UDP traffic

Datagrams matching ip:146.190.72.24 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 1 TFTP 1

Latest DNS datagram, to 53/udp

DNS query TXT/CH VERSION.BIND

payload bytes

00000000  34 ef 01 00 00 01 00 00  00 00 00 00 07 56 45 52  |4............VER|
00000010  53 49 4f 4e 04 42 49 4e  44 00 00 10 00 03        |SION.BIND.....|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

DTLS 1

Latest DTLS datagram, to 4433/udp

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

Unrecognised

17 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 17

Latest Unrecognised datagram, to 69/udp

0·r7tftp.txt0octet0

payload bytes

00000000  30 01 72 37 74 66 74 70  2e 74 78 74 30 6f 63 74  |0.r7tftp.txt0oct|
00000010  65 74 30                                          |et0|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
TFTP	69/udp	3	1	60
QOTD	17/udp	2	1	140.3
DNS	53/udp	1	1	28 to 54
CharGEN	19/udp	1	1	358.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

DNS questions

VERSION.BIND TXT1

DNS record types

TXT1

Networks

AS14061 DigitalOcean, LLC from 1 source20

Countries

US United States20

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
146.190.72.24	AS14061 DigitalOcean, LLC	US	Unrecognised	20	2026-10-06 17:05

Latest datagrams

2026-10-06 17:05:05146.190.72.24to 69/udpUnrecognisedUS

0·r7tftp.txt0octet0

payload bytes

00000000  30 01 72 37 74 66 74 70  2e 74 78 74 30 6f 63 74  |0.r7tftp.txt0oct|
00000010  65 74 30                                          |et0|

2026-10-06 17:05:04146.190.72.24to 80/udpUnrecognisedUS
r·*·Q999·
payload bytes
```
00000000  72 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |r....*...Q999.|
```

2026-10-06 17:05:03146.190.72.24to 4433/udpDTLSUS

·|w@·"·ʬ d/·"d·0·$·+·/·,·0̨̩· · ·<·/·5· ·7· · · ·

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

2026-10-06 17:05:02146.190.72.24to 88/udpUnrecognisedUS

j·n0·k· ·^0\·0P·0·NM·0·0·0·krbtgt·NM·19700101000000Z·٨·0·

payload bytes

00000000  6a 81 6e 30 81 6b a1 03  02 01 05 a2 03 02 01 0a  |j.n0.k..........|
00000010  a4 81 5e 30 5c a0 07 03  05 30 50 80 30 10 a2 04  |..^0\....0P.0...|
00000020  1b 02 4e 4d a3 17 30 15  a0 03 02 01 30 a1 0e 30  |..NM..0.....0..0|
00000030  0c 1b 06 6b 72 62 74 67  74 1b 02 4e 4d a5 11 18  |...krbtgt..NM...|
00000040  0f 31 39 37 30 30 31 30  31 30 30 30 30 30 30 5a  |.19700101000000Z|
00000050  a7 06 02 04 1f 1e b9 d9  a8 17 30 15 02 01 12 02  |..........0.....|
00000060  01 11 02 01 10 02 01 17  02 01 01 02 01 03 02 01  |................|
00000070  02                                                |.|

2026-10-06 17:04:59146.190.72.24to 42/udpUnrecognisedUS
helprnrn
payload bytes
```
00000000  68 65 6c 70 72 6e 72 6e                           |helprnrn|
```
2026-10-06 17:04:58146.190.72.24to 37/udpUnrecognisedUS
helprnrn
payload bytes
```
00000000  68 65 6c 70 72 6e 72 6e                           |helprnrn|
```
2026-10-06 17:04:57146.190.72.24to 13/udpUnrecognisedUS
helprnrn
payload bytes
```
00000000  68 65 6c 70 72 6e 72 6e                           |helprnrn|
```
2026-10-06 17:04:56146.190.72.24to 7/udpUnrecognisedUS
helprnrn
payload bytes
```
00000000  68 65 6c 70 72 6e 72 6e                           |helprnrn|
```
2026-10-06 17:04:55146.190.72.24to 69/udpUnrecognisedUS
00·000000000
payload bytes
```
00000000  30 30 10 30 30 30 30 30  30 30 30 30              |00.000000000|
```
2026-10-06 17:04:54146.190.72.24to 53/udpUnrecognisedUS
00·000000000
payload bytes
```
00000000  30 30 10 30 30 30 30 30  30 30 30 30              |00.000000000|
```

2026-10-06 17:04:53146.190.72.24to 53/udpUnrecognisedUS

0·00·000000·version·bind00·0·

payload bytes

00000000  30 06 01 30 30 01 30 30  30 30 30 30 07 76 65 72  |0..00.000000.ver|
00000010  73 69 6f 6e 04 62 69 6e  64 30 30 10 30 03        |sion.bind00.0.|

2026-10-06 17:04:52146.190.72.24to 88/udpUnrecognisedUS

r·0000000·0·0·|00000000000000000000

payload bytes

00000000  72 fe 1d 13 30 30 30 30  30 30 30 02 30 01 86 a0  |r...0000000.0...|
00000010  30 01 97 7c 30 30 30 30  30 30 30 30 30 30 30 30  |0..|000000000000|
00000020  30 30 30 30 30 30 30 30                           |00000000|

2026-10-06 17:04:51146.190.72.24to 17/udpUnrecognisedUS

r·0000000·0·0·|00000000000000000000

payload bytes

00000000  72 fe 1d 13 30 30 30 30  30 30 30 02 30 01 86 a0  |r...0000000.0...|
00000010  30 01 97 7c 30 30 30 30  30 30 30 30 30 30 30 30  |0..|000000000000|
00000020  30 30 30 30 30 30 30 30                           |00000000|

2026-10-06 17:04:50146.190.72.24to 4433/udpUnrecognisedUS
12345678Q999·
payload bytes
```
00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|
```
2026-10-06 17:04:49146.190.72.24to 80/udpUnrecognisedUS
12345678Q999·
payload bytes
```
00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|
```