UDP traffic

Datagrams matching qtype:ANY sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

202

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

202 datagrams from 28 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 202

Latest DNS datagram, to 53/udp

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +1	202	28	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS197
5355/udp DNS5

DNS questions

DNS record types

ANY202

Networks

AS215925 Vpsvault.host Ltd from 3 sources39
AS51396 Pfcloud UG (haftungsbeschrankt) from 3 sources37
AS219502 Storm Industries LLC from 2 sources30
AS209630 LLC Vash Kredit Bank from 1 source24
AS209605 UAB Host Baltic from 1 source19
AS209588 Flyservers S.A. from 1 source16
AS51115 HLL LLC from 1 source12
AS396982 Google LLC from 7 sources7
AS401661 EMBNEX, LLC from 1 source5
AS63949 Akamai Connected Cloud from 1 source4

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	27	2026-10-11 02:15
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	DNS	24	2026-10-09 20:04
94.154.43.109	AS219502 Storm Industries LLC	NL	DNS	22	2026-10-09 08:45
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	DNS	20	2026-10-11 01:20
141.98.11.129	AS209605 UAB Host Baltic	LT	DNS	19	2026-10-10 06:23
141.98.83.48	AS209588 Flyservers S.A.	PA	DNS	16	2026-10-10 05:46
45.198.224.251	AS215925 Vpsvault.host Ltd	US	DNS	16	2026-10-11 04:18
185.94.111.1	AS51115 HLL LLC	RU	DNS	12	2026-10-10 18:34
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	9	2026-10-11 00:15
94.154.43.51	AS219502 Storm Industries LLC	NL	DNS	8	2026-10-09 17:50
16.5.0.234	AS401661 EMBNEX, LLC	BR	DNS	5	2026-10-05 16:57
173.255.206.155	AS63949 Akamai Connected Cloud	US	DNS	4	2026-10-07 15:22
45.205.1.148	AS215925 Vpsvault.host Ltd	BR	DNS	3	2026-10-06 14:12
217.60.242.50	AS218970 Amin NezhadKahnoji	AE	DNS	3	2026-10-09 22:23
216.180.246.217	AS396982 Google LLC	US	DNS	1	2026-10-07 16:46
216.180.246.141	AS396982 Google LLC	US	DNS	1	2026-10-10 11:12
217.60.242.56	AS218970 Amin NezhadKahnoji	AE	DNS	1	2026-10-08 23:12
216.180.246.207	AS396982 Google LLC	US	DNS	1	2026-10-07 16:25
176.65.149.188	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	DNS	1	2026-10-10 15:54
216.180.246.101	AS396982 Google LLC	US	DNS	1	2026-10-10 11:02

Latest datagrams

2026-10-11 04:18:3845.198.224.251to 53/udpDNSUS

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 02:15:3345.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 01:20:1445.205.1.231to 53/udpDNSBR

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 00:49:0445.205.1.231to 53/udpDNSBR

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 00:41:2145.205.1.231to 53/udpDNSBR

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 00:36:1245.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-11 00:15:2145.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-11 00:02:2745.205.1.231to 53/udpDNSBR

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-10 23:16:5645.135.193.115to 53/udpDNSDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-10 22:31:0845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 22:14:5845.135.193.194to 53/udpDNSDE

DNS query ANY uu.nl

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 02 75 75 02  |Eg...........uu.|
00000010  6e 6c 00 00 ff 00 01 00  00 29 ff ff 00 00 00 00  |nl.......)......|
00000020  00 00                                             |..|

2026-10-10 18:34:14185.94.111.1to 53/udpDNSRU

DNS query ANY com

payload bytes

00000000  48 53 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |HS...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|

2026-10-10 17:53:49185.94.111.1to 53/udpDNSRU

DNS query ANY com

payload bytes

00000000  f9 20 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |. ...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|

2026-10-10 17:22:31185.94.111.1to 53/udpDNSRU

DNS query ANY com

payload bytes

00000000  eb 4f 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |.O...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|

2026-10-10 17:02:13185.94.111.1to 53/udpDNSRU

DNS query ANY com

payload bytes

00000000  3e 67 01 00 00 01 00 00  00 00 00 01 03 63 6f 6d  |>g...........com|
00000010  00 00 ff 00 01 00 00 29  10 00 00 00 00 00 00 00  |.......)........|