UDP traffic

Datagrams matching port:443 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

raw from 6 sources12
quic from 2 sources2
dns from 2 sources2
google from 1 source1
socks5 from 1 source1

Destination ports

443/udp from 10 sources18

QUIC versions

0xfa1a1a1a1
11

Networks

AS54290 Hostwinds LLC. from 2 sources6
AS14061 DigitalOcean, LLC from 1 source5
AS10439 CariNet, Inc. from 2 sources2
AS52539 SBS-NET TELECOMUNICACOES LTDA ME from 1 source1
AS263437 CARATINGA INFORMATICA LTDA - ME from 1 source1
AS9009 M247 Europe SRL from 1 source1
AS211298 Driftnet Ltd from 1 source1
AS45916 Gujarat Telelink Pvt Ltd from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
137.184.210.250	AS14061 DigitalOcean, LLC	US	5	2026-10-05 13:50
104.168.140.86	AS54290 Hostwinds LLC.	US	4	2026-10-05 15:34
104.168.132.113	AS54290 Hostwinds LLC.	US	2	2026-10-05 12:07
71.6.233.2	AS10439 CariNet, Inc.	US	1	2026-10-05 11:05
193.163.125.144	AS211298 Driftnet Ltd	GB	1	2026-10-05 16:51
103.238.108.241	AS45916 Gujarat Telelink Pvt Ltd	IN	1	2026-10-05 15:52
71.6.134.234	AS10439 CariNet, Inc.	US	1	2026-10-05 12:32
179.106.178.49	AS52539 SBS-NET TELECOMUNICACOES LTDA ME	BR	1	2026-10-05 12:16
185.200.118.46	AS9009 M247 Europe SRL	GB	1	2026-10-05 14:13
177.91.94.6	AS263437 CARATINGA INFORMATICA LTDA - ME	BR	1	2026-10-05 14:51

Latest datagrams

2026-10-05 16:51:45193.163.125.144to 443/udpdnsGB

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 1d 12 8f a2 8d  |y.......y.......|
00000020  71 3e 5f 1a 7d bd 07 8b  78 fc cf 3e 08 95 de 25  |q>_.}...x..>...%|
00000030  60 95 66 bd ed a2 36 b7  e9 6f dd 00 00 00 18 c0  |`.f...6..o......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-05 15:52:47103.238.108.241to 443/udpsocks5IN

·4Vx·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-05 15:34:02104.168.140.86to 443/udprawUS
·.·ȼ·x· ·'{ ·v·
payload bytes
2026-10-05 15:34:01104.168.140.86to 443/udprawUS
·.·ȼ·x· ·'{ ·v·
payload bytes
2026-10-05 15:20:18104.168.140.86to 443/udprawUS
·DX·s·x· ·h·^%·
payload bytes
2026-10-05 15:20:17104.168.140.86to 443/udprawUS
·DX·s·x· ·h·^%·
payload bytes

2026-10-05 14:51:43177.91.94.6to 443/udprawBR

·ϡ·4VxL·Yr·v·

payload bytes

00000000  01 14 15 e1 f9 b4 a9 cf  a1 00 ff ff 00 fe fe fe  |................|
00000010  fe fd fd fd fd 12 34 56  78 4c f7 10 59 72 81 76  |......4VxL..Yr.v|
00000020  d0                                                |.|

