UDP traffic

Datagrams matching proto:dns sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Protocols

dns from 31 sources83

Destination ports

53/udp from 10 sources29
137/udp from 6 sources16
5353/udp from 3 sources8
17185/udp from 3 sources7
5355/udp from 1 source5
111/udp from 2 sources2
123/udp from 1 source2
443/udp from 2 sources2
1629/udp from 1 source1
5349/udp from 1 source1
6301/udp from 1 source1
6953/udp from 1 source1

DNS questions

63 queries and 20 unsolicited answers. An answer nobody asked for means a resolver was given a forged source address.

DNS record types

SRV17
ANY14
A12
TXT10
PTR8
TYPE02

Networks

AS401661 EMBNEX, LLC from 1 source22
AS16509 Amazon.com, Inc. from 1 source11
AS398324 Censys, Inc. from 6 sources10
AS14061 DigitalOcean, LLC from 3 sources6
AS51396 Pfcloud UG (haftungsbeschrankt) from 2 sources5
AS209630 LLC Vash Kredit Bank from 1 source4
AS211298 Driftnet Ltd from 4 sources4
AS1103 SURF B.V. from 1 source3
AS63949 Akamai Connected Cloud from 1 source3
AS20052 Arbor Networks, Inc. from 2 sources3

Countries

Source addresses (unverified)

Address	Network	Cc	Datagrams	Last seen (UTC)
16.5.0.234	AS401661 EMBNEX, LLC	BR	22	2026-10-05 17:19
18.226.68.29	AS16509 Amazon.com, Inc.	US	11	2026-10-05 14:12
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	4	2026-10-05 16:04
66.132.172.254	AS398324 Censys, Inc.	US	4	2026-10-05 15:52
137.184.210.250	AS14061 DigitalOcean, LLC	US	3	2026-10-05 13:50
45.135.193.194	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	3	2026-10-05 13:31
172.104.155.101	AS63949 Akamai Connected Cloud	DE	3	2026-10-05 16:57
192.87.173.76	AS1103 SURF B.V.	NL	3	2026-10-05 13:13
194.164.107.4	AS50219 Valence Technology Co.	US	2	2026-10-05 13:22
146.88.241.80	AS20052 Arbor Networks, Inc.	US	2	2026-10-05 14:18
71.6.232.27	AS10439 CariNet, Inc.	US	2	2026-10-05 16:49
66.132.172.249	AS398324 Censys, Inc.	US	2	2026-10-05 17:04
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	2	2026-10-05 17:20
62.210.90.215	AS12876 Scaleway SAS	FR	2	2026-10-05 16:54
201.79.2.46	AS14061 DigitalOcean, LLC	DE	2	2026-10-05 16:48
146.88.240.27	AS20052 Arbor Networks, Inc.	US	1	2026-10-05 13:05
91.231.89.88	AS213412 ONYPHE SAS	FR	1	2026-10-05 14:39
91.230.168.216	AS213412 ONYPHE SAS	US	1	2026-10-05 14:37
199.45.154.183	AS398722 Censys, Inc.	US	1	2026-10-05 13:14
66.132.172.243	AS398324 Censys, Inc.	US	1	2026-10-05 13:59

Latest datagrams

2026-10-05 17:20:5045.135.193.115to 53/udpdnsDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-05 17:19:2016.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:17:5116.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:16:5716.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:11:4116.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:11:2116.5.0.234to 17185/udpdnsBR

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 17:04:2066.132.172.249to 6301/udpdnsUS

DNS query A ip.parrotdns.com

payload bytes

00000000  70 9a 01 00 00 01 00 00  00 00 00 01 02 69 70 09  |p............ip.|
00000010  70 61 72 72 6f 74 64 6e  73 03 63 6f 6d 00 00 01  |parrotdns.com...|
00000020  00 01 00 00 29 02 00 00  00 80 00 00 00           |....)........|

2026-10-05 17:01:5016.5.0.234to 5353/udpdnsBR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-05 17:01:3716.5.0.234to 5353/udpdnsBR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-05 16:59:3616.5.0.234to 5353/udpdnsBR

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-05 16:57:4116.5.0.234to 5355/udpdnsBR

DNS query ANY a

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 01 61 00 00  |.............a..|
00000010  ff 00 01                                          |...|

2026-10-05 16:57:17172.104.155.101to 5353/udpdnsDE

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-05 16:56:3716.5.0.234to 5355/udpdnsBR

