UDP traffic

Datagrams matching ip:43.98.186.223 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

4 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 2 SSDP 2

Latest DNS datagram, to 53/udp

DNS query TXT/CH version.bind

payload bytes

00000000  58 fd 01 20 00 01 00 00  00 00 00 00 07 76 65 72  |X.. .........ver|
00000010  73 69 6f 6e 04 62 69 6e  64 00 00 10 00 03 00     |sion.bind......|

Other services

4 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 1 TARGUSDATASPEED 1 Redis 1 SIP 1

Latest HTTP datagram, to 30311/udp

payload bytes

00000000  47 45 54 20 2f 47 61 72  64 20 48 54 54 50 2f 31  |GET /Gard HTTP/1|
00000010  2e 30 0d 0a 0d 0a                                 |.0....|

Unrecognised

21 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 21

Latest Unrecognised datagram, to 5005/udp

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

Peer-to-peer

1 datagrams from 1 source

File-sharing clients trying to reach a peer that used one of these addresses before. This is not scanning, so it is left out of every other figure on this page.

BitTorrent 1

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	2	1	30.8
mDNS	5353/udp	1	1	2 to 10
DNS	53/udp	1	1	28 to 54

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

1900/udp SSDP2
53/udp DNS1
28015/udp1
672/udp1
1604/udp Redis1
17185/udp1
2049/udp1
2424/udp1
512/udp1
4500/udp IPsec NAT-T1
5001/udp TARGUSDATASPEED1
5005/udp1

DNS questions

DNS record types

PTR1
TXT1

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 1 source30

Countries

SG Singapore30

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
43.98.186.223	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	30	2026-10-06 07:19

Latest datagrams

2026-10-06 07:19:3643.98.186.223to 5060/udpSIPSG

REGISTER sip:1000@192.168.1.2 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.2:32423;branch=z9hG4bK-0748629351;rport Max-Forwards: 70 To: 1000 <sip:1000@192.168.1.2> From: 5000 <sip:5000@192.168.1.2>;tag=2479

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 31 30 30  |REGISTER sip:100|
00000010  30 40 31 39 32 2e 31 36  38 2e 31 2e 32 20 53 49  |0@192.168.1.2 SI|
00000020  50 2f 32 2e 30 0d 0a 56  69 61 3a 20 53 49 50 2f  |P/2.0..Via: SIP/|
00000030  32 2e 30 2f 55 44 50 20  31 39 32 2e 31 36 38 2e  |2.0/UDP 192.168.|
00000040  31 2e 32 3a 33 32 34 32  33 3b 62 72 61 6e 63 68  |1.2:32423;branch|
00000050  3d 7a 39 68 47 34 62 4b  2d 30 37 34 38 36 32 39  |=z9hG4bK-0748629|
00000060  33 35 31 3b 72 70 6f 72  74 0d 0a 4d 61 78 2d 46  |351;rport..Max-F|
00000070  6f 72 77 61 72 64 73 3a  20 37 30 0d 0a 54 6f 3a  |orwards: 70..To:|
00000080  20 31 30 30 30 20 3c 73  69 70 3a 31 30 30 30 40  | 1000 <sip:1000@|
00000090  31 39 32 2e 31 36 38 2e  31 2e 32 3e 0d 0a 46 72  |192.168.1.2>..Fr|
000000a0  6f 6d 3a 20 35 30 30 30  20 3c 73 69 70 3a 35 30  |om: 5000 <sip:50|
000000b0  30 30 40 31 39 32 2e 31  36 38 2e 31 2e 32 3e 3b  |00@192.168.1.2>;|
000000c0  74 61 67 3d 32 34 37 39  33 34 0d 0a 43 61 6c 6c  |tag=247934..Call|
000000d0  2d 49 44 3a 20 7a 65 32  70 66 72 37 30 31 6c 38  |-ID: ze2pfr701l8|
000000e0  68 36 6d 6e 6b 69 61 78  73 35 63 71 64 33 75 77  |h6mnkiaxs5cqd3uw|
000000f0  33 35 31 38 39 0d 0a 43  53 65 71 3a 20 31 20 52  |35189..CSeq: 1 R|
... 360 bytes shown in part

