UDP traffic

Datagrams matching country:PA sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

21 datagrams from 3 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 5 NetBIOS 4 NTP 4 DNS 4 SOAP 2 CLDAP 1 SNMP 1

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

Unrecognised

40 datagrams from 3 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 40

Latest Unrecognised datagram, to 3702/udp

<:/>

payload bytes

00000000  3c 3a 2f 3e 0a                                    |<:/>.|

Peer-to-peer

17 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 17

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
WS-Discovery	3702/udp	7	3	10 to 500
Memcached	11211/udp	5	2	10,000 to 51,000
NTP	123/udp	4	2	556.9
NetBIOS	137/udp +1	4	2	3.8
CharGEN	19/udp	5	1	358.8
SSDP	1900/udp	5	1	30.8
DNS	53/udp	4	1	28 to 54
CLDAP	389/udp	1	1	56 to 70
SNMPv2	161/udp	1	1	6.3

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

39131/udp BitTorrent17
427/udp SLP7
3702/udp WS-Discovery7
37020/udp6
19/udp CharGEN5
1900/udp SSDP5
11211/udp Memcached5
53/udp DNS4
123/udp NTP4
37810/udp4
3283/udp ARMS3
57777/udp3

DNS questions

ferc.gov ANY4

DNS record types

ANY4

Networks

AS209588 Flyservers S.A. from 1 source48
AS11556 Cable & Wireless Panama from 1 source17
AS264617 GRUPO PANAGLOBAL 15 S.A from 2 sources13

Countries

PA Panama78

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
141.98.83.48	AS209588 Flyservers S.A.	PA	Unrecognised	48	2026-10-06 09:28
186.72.10.135	AS11556 Cable & Wireless Panama	PA	BitTorrent	17	2026-10-06 19:47
170.231.236.98	AS264617 GRUPO PANAGLOBAL 15 S.A	PA	NetBIOS	7	2026-10-06 16:15
170.231.237.214	AS264617 GRUPO PANAGLOBAL 15 S.A	PA	SOAP	6	2026-10-06 16:03

Latest datagrams

2026-10-06 19:47:18186.72.10.135to 39131/udpBitTorrentPA

A· ·F·

payload bytes

00000000  41 00 dd c5 0a b5 46 0f  00 00 00 00 00 10 00 00  |A.....F.........|
00000010  0b 89 00 00                                       |....|

2026-10-06 19:47:12186.72.10.135to 39131/udpBitTorrentPA

A· W·

payload bytes

00000000  41 00 dd c5 0a 57 bc f7  00 00 00 00 00 10 00 00  |A....W..........|
00000010  0b 89 00 00                                       |....|

2026-10-06 19:47:08186.72.10.135to 39131/udpBitTorrentPA

A· "·s·

payload bytes

00000000  41 00 dd c5 0a 22 a9 73  00 00 00 00 00 10 00 00  |A....".s........|
00000010  0b 89 00 00                                       |....|

2026-10-06 19:45:32186.72.10.135to 39131/udpBitTorrentPA

A·3·k·T·

payload bytes

00000000  41 00 33 bb 04 6b f7 e2  00 00 00 00 00 10 00 00  |A.3..k..........|
00000010  84 54 00 00                                       |.T..|

2026-10-06 19:45:26186.72.10.135to 39131/udpBitTorrentPA

A·3·B·T·

payload bytes

00000000  41 00 33 bb 04 0e ef 42  00 00 00 00 00 10 00 00  |A.3....B........|
00000010  84 54 00 00                                       |.T..|

2026-10-06 19:45:23186.72.10.135to 39131/udpBitTorrentPA

A·3·T·

payload bytes

00000000  41 00 33 bb 03 e0 91 ed  00 00 00 00 00 10 00 00  |A.3.............|
00000010  84 54 00 00                                       |.T..|

2026-10-06 19:44:43186.72.10.135to 39131/udpBitTorrentPA

d1:ad2:id20:#<·볦·<·>·$^ ·6:target20:#<·볦·<·>·$^ ·e1:q9:find_node1:t4:·1:v4:UT·x1:y1:qe

payload bytes

00000000  64 31 3a 61 64 32 3a 69  64 32 30 3a 23 3c fb f1  |d1:ad2:id20:#<..|
00000010  f1 bb e9 eb b3 a6 db 3c  87 0c 3e 99 24 5e 0d 90  |.......<..>.$^..|
00000020  36 3a 74 61 72 67 65 74  32 30 3a 23 3c fb f1 f1  |6:target20:#<...|
00000030  bb e9 eb b3 a6 db 3c 87  0c 3e 99 24 5e 0d 90 65  |......<..>.$^..e|
00000040  31 3a 71 39 3a 66 69 6e  64 5f 6e 6f 64 65 31 3a  |1:q9:find_node1:|
00000050  74 34 3a 9d 13 00 00 31  3a 76 34 3a 55 54 b8 78  |t4:....1:v4:UT.x|
00000060  31 3a 79 31 3a 71 65                              |1:y1:qe|

