UDP traffic

Datagrams matching port:5353 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

28 datagrams from 21 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 28

Latest DNS datagram, to 5353/udp

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

Unrecognised

15 datagrams from 13 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 15

Latest Unrecognised datagram, to 5353/udp

payload bytes

00000000  00 00 00 00                                       |....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
mDNS	5353/udp	43	33	2 to 10

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

5353/udp DNS43

DNS questions

DNS record types

PTR26
TXT1
A1

Networks

AS45102 Alibaba (US) Technology Co., Ltd. from 3 sources7
AS396982 Google LLC from 4 sources4
AS63949 Akamai Connected Cloud from 2 sources4
AS8075 Microsoft Corporation from 4 sources4
AS6939 Hurricane Electric LLC from 4 sources4
AS401661 EMBNEX, LLC from 1 source3
AS50219 Valence Technology Co. from 1 source2
AS15964 CAMTEL from 1 source2
AS150968 PT Jaringanku Media Telekomunikasi from 1 source1
AS8560 IONOS SE from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
47.84.179.21	AS45102 Alibaba (US) Technology Co., Ltd.	SG	DNS	5	2026-10-06 17:04
16.5.0.234	AS401661 EMBNEX, LLC	BR	DNS	3	2026-10-05 17:01
172.104.155.101	AS63949 Akamai Connected Cloud	DE	DNS	3	2026-10-05 16:57
195.24.207.184	AS15964 CAMTEL	CM	Unrecognised	2	2026-10-06 04:23
194.164.107.4	AS50219 Valence Technology Co.	US	DNS	2	2026-10-05 13:22
38.99.239.208	AS398991 X99	US	Unrecognised	1	2026-10-06 05:29
74.82.47.4	AS6939 Hurricane Electric LLC	US	DNS	1	2026-10-06 06:35
20.169.85.54	AS8075 Microsoft Corporation	US	DNS	1	2026-10-06 17:00
65.49.1.36	AS6939 Hurricane Electric LLC	US	DNS	1	2026-10-06 00:39
40.124.123.178	AS8075 Microsoft Corporation	US	DNS	1	2026-10-06 17:00
14.225.1.210	AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GRO	VN	Unrecognised	1	2026-10-05 17:12
107.173.67.223	AS36352 HostPapa	US	Unrecognised	1	2026-10-06 02:07
175.30.48.142	AS4134 Chinanet	CN	DNS	1	2026-10-06 04:49
20.80.108.223	AS8075 Microsoft Corporation	US	DNS	1	2026-10-06 17:03
217.71.127.125	AS198545 Flex Network Sarl	FR	Unrecognised	1	2026-10-05 15:43
159.203.67.164	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-06 03:25
20.168.123.103	AS8075 Microsoft Corporation	US	DNS	1	2026-10-06 17:01
217.160.190.176	AS8560 IONOS SE	DE	Unrecognised	1	2026-10-05 14:59
103.123.175.6	AS150968 PT Jaringanku Media Telekomunikasi	ID	Unrecognised	1	2026-10-06 03:13
37.112.63.117	AS57044 JSC ER-Telecom Holding	RU	Unrecognised	1	2026-10-06 16:52

Latest datagrams

2026-10-06 17:04:0947.84.179.21to 5353/udpUnrecognisedSG
·
payload bytes
```
00000000  00 00 00 00                                       |....|
```

2026-10-06 17:03:5947.84.179.21to 5353/udpDNSSG

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 17:03:4947.84.179.21to 5353/udpDNSSG

DNS query A addons.g-fox.cn

payload bytes

00000000  f5 35 01 00 00 01 00 00  00 00 00 00 06 61 64 64  |.5...........add|
00000010  6f 6e 73 05 67 2d 66 6f  78 02 63 6e 00 00 01 00  |ons.g-fox.cn....|
00000020  01                                                |.|

2026-10-06 17:03:3847.84.179.21to 5353/udpDNSSG

DNS query TXT/CH authors.bind

payload bytes

00000000  18 02 01 00 00 01 00 00  00 00 00 00 07 61 75 74  |.............aut|
00000010  68 6f 72 73 04 62 69 6e  64 00 00 10 00 03        |hors.bind.....|

2026-10-06 17:03:3020.80.108.223to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 17:03:2847.84.179.21to 5353/udpUnrecognisedSG

payload bytes

00000000  00 00 10 00 00 00 00 00  00 00 00 00              |............|

2026-10-06 17:01:2720.168.123.103to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 17:00:5540.124.123.178to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 17:00:1920.169.85.54to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 16:52:1637.112.63.117to 5353/udpUnrecognisedRU
t.e·
payload bytes
```
00000000  74 2e 65 e3 ce                                    |t.e..|
```

2026-10-06 16:25:56172.235.50.127to 5353/udpUnrecognisedUS

·.vb·(·0+*_Q'nMc8f·U5·*_ /fhg$l·

payload bytes

00000000  1a 2e 76 62 18 28 02 30  2b 2a 5f 51 27 6e 4d 63  |..vb.(.0+*_Q'nMc|
00000010  38 66 08 55 35 04 2a 5f  20 2f 66 68 67 24 6c a8  |8f.U5.*_ /fhg$l.|
00000020  d2                                                |.|

2026-10-06 12:27:08192.168.42.19to 5353/udpUnrecognised
K.*M,·[b·
payload bytes
```
00000000  4b 2e 2a 4d 2c 0b 5b 62  1a e8                    |K.*M,.[b..|
```

2026-10-06 10:06:5162.210.89.150to 5353/udpUnrecognisedFR

m.g·L·-·B·t·'Yv·YZ7V^Fep`eKW!9L R_Uo·p1!·%.&·$-X~d.\*·L x·b·Q.## x·hD;hji·i ;A·oh·L

payload bytes

00000000  6d 2e 67 19 13 4c 1d 2d  1a 42 15 0f 74 0c 27 59  |m.g..L.-.B..t.'Y|
00000010  76 06 59 5a 37 56 5e 46  65 70 60 65 4b 57 21 39  |v.YZ7V^Fep`eKW!9|
00000020  4c 09 52 5f 55 6f 0c 70  31 21 7f 25 2e 26 7f 24  |L.R_Uo.p1!.%.&.$|
00000030  2d 58 7e 64 2e 5c 2a 13  4c 0a 78 18 62 1a 51 2e  |-X~d.\*.L.x.b.Q.|
00000040  23 23 0d 78 13 1a 68 44  3b 68 6a 69 0e 69 0d 3b  |##.x..hD;hji.i.;|
00000050  41 0b 1f 6f 68 cf 4c                              |A..oh.L|

2026-10-06 09:54:5466.132.172.232to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-06 07:06:4743.98.186.223to 5353/udpDNSSG

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|