UDP traffic
Datagrams matching ip:66.132.186.207 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
3
Datagrams
1
Source addresses
1
Networks
1
Countries
3
Destination ports
Traffic by type
Service queries
1 datagrams from 1 sourceRequests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.
Latest SOAP datagram, to 3702/udp
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x|
Unrecognised
2 datagrams from 1 sourceDatagrams no decoder recognised. Their first bytes are kept.
Latest Unrecognised datagram, to 44818/udp
payload bytes
00000000 63 00 00 00 00 00 00 00 00 00 00 00 00 00 63 65 |c.............ce| 00000010 6e 73 79 73 00 00 00 00 |nsys....|
Amplification checks
Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.
| Service | Port | Datagrams | Sources | Factor |
|---|---|---|---|---|
| WS-Discovery | 3702/udp | 1 | 1 | 10 to 500 |
The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 66.132.186.207 | AS398324 Censys, Inc. | US | Unrecognised | 3 | 2026-10-06 16:46 |
Latest datagrams
payload bytes
00000000 63 00 00 00 00 00 00 00 00 00 00 00 00 00 63 65 |c.............ce| 00000010 6e 73 79 73 00 00 00 00 |nsys....|
payload bytes
00000000 1a 09 fa ba 00 00 00 00 00 00 00 02 55 55 55 55 |............UUUU| 00000010 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 ff ff 55 12 00 00 00 3c |..........U....<| 00000030 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 00 |................|
payload bytes
00000000 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 |<?xml version="1| 00000010 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 |.0" encoding="ut| 00000020 66 2d 38 22 3f 3e 0a 3c 73 6f 61 70 3a 45 6e 76 |f-8"?>.<soap:Env| 00000030 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 6f 61 70 |elope xmlns:soap| 00000040 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e |="http://www.w3.| 00000050 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 |org/2003/05/soap| 00000060 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 |-envelope" xmlns| 00000070 3a 77 73 61 3d 22 68 74 74 70 3a 2f 2f 73 63 68 |:wsa="http://sch| 00000080 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 |emas.xmlsoap.org| 00000090 2f 77 73 2f 32 30 30 34 2f 30 38 2f 61 64 64 72 |/ws/2004/08/addr| 000000a0 65 73 73 69 6e 67 22 20 78 6d 6c 6e 73 3a 77 73 |essing" xmlns:ws| 000000b0 64 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 |d="http://schema| 000000c0 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 77 73 |s.xmlsoap.org/ws| 000000d0 2f 32 30 30 35 2f 30 34 2f 64 69 73 63 6f 76 65 |/2005/04/discove| 000000e0 72 79 22 20 78 6d 6c 6e 73 3a 77 73 64 70 3d 22 |ry" xmlns:wsdp="| 000000f0 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 |http://schemas.x| ... 512 bytes shown in part