-UDP-SCan-0.Io.i|
00000020  4e 74 45 72 6e 45 54 64  41 54 61 02 69 6f 00 00  |NtErnETdATa.io..|
00000030  01 00 01                                          |...|

2026-10-09 00:41:33164.92.184.210to 53/udpDNSDE

DNS query A Dns-udp-SCAN-0.IO.iNtERnETdAta.Io

payload bytes

00000000  42 92 01 00 00 01 00 00  00 00 00 00 0e 44 6e 73  |B............Dns|
00000010  2d 75 64 70 2d 53 43 41  4e 2d 30 02 49 4f 0c 69  |-udp-SCAN-0.IO.i|
00000020  4e 74 45 52 6e 45 54 64  41 74 61 02 49 6f 00 00  |NtERnETdAta.Io..|
00000030  01 00 01                                          |...|

2026-10-06 11:11:3646.101.120.74to 53/udpDNSDE

DNS query A dnS-UDp-SCaN-0.IO.intErNetdaTa.iO

payload bytes

00000000  3b 89 01 00 00 01 00 00  00 00 00 00 0e 64 6e 53  |;............dnS|
00000010  2d 55 44 70 2d 53 43 61  4e 2d 30 02 49 4f 0c 69  |-UDp-SCaN-0.IO.i|
00000020  6e 74 45 72 4e 65 74 64  61 54 61 02 69 4f 00 00  |ntErNetdaTa.iO..|
00000030  01 00 01                                          |...|