UDP traffic

Datagrams matching qname:"sl" sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

30 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 30

Latest DNS datagram, to 53/udp

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp	30	3	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS30

DNS questions

sl ANY30

DNS record types

ANY30

Networks

AS219502 Storm Industries LLC from 2 sources29
AS51396 Pfcloud UG (haftungsbeschrankt) from 1 source1

Countries

NL The Netherlands30

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
94.154.43.109	AS219502 Storm Industries LLC	NL	DNS	21	2026-10-09 08:45
94.154.43.51	AS219502 Storm Industries LLC	NL	DNS	8	2026-10-09 17:50
176.65.149.188	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	DNS	1	2026-10-10 15:54

Latest datagrams

2026-10-10 15:54:27176.65.149.188to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 17:50:2094.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 17:43:5194.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 17:41:4794.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 17:40:0094.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 08:45:5094.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|

2026-10-09 08:20:1694.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|

2026-10-09 07:15:4394.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|

2026-10-09 07:07:4894.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|

2026-10-09 06:07:5694.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 06:04:5694.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 06:04:0394.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 06:03:1994.154.43.51to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 73 6c 00  |Eg...........sl.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-09 04:57:2994.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|

2026-10-09 04:40:4994.154.43.109to 53/udpDNSNL

DNS query ANY sl

payload bytes

00000000  f1 e8 01 20 00 01 00 00  00 00 00 01 02 73 6c 00  |... .........sl.|
00000010  00 ff 00 01 00 00 29 10  00 00 00 80 00 00 0c 00  |......).........|
00000020  0a 00 08 c0 4e d3 88 f7  91 6b b6                 |....N....k.|