2026-10-06 16:15:02170.231.236.98to 389/udpCLDAPPA

0·-·c·$· · ·objectclass0·

payload bytes

00000000  30 84 00 00 00 2d 02 01  01 63 84 00 00 00 24 04  |0....-...c....$.|
00000010  00 0a 01 00 0a 01 00 02  01 00 02 01 00 01 01 00  |................|
00000020  87 0b 6f 62 6a 65 63 74  63 6c 61 73 73 30 84 00  |..objectclass0..|
00000030  00 00 00 00 0a                                    |.....|

2026-10-06 16:10:05170.231.236.98to 3702/udpUnrecognisedPA
<:/>
payload bytes
```
00000000  3c 3a 2f 3e 0a                                    |<:/>.|
```

2026-10-06 16:09:59170.231.236.98to 3702/udpSOAPPA

<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoa

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-06 16:03:49170.231.237.214to 3702/udpUnrecognisedPA
<:/>
payload bytes
```
00000000  3c 3a 2f 3e 0a                                    |<:/>.|
```

2026-10-06 16:03:43170.231.237.214to 3702/udpSOAPPA

payload bytes

00000000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
00000010  2e 30 22 20 65 6e 63 6f  64 69 6e 67 3d 22 75 74  |.0" encoding="ut|
00000020  66 2d 38 22 3f 3e 0a 3c  73 6f 61 70 3a 45 6e 76  |f-8"?>.<soap:Env|
00000030  65 6c 6f 70 65 20 78 6d  6c 6e 73 3a 73 6f 61 70  |elope xmlns:soap|
00000040  3d 22 68 74 74 70 3a 2f  2f 77 77 77 2e 77 33 2e  |="http://www.w3.|
00000050  6f 72 67 2f 32 30 30 33  2f 30 35 2f 73 6f 61 70  |org/2003/05/soap|
00000060  2d 65 6e 76 65 6c 6f 70  65 22 20 78 6d 6c 6e 73  |-envelope" xmlns|
00000070  3a 77 73 61 3d 22 68 74  74 70 3a 2f 2f 73 63 68  |:wsa="http://sch|
00000080  65 6d 61 73 2e 78 6d 6c  73 6f 61 70 2e 6f 72 67  |emas.xmlsoap.org|
00000090  2f 77 73 2f 32 30 30 34  2f 30 38 2f 61 64 64 72  |/ws/2004/08/addr|
000000a0  65 73 73 69 6e 67 22 20  78 6d 6c 6e 73 3a 77 73  |essing" xmlns:ws|
000000b0  64 3d 22 68 74 74 70 3a  2f 2f 73 63 68 65 6d 61  |d="http://schema|
000000c0  73 2e 78 6d 6c 73 6f 61  70 2e 6f 72 67 2f 77 73  |s.xmlsoap.org/ws|
000000d0  2f 32 30 30 35 2f 30 34  2f 64 69 73 63 6f 76 65  |/2005/04/discove|
000000e0  72 79 22 20 78 6d 6c 6e  73 3a 77 73 64 70 3d 22  |ry" xmlns:wsdp="|
000000f0  68 74 74 70 3a 2f 2f 73  63 68 65 6d 61 73 2e 78  |http://schemas.x|
... 512 bytes shown in part

2026-10-06 15:39:26170.231.236.98to 3389/udpUnrecognisedPA

·T·

payload bytes

00000000  00 00 00 00 00 00 00 ff  00 00 00 00 00 00 00 00  |................|
00000010  54 06                                             |T.|

2026-10-06 09:28:03141.98.83.48to 3702/udpUnrecognisedPA
<·>
payload bytes
```
00000000  3c aa 3e                                          |<.>|
```
2026-10-06 09:21:56141.98.83.48to 3702/udpUnrecognisedPA
<·>
payload bytes
```
00000000  3c aa 3e                                          |<.>|
```