UDP traffic

Datagrams matching ip:47.84.101.219 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

9 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 3 SNMP 3 CoAP 2 SSDP 1

Latest DNS datagram, to 520/udp

·D·

payload bytes

00000000  01 01 00 00 00 02 00 00  44 00 00 00 00 00 00 00  |........D.......|
00000010  00 00 00 00 00 00 00 0f                           |........|

Other services

4 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

HTTP 1 SIP 1 RTP 1 GTP-C 1

Latest HTTP datagram, to 30312/udp

payload bytes

00000000  47 45 54 20 2f 47 61 72  64 20 48 54 54 50 2f 31  |GET /Gard HTTP/1|
00000010  2e 30 0d 0a 0d 0a                                 |.0....|

Unrecognised

20 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 20

Latest Unrecognised datagram, to 1701/udp

·u· · ·albatross.dev.hsd.com.au·Microsoft· · ·

payload bytes

00000000  c8 02 00 75 00 00 00 00  00 00 00 00 80 08 00 00  |...u............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 01 80 0a  00 00 00 04 00 00 00 00  |................|
00000030  00 08 00 00 00 06 05 00  80 1e 00 00 00 07 61 6c  |..............al|
00000040  62 61 74 72 6f 73 73 2e  64 65 76 2e 68 73 64 2e  |batross.dev.hsd.|
00000050  63 6f 6d 2e 61 75 00 0f  00 00 00 08 4d 69 63 72  |com.au......Micr|
00000060  6f 73 6f 66 74 80 08 00  00 00 09 00 02 80 08 00  |osoft...........|
00000070  00 00 0a 00 08                                    |.....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	520/udp +1	3	1	28 to 54
SNMPv2	161/udp	3	1	6.3
TFTP	69/udp	1	1	60
SSDP	8888/udp	1	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

161/udp SNMP3
5683/udp CoAP2
2123/udp GTP-C2
520/udp DNS2
69/udp TFTP1
705/udp1
1024/udp1
623/udp DNS1
1701/udp L2TP1
427/udp SLP1
2425/udp1
3386/udp1

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 1 source33

Countries

SG Singapore33

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
47.84.101.219	AS45102 Alibaba (US) Technology Co., Ltd.	SG	Unrecognised	33	2026-10-06 07:47

Latest datagrams

2026-10-06 07:47:2847.84.101.219to 1701/udpUnrecognisedSG

·u· · ·albatross.dev.hsd.com.au·Microsoft· · ·

payload bytes

00000000  c8 02 00 75 00 00 00 00  00 00 00 00 80 08 00 00  |...u............|
00000010  00 00 00 01 80 08 00 00  00 02 01 00 80 0a 00 00  |................|
00000020  00 03 00 00 00 01 80 0a  00 00 00 04 00 00 00 00  |................|
00000030  00 08 00 00 00 06 05 00  80 1e 00 00 00 07 61 6c  |..............al|
00000040  62 61 74 72 6f 73 73 2e  64 65 76 2e 68 73 64 2e  |batross.dev.hsd.|
00000050  63 6f 6d 2e 61 75 00 0f  00 00 00 08 4d 69 63 72  |com.au......Micr|
00000060  6f 73 6f 66 74 80 08 00  00 00 09 00 02 80 08 00  |osoft...........|
00000070  00 00 0a 00 08                                    |.....|

2026-10-06 07:47:0047.84.101.219to 5061/udpSIPSG

REGISTER sip:1000@192.168.1.2 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.2:32423;branch=z9hG4bK-0748629351;rport Max-Forwards: 70 To: 1000 <sip:1000@192.168.1.2> From: 5000 <sip:5000@192.168.1.2>;tag=2479

payload bytes

00000000  52 45 47 49 53 54 45 52  20 73 69 70 3a 31 30 30  |REGISTER sip:100|
00000010  30 40 31 39 32 2e 31 36  38 2e 31 2e 32 20 53 49  |0@192.168.1.2 SI|
00000020  50 2f 32 2e 30 0d 0a 56  69 61 3a 20 53 49 50 2f  |P/2.0..Via: SIP/|
00000030  32 2e 30 2f 55 44 50 20  31 39 32 2e 31 36 38 2e  |2.0/UDP 192.168.|
00000040  31 2e 32 3a 33 32 34 32  33 3b 62 72 61 6e 63 68  |1.2:32423;branch|
00000050  3d 7a 39 68 47 34 62 4b  2d 30 37 34 38 36 32 39  |=z9hG4bK-0748629|
00000060  33 35 31 3b 72 70 6f 72  74 0d 0a 4d 61 78 2d 46  |351;rport..Max-F|
00000070  6f 72 77 61 72 64 73 3a  20 37 30 0d 0a 54 6f 3a  |orwards: 70..To:|
00000080  20 31 30 30 30 20 3c 73  69 70 3a 31 30 30 30 40  | 1000 <sip:1000@|
00000090  31 39 32 2e 31 36 38 2e  31 2e 32 3e 0d 0a 46 72  |192.168.1.2>..Fr|
000000a0  6f 6d 3a 20 35 30 30 30  20 3c 73 69 70 3a 35 30  |om: 5000 <sip:50|
000000b0  30 30 40 31 39 32 2e 31  36 38 2e 31 2e 32 3e 3b  |00@192.168.1.2>;|
000000c0  74 61 67 3d 32 34 37 39  33 34 0d 0a 43 61 6c 6c  |tag=247934..Call|
000000d0  2d 49 44 3a 20 7a 65 32  70 66 72 37 30 31 6c 38  |-ID: ze2pfr701l8|
000000e0  68 36 6d 6e 6b 69 61 78  73 35 63 71 64 33 75 77  |h6mnkiaxs5cqd3uw|
000000f0  33 35 31 38 39 0d 0a 43  53 65 71 3a 20 31 20 52  |35189..CSeq: 1 R|
... 360 bytes shown in part