2026-10-06 07:19:3143.98.186.223to 5005/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:18:5543.98.186.223to 5673/udpUnrecognisedSG

@·}5·1qaz2wsx3edc

payload bytes

00000000  40 01 7d 35 ff 31 71 61  7a 32 77 73 78 33 65 64  |@.}5.1qaz2wsx3ed|
00000010  63                                                |c|

2026-10-06 07:18:2843.98.186.223to 4500/udpUnrecognisedSG

1'·8· ·\·P·$·$· ·+Qi·}|·a· ·@H·

payload bytes

00000000  31 27 fc b0 38 10 9e 89  00 00 00 00 00 00 00 00  |1'..8...........|
00000010  01 10 02 00 00 00 00 00  00 00 00 cc 0d 00 00 5c  |...............\|
00000020  00 00 00 01 00 00 00 01  00 00 00 50 01 01 00 02  |...........P....|
00000030  03 00 00 24 01 01 00 00  80 01 00 05 80 02 00 02  |...$............|
00000040  80 04 00 02 80 03 00 03  80 0b 00 01 00 0c 00 04  |................|
00000050  00 00 0e 10 00 00 00 24  02 01 00 00 80 01 00 05  |.......$........|
00000060  80 02 00 01 80 04 00 02  80 03 00 03 80 0b 00 01  |................|
00000070  00 0c 00 04 00 00 0e 10  0d 00 00 18 1e 2b 51 69  |.............+Qi|
00000080  05 99 1c 7d 7c 96 fc bf  b5 87 e4 61 00 00 00 04  |...}|......a....|
00000090  0d 00 00 14 40 48 b7 d5  6e bc e8 85 25 e7 de 7f  |....@H..n...%...|
000000a0  00 d6 c2 d3 0d 00 00 14  90 cb 80 91 3e bb 69 6e  |............>.in|
000000b0  08 63 81 b5 ec 42 7b 1f  00 00 00 14 26 24 4d 38  |.c...B{.....&$M8|
000000c0  ed db 61 b3 17 2a 36 e3  d0 cf b8 19              |..a..*6.....|

2026-10-06 07:18:1843.98.186.223to 47808/udpUnrecognisedSG

· ·?·y

payload bytes

00000000  81 0a 00 11 01 04 00 05  01 0c 0c 02 3f ff ff 19  |............?...|
00000010  79                                                |y|

2026-10-06 07:18:0943.98.186.223to 5094/udpUnrecognisedSG

payload bytes

00000000  01 00 00 00 00 00 00 00  00 00 00                 |...........|

2026-10-06 07:17:4943.98.186.223to 32780/udpUnrecognisedSG

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-06 07:16:0943.98.186.223to 391/udpUnrecognisedSG

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|

2026-10-06 07:15:0943.98.186.223to 17185/udpUnrecognisedSG

·UUUU·U·0·

payload bytes

00000000  00 00 00 00 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 13 00 00 00 30  |..........U....0|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-06 07:14:3243.98.186.223to 2049/udpUnrecognisedSG

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-06 07:12:5043.98.186.223to 28015/udpUnrecognisedSG

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-06 07:12:4143.98.186.223to 10001/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00 00 00                                       |....|
```

2026-10-06 07:12:3343.98.186.223to 5001/udpTARGUSDATASPEEDSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:12:1643.98.186.223to 30718/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00 00 f6                                       |....|
```

2026-10-06 07:10:5843.98.186.223to 8161/udpUnrecognisedSG

0'·public·e(·0·0·+·

payload bytes

00000000  30 27 02 01 00 04 06 70  75 62 6c 69 63 a0 1a 02  |0'.....public...|
00000010  02 65 28 02 01 00 02 01  00 30 0e 30 0c 06 08 2b  |.e(......0.0...+|
00000020  06 01 02 01 01 01 00 05  00                       |.........|