DNS query ANY a

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 01 61 00 00  |.............a..|
00000010  ff 00 01                                          |...|

2026-10-05 16:54:1916.5.0.234to 5355/udpdnsBR

DNS query ANY a

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 01 61 00 00  |.............a..|
00000010  ff 00 01                                          |...|

2026-10-05 16:54:0162.210.90.215to 137/udpdnsFR

DNS query SRV CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

payload bytes

00000000  b3 2d 00 00 00 01 00 00  00 00 00 00 20 43 4b 41  |.-.......... CKA|
00000010  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  |AAAAAAAAAAAAAAAA|
00000020  41 41 41 41 41 41 41 41  41 41 41 41 41 00 00 21  |AAAAAAAAAAAAA..!|
00000030  00 01                                             |..|

2026-10-05 16:53:4416.5.0.234to 5355/udpdnsBR

DNS query ANY a

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 01 61 00 00  |.............a..|
00000010  ff 00 01                                          |...|

2026-10-05 16:52:4016.5.0.234to 5355/udpdnsBR

DNS query ANY a

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 01 61 00 00  |.............a..|
00000010  ff 00 01                                          |...|

2026-10-05 16:51:45193.163.125.144to 443/udpdnsGB

DNS response 15

payload bytes

00000000  16 fe fd 00 00 00 00 00  00 00 00 00 85 01 00 00  |................|
00000010  79 00 00 00 00 00 00 00  79 fe fd 1d 12 8f a2 8d  |y.......y.......|
00000020  71 3e 5f 1a 7d bd 07 8b  78 fc cf 3e 08 95 de 25  |q>_.}...x..>...%|
00000030  60 95 66 bd ed a2 36 b7  e9 6f dd 00 00 00 18 c0  |`.f...6..o......|
00000040  ac c0 ae c0 2b c0 2f c0  09 c0 13 c0 0a c0 14 c0  |....+./.........|
00000050  2c c0 30 cc a9 cc a8 01  00 00 37 00 0d 00 16 00  |,.0.......7.....|
00000060  14 04 03 05 03 06 03 08  07 08 04 08 05 08 06 04  |................|
00000070  01 05 01 06 01 ff 01 00  01 00 00 0a 00 0a 00 08  |................|
00000080  00 1d 00 17 00 18 00 19  00 0b 00 02 01 00 00 17  |................|
00000090  00 00                                             |..|

2026-10-05 16:49:5071.6.232.27to 53/udpdnsUS

DNS query A a.gtld-servers.net

payload bytes

00000000  05 39 01 00 00 01 00 00  00 00 00 00 01 61 0c 67  |.9...........a.g|
00000010  74 6c 64 2d 73 65 72 76  65 72 73 03 6e 65 74 00  |tld-servers.net.|
00000020  00 01 00 01                                       |....|

2026-10-05 16:48:36201.79.2.46to 123/udpdnsDE

DNS query TYPE0/CLASS0 .

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-05 16:48:33201.79.2.46to 123/udpdnsDE

DNS query TYPE0/CLASS0 .

payload bytes

00000000  e3 00 04 fa 00 01 00 00  00 01 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  c5 4f 23 4b 71 b1 52 f3  |.........O#Kq.R.|

2026-10-05 16:31:3945.135.193.115to 53/udpdnsDE

DNS query ANY dhitc.com

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 05 64 68 69  |.q...........dhi|
00000010  74 63 03 63 6f 6d 00 00  ff 00 01 00 00 29 ff ff  |tc.com.......)..|
00000020  00 00 00 00 00 00                                 |......|

2026-10-05 16:29:3371.6.232.27to 53/udpdnsUS

DNS query A a.gtld-servers.net

payload bytes

00000000  05 39 01 00 00 01 00 00  00 00 00 00 01 61 0c 67  |.9...........a.g|
00000010  74 6c 64 2d 73 65 72 76  65 72 73 03 6e 65 74 00  |tld-servers.net.|
00000020  00 01 00 01                                       |....|

2026-10-05 16:14:36104.248.129.131to 17185/udpdnsDE

DNS response 15

payload bytes

00000000  1a 09 fa ba 00 00 00 00  00 00 00 02 55 55 55 55  |............UUUU|
00000010  00 00 00 01 00 00 00 01  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  ff ff 55 12 00 00 00 3c  |..........U....<|
00000030  00 00 00 01 00 00 00 02  00 00 00 00 00 00 00 00  |................|

2026-10-05 16:04:59151.243.11.230to 53/udpdnsAE

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|