UDP traffic

Datagrams matching country:SE sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

2 datagrams from 1 source

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 2

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:1

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 31 0d 0a 0d  |scover"..MX:1...|
00000060  0a                                                |.|

Other services

1 datagrams from 1 source

First packets of sessions with VPN, voice, tunnelling, database and management services.

SOCKS5 1

Latest SOCKS5 datagram, to 8780/udp

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Unrecognised

12 datagrams from 4 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 12

Latest Unrecognised datagram, to 5351/udp

·X

payload bytes

00000000  00 02 00 00 0f a0 82 e0  00 00 02 58              |...........X|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	2	1	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

AS42237 w1n ltd from 2 sources10
AS29518 Bredband2 AB from 2 sources3
AS3301 Telia Company AB from 1 source1
AS1257 Tele2 SWIPnet from 1 source1

Countries

SE Sweden15

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.217.1.242	AS42237 w1n ltd	SE	Unrecognised	8	2026-10-10 03:16
83.209.255.191	AS29518 Bredband2 AB	SE	Unrecognised	2	2026-10-06 23:22
185.246.128.192	AS42237 w1n ltd	SE	SSDP	2	2026-10-09 11:17
77.218.98.33	AS1257 Tele2 SWIPnet	SE	SOCKS5	1	2026-10-07 09:40
88.129.109.189	AS29518 Bredband2 AB	SE	Unrecognised	1	2026-10-07 20:23
81.235.9.131	AS3301 Telia Company AB	SE	Unrecognised	1	2026-10-05 19:11

Latest datagrams

2026-10-10 03:16:53185.217.1.242to 5351/udpUnrecognisedSE

·X

payload bytes

00000000  00 02 00 00 0f a0 82 e0  00 00 02 58              |...........X|

2026-10-09 23:12:55185.217.1.242to 5351/udpUnrecognisedSE
·5·X
payload bytes
```
00000000  00 02 00 00 0f a0 35 ab  00 00 02 58              |......5....X|
```

2026-10-09 11:17:57185.246.128.192to 1900/udpSSDPSE

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:1

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 31 0d 0a 0d  |scover"..MX:1...|
00000060  0a                                                |.|

2026-10-08 16:13:16185.217.1.242to 5351/udpUnrecognisedSE
·C·X
payload bytes
```
00000000  00 02 00 00 0f a0 43 dc  00 00 02 58              |......C....X|
```

2026-10-08 12:08:44185.217.1.242to 5351/udpUnrecognisedSE

·X

payload bytes

00000000  00 02 00 00 0f a0 99 fb  00 00 02 58              |...........X|

2026-10-07 20:23:4588.129.109.189to 17392/udpUnrecognisedSE

·W·["·x·4Vx&·(·

payload bytes

00000000  01 10 57 a2 5b 22 cf ef  78 00 ff ff 00 fe fe fe  |..W.["..x.......|
00000010  fe fd fd fd fd 12 34 56  78 26 ad 96 ca 28 9c 96  |......4Vx&...(..|
00000020  ca                                                |.|

2026-10-07 09:40:3077.218.98.33to 8780/udpSOCKS5SE

·4Vx ·

payload bytes

00000000  05 00 ff ff 00 fe fe fe  fe fd fd fd fd 12 34 56  |..............4V|
00000010  78 0a 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |x...............|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
... 512 bytes shown in part

2026-10-07 05:07:50185.217.1.242to 5351/udpUnrecognisedSE
·`W·X
payload bytes
```
00000000  00 02 00 00 0f a0 60 57  00 00 02 58              |......`W...X|
```
2026-10-07 01:03:28185.217.1.242to 5351/udpUnrecognisedSE
·\·X
payload bytes
```
00000000  00 02 00 00 0f a0 5c c0  00 00 02 58              |......\....X|
```

2026-10-06 23:22:1883.209.255.191to 6799/udpUnrecognisedSE

·^·%·4VxK·#?<u

payload bytes

00000000  01 5e 90 a3 f8 cc 25 b5  e7 00 ff ff 00 fe fe fe  |.^....%.........|
00000010  fe fd fd fd fd 12 34 56  78 4b 8e b6 da 23 3f 3c  |......4VxK...#?<|
00000020  75                                                |u|

2026-10-06 02:56:46185.246.128.192to 1900/udpSSDPSE

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:1

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 31 0d 0a 0d  |scover"..MX:1...|
00000060  0a                                                |.|

2026-10-05 19:11:0781.235.9.131to 9/udpUnrecognisedSE
·
payload bytes
```
00000000  00                                                |.|
```
2026-10-05 18:03:39185.217.1.242to 5351/udpUnrecognisedSE
·L ·X
payload bytes
```
00000000  00 02 00 00 0f a0 4c 09  00 00 02 58              |......L....X|
```

2026-10-05 14:15:5983.209.255.191to 42732/udpUnrecognisedSE

·+·4Vx·|·

payload bytes

00000000  01 07 ef f5 2b e1 88 05  f4 00 ff ff 00 fe fe fe  |....+...........|
00000010  fe fd fd fd fd 12 34 56  78 ae e3 17 03 a0 7c b9  |......4Vx.....|.|
00000020  03                                                |.|

2026-10-05 13:59:14185.217.1.242to 5351/udpUnrecognisedSE
·($·X
payload bytes
```
00000000  00 02 00 00 0f a0 28 24  00 00 02 58              |......($...X|
```