UDP traffic

Datagrams matching asn:264617 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

15 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

NetBIOS 6 NTP 4 CLDAP 3 SOAP 2

Latest NetBIOS datagram, to 139/udp

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

Unrecognised

8 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 8

Latest Unrecognised datagram, to 3702/udp

<:/>

payload bytes

00000000  3c 3a 2f 3e 0a                                    |<:/>.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
NetBIOS	139/udp +1	6	3	3.8
NTP	123/udp	4	2	556.9
WS-Discovery	3702/udp	4	2	10 to 500
CLDAP	389/udp	3	2	56 to 70
Memcached	11211/udp	2	2	10,000 to 51,000

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

123/udp NTP4
139/udp NetBIOS4
3389/udp4
3702/udp SOAP4
389/udp CLDAP3
137/udp NetBIOS2
11211/udp Memcached2

Networks

AS264617 GRUPO PANAGLOBAL 15 S.A from 3 sources23

Countries

PA Panama13
CH Switzerland10

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.191.236.38	AS264617 GRUPO PANAGLOBAL 15 S.A	CH	Unrecognised	10	2026-10-06 16:30
170.231.236.98	AS264617 GRUPO PANAGLOBAL 15 S.A	PA	NetBIOS	7	2026-10-06 16:15
170.231.237.214	AS264617 GRUPO PANAGLOBAL 15 S.A	PA	SOAP	6	2026-10-06 16:03

Latest datagrams

2026-10-06 16:30:55185.191.236.38to 389/udpCLDAPCH

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 16:22:29185.191.236.38to 389/udpCLDAPCH

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 16:15:02170.231.236.98to 389/udpCLDAPPA

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 16:10:05170.231.236.98to 3702/udpUnrecognisedPA
<:/>
payload bytes
```
00000000  3c 3a 2f 3e 0a                                    |<:/>.|
```

2026-10-06 16:09:59170.231.236.98to 3702/udpSOAPPA

<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoa

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-06 16:03:49170.231.237.214to 3702/udpUnrecognisedPA
<:/>
payload bytes
```
00000000  3c 3a 2f 3e 0a                                    |<:/>.|
```

2026-10-06 16:03:43170.231.237.214to 3702/udpSOAPPA

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-06 15:43:38185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 15:39:26170.231.236.98to 3389/udpUnrecognisedPA

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 15:28:11185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 15:27:38185.191.236.38to 3389/udpUnrecognisedCH

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 01:22:39170.231.236.98to 139/udpNetBIOSPA

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-06 01:22:36185.191.236.38to 139/udpNetBIOSCH

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-06 01:16:27170.231.236.98to 139/udpNetBIOSPA

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-06 01:04:49185.191.236.38to 139/udpNetBIOSCH

NetBIOS node status query *

payload bytes

00000000  e5 d8 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |............ CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|