UDP traffic

Datagrams matching qname:"com" sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

125

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

125 datagrams from 48 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 125

Latest DNS datagram, to 53/udp

DNS query A 00065d87e9839cd7.1059.<HONEYPOT>.asertdnsresearch.com

Payload bytes withheld: they contain the sensor's address.

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	125	48	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS107
3369/udp DNS1
6301/udp DNS1
8718/udp DNS1
9472/udp DNS1
13746/udp DNS1
13910/udp DNS1
15234/udp DNS1
15319/udp DNS1
21814/udp DNS1
28057/udp DNS1
29227/udp DNS1

DNS questions

DNS record types

A82
ANY43

Networks

AS398324 Censys, Inc. from 13 sources31
AS51396 Pfcloud UG (haftungsbeschrankt) from 1 source27
AS16509 Amazon.com, Inc. from 5 sources13
AS51115 HLL LLC from 1 source12
AS63949 Akamai Connected Cloud from 1 source10
AS211298 Driftnet Ltd from 8 sources8
AS20052 Arbor Networks, Inc. from 6 sources7
AS215925 Vpsvault.host Ltd from 1 source3
AS10439 CariNet, Inc. from 3 sources3
AS24151 China Internet Network Infomation Center from 1 source2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	27	2026-10-11 02:15
66.132.172.249	AS398324 Censys, Inc.	US	DNS	18	2026-10-10 19:14
185.94.111.1	AS51115 HLL LLC	RU	DNS	12	2026-10-10 18:34
139.162.66.65	AS63949 Akamai Connected Cloud	JP	DNS	10	2026-10-10 18:01
13.58.25.240	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-07 13:16
18.226.68.29	AS16509 Amazon.com, Inc.	US	DNS	4	2026-10-06 13:13
45.205.1.148	AS215925 Vpsvault.host Ltd	BR	DNS	3	2026-10-06 14:12
66.132.186.218	AS398324 Censys, Inc.	US	DNS	2	2026-10-09 23:11
18.188.181.94	AS16509 Amazon.com, Inc.	US	DNS	2	2026-10-10 12:34
146.88.241.170	AS20052 Arbor Networks, Inc.	US	DNS	2	2026-10-11 03:09
42.83.147.32	AS24151 China Internet Network Infomation Center	CN	DNS	2	2026-10-06 12:39
52.14.245.101	AS16509 Amazon.com, Inc.	US	DNS	2	2026-10-08 12:08
185.191.236.38	AS264617 GRUPO PANAGLOBAL 15 S.A	CH	DNS	2	2026-10-06 23:51
146.88.241.20	AS20052 Arbor Networks, Inc.	US	DNS	1	2026-10-06 06:21
13.59.254.158	AS16509 Amazon.com, Inc.	US	DNS	1	2026-10-10 13:51
146.88.241.70	AS20052 Arbor Networks, Inc.	US	DNS	1	2026-10-06 07:45
66.132.224.24	AS398324 Censys, Inc.	US	DNS	1	2026-10-06 23:31
146.88.241.100	AS20052 Arbor Networks, Inc.	US	DNS	1	2026-10-11 03:03
193.163.125.173	AS211298 Driftnet Ltd	GB	DNS	1	2026-10-06 10:09
193.163.125.242	AS211298 Driftnet Ltd	GB	DNS	1	2026-10-10 13:39

Latest datagrams

2026-10-11 03:09:40146.88.241.170to 53/udpDNSUS
DNS query A 00065d87e9839cd7.1059.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.
2026-10-11 03:03:48146.88.241.100to 53/udpDNSUS
DNS query A 00065d87d48e32b8.522f.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 02:57:5866.132.224.19to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:29:5166.132.172.227to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-11 00:36:1245.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 00:05:27146.88.241.120to 53/udpDNSUS
DNS query A 00065d8556c75ea6.af52.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-10 23:43:21193.163.125.130to 53/udpDNSGB

DNS query A example.com

payload bytes

00000000  96 3b 01 20 00 01 00 00  00 00 00 00 07 65 78 61  |.;. .........exa|
00000010  6d 70 6c 65 03 63 6f 6d  00 00 01 00 01           |mple.com.....|

2026-10-10 23:16:5645.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-10 22:59:5866.132.159.43to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-10 20:50:1666.132.186.249to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-10 19:14:3066.132.172.249to 39445/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-10 18:56:4566.132.172.249to 3369/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-10 18:34:14185.94.111.1to 53/udpDNSRU

DNS query ANY com

payload bytes

00000000  48 53 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |HS...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|

2026-10-10 18:15:2566.132.186.221to 53/udpDNSUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|