2026-10-05 14:13:13185.200.118.46to 443/udpgoogleGB

·.·cՄ·Q043·\·Ժ·C·C·CHLO·PAD·SNI·STK·,·VER·0·CCS·@·NONC`·AEADd·UAID·SCID·TCID·PDMD·SMHL·ICSL·NONP·PUBS·MIDS

payload bytes

00000000  0d 80 2e c4 63 d5 84 95  03 51 30 34 33 01 e5 1a  |....c....Q043...|
00000010  5c f8 aa aa d4 ba 10 43  de 43 a0 01 04 00 43 48  |\......C.C....CH|
00000020  4c 4f 19 00 00 00 50 41  44 00 e8 01 00 00 53 4e  |LO....PAD.....SN|
00000030  49 00 f6 01 00 00 53 54  4b 00 2c 02 00 00 56 45  |I.....STK.,...VE|
00000040  52 00 30 02 00 00 43 43  53 00 40 02 00 00 4e 4f  |R.0...CCS.@...NO|
00000050  4e 43 60 02 00 00 41 45  41 44 64 02 00 00 55 41  |NC`...AEADd...UA|
00000060  49 44 94 02 00 00 53 43  49 44 a4 02 00 00 54 43  |ID....SCID....TC|
00000070  49 44 a8 02 00 00 50 44  4d 44 ac 02 00 00 53 4d  |ID....PDMD....SM|
00000080  48 4c b0 02 00 00 49 43  53 4c b4 02 00 00 4e 4f  |HL....ICSL....NO|
00000090  4e 50 d4 02 00 00 50 55  42 53 f4 02 00 00 4d 49  |NP....PUBS....MI|
000000a0  44 53 f8 02 00 00 53 43  4c 53 fc 02 00 00 4b 45  |DS....SCLS....KE|
000000b0  58 53 00 03 00 00 58 4c  43 54 08 03 00 00 43 53  |XS....XLCT....CS|
000000c0  43 54 08 03 00 00 43 4f  50 54 14 03 00 00 43 43  |CT....COPT....CC|
000000d0  52 54 24 03 00 00 49 52  54 54 28 03 00 00 43 46  |RT$...IRTT(...CF|
000000e0  43 57 2c 03 00 00 53 46  43 57 30 03 00 00 2d 2d  |CW,...SFCW0...--|
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
... 512 bytes shown in part

2026-10-05 13:50:17137.184.210.250to 443/udpquicUS
QUIC v1 Initial (ClientHello incomplete, 65 bytes)

2026-10-05 13:50:11137.184.210.250to 443/udprawUS

r·*·Q999·

payload bytes

00000000  72 89 c1 9c 1c 2a ff fc  f1 51 39 39 39 00        |r....*...Q999.|

2026-10-05 13:50:10137.184.210.250to 443/udpdnsUS

DNS response 15

payload bytes

00000000  16 fe ff 00 00 00 00 00  00 00 00 00 91 01 00 00  |................|
00000010  85 00 00 00 00 00 00 00  85 fe fd 00 00 00 00 7c  |...............||
00000020  77 40 1e 8a c8 22 a0 a0  18 ff 93 08 ca ac 0a 64  |w@...".........d|
00000030  2f c9 22 64 bc 08 a8 16  89 19 30 00 00 00 24 c0  |/."d......0...$.|
00000040  2b c0 2f c0 2c c0 30 cc  a9 cc a8 c0 ac c0 ae c0  |+./.,.0.........|
00000050  09 c0 13 c0 0a c0 14 00  9c 00 9d 00 3c 00 2f 00  |............<./.|
00000060  35 00 0a 01 00 00 37 00  0a 00 0a 00 08 00 1d 00  |5.....7.........|
00000070  17 00 18 00 19 00 0b 00  02 01 00 00 0d 00 16 00  |................|
00000080  14 04 03 08 04 04 01 05  03 08 05 05 01 08 06 06  |................|
00000090  01 02 03 02 01 00 17 00  00 ff 01 00 01 00        |..............|

2026-10-05 13:50:05137.184.210.250to 443/udprawUS

8d·x·ˏ00000

payload bytes

00000000  38 64 c1 78 01 b8 9b cb  8f 30 30 30 30 30        |8d.x.....00000|

2026-10-05 13:49:52137.184.210.250to 443/udprawUS

12345678Q999·

payload bytes

00000000  0d 31 32 33 34 35 36 37  38 51 39 39 39 00        |.12345678Q999.|

2026-10-05 12:32:3171.6.134.234to 443/udpquicUS
QUIC version 0xfa1a1a1a probe

2026-10-05 12:16:03179.106.178.49to 443/udprawBR

·v·u·4Vxl{-·

payload bytes

00000000  01 fa 95 1a 95 76 94 be  75 00 ff ff 00 fe fe fe  |.....v..u.......|
00000010  fe fd fd fd fd 12 34 56  78 6c 7b 2d b0 fd f9 bc  |......4Vxl{-....|
00000020  0c                                                |.|

2026-10-05 12:07:42104.168.132.113to 443/udprawUS
0·v·
payload bytes
2026-10-05 12:07:40104.168.132.113to 443/udprawUS
0·v·
payload bytes

2026-10-05 11:05:4571.6.233.2to 443/udprawUS

·Q012·

payload bytes

00000000  0d 00 00 00 01 02 03 04  05 06 07 08 00 00 00 00  |................|
00000010  00 00 00 00 51 30 31 32  00 00 00 00              |....Q012....|