UDP traffic

Datagrams matching ip:47.84.179.21 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

3 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 3

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Unrecognised

2 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 2

Latest Unrecognised datagram, to 5353/udp

payload bytes

00000000  00 00 00 00                                       |....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	5	1	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5353/udp DNS5

DNS questions

DNS record types

PTR1
TXT1
A1

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 1 source5

Countries

SG Singapore5

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
47.84.179.21	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	5	2026-10-06 17:04

Latest datagrams

2026-10-06 17:04:0947.84.179.21to 5353/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00 00 00                                       |....|
```

2026-10-06 17:03:5947.84.179.21to 5353/udpDNSSG

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 17:03:4947.84.179.21to 5353/udpDNSSG

DNS query A addons.g-fox.cn

payload bytes

00000000  f5 35 01 00 00 01 00 00  00 00 00 00 06 61 64 64  |.5...........add|
00000010  6f 6e 73 05 67 2d 66 6f  78 02 63 6e 00 00 01 00  |ons.g-fox.cn....|
00000020  01                                                |.|

2026-10-06 17:03:3847.84.179.21to 5353/udpDNSSG

DNS query TXT/CH authors.bind

payload bytes

00000000  18 02 01 00 00 01 00 00  00 00 00 00 07 61 75 74  |.............aut|
00000010  68 6f 72 73 04 62 69 6e  64 00 00 10 00 03        |hors.bind.....|

2026-10-06 17:03:2847.84.179.21to 5353/udpUnrecognisedSG

payload bytes

00000000  00 00 10 00 00 00 00 00  00 00 00 00              |............|