UDP traffic

Datagrams matching ip:43.98.165.95 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

1 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SNMP 1

Latest SNMP datagram, to 162/udp

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|

Other services

5 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 2 GTP-U 1 STUN 1 RADIUS 1

Latest HTTP datagram, to 30313/udp

payload bytes

00000000  47 45 54 20 2f 47 61 72  64 20 48 54 54 50 2f 31  |GET /Gard HTTP/1|
00000010  2e 30 0d 0a 0d 0a                                 |.0....|

Unrecognised

28 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 28

Latest Unrecognised datagram, to 1993/udp

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Portmap	111/udp	1	1	7 to 28
SNMPv2	162/udp	1	1	6.3
WS-Discovery	3702/udp	1	1	10 to 500

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 1 source34

Countries

SG Singapore34

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
43.98.165.95	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	34	2026-10-06 07:19

Latest datagrams

2026-10-06 07:19:0343.98.165.95to 1993/udpUnrecognisedSG

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|

2026-10-06 07:18:5943.98.165.95to 5004/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:18:3443.98.165.95to 32778/udpUnrecognisedSG

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-06 07:18:2543.98.165.95to 162/udpSNMPSG

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|

2026-10-06 07:18:1943.98.165.95to 443/udpUnrecognisedSG
12345678Q999·
payload bytes
```
00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|
```

2026-10-06 07:18:0043.98.165.95to 2152/udpGTP-USG

2·

payload bytes

00000000  32 01 00 04 00 00 00 00  00 00 00 00              |2...........|

2026-10-06 07:17:4643.98.165.95to 3478/udpSTUNSG

·!·B7vyrtWmhOXqD

payload bytes

00000000  00 01 00 00 21 12 a4 42  37 76 79 72 74 57 6d 68  |....!..B7vyrtWmh|
00000010  4f 58 71 44                                       |OXqD|

2026-10-06 07:16:5943.98.165.95to 5093/udpUnrecognisedSG
z·
payload bytes
```
00000000  7a 00 00 00 00 00                                 |z.....|
```

2026-10-06 07:16:4643.98.165.95to 626/udpUnrecognisedSG

SNQUERY: 127.0.0.1:AAAAAA:xsvr

payload bytes

00000000  53 4e 51 55 45 52 59 3a  20 31 32 37 2e 30 2e 30  |SNQUERY: 127.0.0|
00000010  2e 31 3a 41 41 41 41 41  41 3a 78 73 76 72        |.1:AAAAAA:xsvr|

2026-10-06 07:16:4543.98.165.95to 5351/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00                                             |..|
```

2026-10-06 07:16:1143.98.165.95to 1812/udpRADIUSSG

·j·0·T·Θ·I·g·'· username·Ǣ·&D·ߡ·i-

payload bytes

00000000  01 6a 00 30 d3 18 54 b1  a8 15 ce 98 a3 aa 8d 49  |.j.0..T........I|
00000010  0e 67 e3 27 01 0a 75 73  65 72 6e 61 6d 65 02 12  |.g.'..username..|
00000020  12 c7 a2 02 f8 26 44 1f  f9 df a1 a8 a8 08 69 2d  |.....&D.......i-|

2026-10-06 07:16:0043.98.165.95to 2427/udpUnrecognisedSG

RQNT 67184230 aaln/1@example.net MGCP 1.0 X: 13 2F3005001FF R: L/hu(N),L/hf(N)

payload bytes

00000000  52 51 4e 54 20 36 37 31  38 34 32 33 30 20 61 61  |RQNT 67184230 aa|
00000010  6c 6e 2f 31 40 65 78 61  6d 70 6c 65 2e 6e 65 74  |ln/1@example.net|
00000020  20 4d 47 43 50 20 31 2e  30 0a 58 3a 20 31 33 20  | MGCP 1.0.X: 13 |
00000030  32 46 33 30 30 35 30 30  31 46 46 0a 52 3a 20 4c  |2F3005001FF.R: L|
00000040  2f 68 75 28 4e 29 2c 4c  2f 68 66 28 4e 29        |/hu(N),L/hf(N)|

2026-10-06 07:15:3343.98.165.95to 32769/udpUnrecognisedSG

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-06 07:15:2343.98.165.95to 3283/udpUnrecognisedSG
·
payload bytes
```
00000000  00 14 00 01 03                                    |.....|
```

2026-10-06 07:15:0243.98.165.95to 6003/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|