2026-10-06 07:46:5647.84.101.219to 8888/udpSSDPSG

M-SEARCH * HTTP/1.1 Host:example.com ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 65 78 61 6d 70 6c  |1.1..Host:exampl|
00000020  65 2e 63 6f 6d 0d 0a 53  54 3a 75 70 6e 70 3a 72  |e.com..ST:upnp:r|
00000030  6f 6f 74 64 65 76 69 63  65 0d 0a 4d 61 6e 3a 22  |ootdevice..Man:"|
00000040  73 73 64 70 3a 64 69 73  63 6f 76 65 72 22 0d 0a  |ssdp:discover"..|
00000050  4d 58 3a 33 0d 0a 0d 0a                           |MX:3....|

2026-10-06 07:46:4747.84.101.219to 2425/udpUnrecognisedSG

1:100:test:test:32:Hello

payload bytes

00000000  31 3a 31 30 30 3a 74 65  73 74 3a 74 65 73 74 3a  |1:100:test:test:|
00000010  33 32 3a 48 65 6c 6c 6f                           |32:Hello|

2026-10-06 07:46:3147.84.101.219to 27015/udpUnrecognisedSG

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-06 07:46:2347.84.101.219to 5006/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:46:1047.84.101.219to 5683/udpCoAPSG

@·λ.well-known·core

payload bytes

00000000  40 01 01 ce bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

2026-10-06 07:46:1047.84.101.219to 5683/udpCoAPSG

@·˻.well-known·core

payload bytes

00000000  40 01 ed cb bb 2e 77 65  6c 6c 2d 6b 6e 6f 77 6e  |@.....well-known|
00000010  04 63 6f 72 65                                    |.core|

2026-10-06 07:44:3847.84.101.219to 6002/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:43:2647.84.101.219to 32768/udpUnrecognisedSG

r·|·

payload bytes

00000000  72 fe 1d 13 00 00 00 00  00 00 00 02 00 01 86 a0  |r...............|
00000010  00 01 97 7c 00 00 00 00  00 00 00 00 00 00 00 00  |...|............|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-06 07:43:0747.84.101.219to 1024/udpUnrecognisedSG

·TSource Engine Query·

payload bytes

00000000  ff ff ff ff 54 53 6f 75  72 63 65 20 45 6e 67 69  |....TSource Engi|
00000010  6e 65 20 51 75 65 72 79  00                       |ne Query.|

2026-10-06 07:42:5747.84.101.219to 4800/udpUnrecognisedSG
·
payload bytes
```
00000000  01 00 00 08 00 00 00 00                           |........|
```

2026-10-06 07:40:1347.84.101.219to 7005/udpUnrecognisedSG

{·13911111112{{.ip}}{{.port}}{

payload bytes

00000000  7b 01 00 16 31 33 39 31  31 31 31 31 31 31 32 7b  |{...13911111112{|
00000010  7b 2e 69 70 7d 7d 7b 7b  2e 70 6f 72 74 7d 7d 7b  |{.ip}}{{.port}}{|

2026-10-06 07:39:5147.84.101.219to 161/udpSNMPSG

09·public·,·c·0·0 · +·0 · +·

payload bytes

00000000  30 39 02 01 00 04 06 70  75 62 6c 69 63 a0 2c 02  |09.....public.,.|
00000010  04 1a de 63 8f 02 01 00  02 01 00 30 1e 30 0d 06  |...c.......0.0..|
00000020  09 2b 06 01 80 02 01 01  01 00 05 00 30 0d 06 09  |.+..........0...|
00000030  2b 06 01 80 02 01 01 05  00 05 00                 |+..........|

2026-10-06 07:39:5147.84.101.219to 161/udpSNMPSG

0(·private·e(·0·0·+·

payload bytes

00000000  30 28 02 01 00 04 07 70  72 69 76 61 74 65 a0 1a  |0(.....private..|
00000010  02 02 65 28 02 01 00 02  01 00 30 0e 30 0c 06 08  |..e(......0.0...|
00000020  2b 06 01 02 01 01 01 00  05 00                    |+.........|