UDP traffic

Datagrams matching port:1900 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

50 datagrams from 23 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 50

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

Unrecognised

8 datagrams from 8 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 8

Latest Unrecognised datagram, to 1900/udp

L.so·?·nYZ/Y·E·-·.·h%x_·qtL>·?-·E·X·31"x4?&OQTWb=}Z·^·*L jy5i?8A^T·

payload bytes

00000000  4c 2e 73 6f 01 3f 18 6e  59 5a 2f 59 03 45 02 1d  |L.so.?.nYZ/Y.E..|
00000010  2d 1b 12 2e 08 10 68 25  78 5f 1b 03 71 74 4c 3e  |-.....h%x_..qtL>|
00000020  13 3f 2d 15 7f 45 03 58  1f 33 31 22 78 34 3f 26  |.?-..E.X.31"x4?&|
00000030  4f 51 54 57 62 3d 7d 5a  1c 18 5e 0e 0c 2a 4c 20  |OQTWb=}Z..^..*L |
00000040  6a 79 35 69 3f 38 41 5e  54 99                    |jy5i?8A^T.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	58	31	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

1900/udp SSDP58

Networks

AS215925 Vpsvault.host Ltd from 2 sources14
AS209630 LLC Vash Kredit Bank from 1 source8
AS20052 Arbor Networks, Inc. from 5 sources5
AS51115 HLL LLC from 1 source4
AS216014 BestDC Limited from 1 source4
AS396982 Google LLC from 4 sources4
AS8075 Microsoft Corporation from 4 sources4
AS6939 Hurricane Electric LLC from 4 sources4
AS209588 Flyservers S.A. from 1 source3
AS14061 DigitalOcean, LLC from 2 sources2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	SSDP	8	2026-10-10 19:09
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SSDP	8	2026-10-10 12:02
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	SSDP	6	2026-10-10 22:05
193.47.62.187	AS216014 BestDC Limited	BG	SSDP	4	2026-10-10 22:38
185.94.111.1	AS51115 HLL LLC	RU	SSDP	4	2026-10-11 02:25
141.98.83.48	AS209588 Flyservers S.A.	PA	SSDP	3	2026-10-11 03:36
146.190.66.18	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-10 07:45
162.35.175.206	AS19318 Interserver, Inc	US	Unrecognised	1	2026-10-10 18:52
20.14.76.11	AS8075 Microsoft Corporation	US	SSDP	1	2026-10-10 22:34
62.210.89.150	AS12876 Scaleway SAS	FR	Unrecognised	1	2026-10-10 14:45
20.40.214.173	AS8075 Microsoft Corporation	US	SSDP	1	2026-10-10 22:40
147.185.132.76	AS396982 Google LLC	US	SSDP	1	2026-10-11 00:10
20.29.53.174	AS8075 Microsoft Corporation	US	SSDP	1	2026-10-10 22:40
174.138.216.234	AS11814 Distributel Communications Limited	CA	Unrecognised	1	2026-10-10 18:16
147.185.132.9	AS396982 Google LLC	US	SSDP	1	2026-10-10 07:47
65.49.1.221	AS6939 Hurricane Electric LLC	US	SSDP	1	2026-10-10 07:32
146.88.241.90	AS20052 Arbor Networks, Inc.	US	SSDP	1	2026-10-10 05:00
198.235.24.39	AS396982 Google LLC	US	SSDP	1	2026-10-10 16:12
146.88.241.70	AS20052 Arbor Networks, Inc.	US	SSDP	1	2026-10-10 13:12
204.48.22.204	AS14061 DigitalOcean, LLC	US	Unrecognised	1	2026-10-11 02:50

Latest datagrams

2026-10-11 03:36:14141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 03:21:41141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 03:12:12141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 02:55:3564.62.197.80to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 02:50:44204.48.22.204to 1900/udpUnrecognisedUS

L.so·?·nYZ/Y·E·-·.·h%x_·qtL>·?-·E·X·31"x4?&OQTWb=}Z·^·*L jy5i?8A^T·

payload bytes

00000000  4c 2e 73 6f 01 3f 18 6e  59 5a 2f 59 03 45 02 1d  |L.so.?.nYZ/Y.E..|
00000010  2d 1b 12 2e 08 10 68 25  78 5f 1b 03 71 74 4c 3e  |-.....h%x_..qtL>|
00000020  13 3f 2d 15 7f 45 03 58  1f 33 31 22 78 34 3f 26  |.?-..E.X.31"x4?&|
00000030  4f 51 54 57 62 3d 7d 5a  1c 18 5e 0e 0c 2a 4c 20  |OQTWb=}Z..^..*L |
00000040  6a 79 35 69 3f 38 41 5e  54 99                    |jy5i?8A^T.|

2026-10-11 02:33:01195.85.207.31to 1900/udpUnrecognisedTR
d.'wPJ]31_·
payload bytes
```
00000000  64 2e 27 77 50 4a 5d 33  31 5f f0                 |d.'wPJ]31_.|
```

2026-10-11 02:25:49185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:18:51185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:07:07185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:02:08185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 00:10:42147.185.132.76to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-10 22:40:3720.40.214.173to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:40:0320.29.53.174to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:39:5452.165.97.149to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:38:25193.47.62.187to 1900/udpSSDPBG

M-SEARCH * HTTP/1.1 HOST:239.255.255.250:1900 ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0a 48 4f 53 54  3a 32 33 39 2e 32 35 35  |1.1.HOST:239.255|
00000020  2e 32 35 35 2e 32 35 30  3a 31 39 30 30 0a 53 54  |.255.250:1900.ST|
00000030  3a 73 73 64 70 3a 61 6c  6c 0a 4d 41 4e 3a 22 73  |:ssdp:all.MAN:"s|
00000040  73 64 70 3a 64 69 73 63  6f 76 65 72 22 0a 0a     |sdp:discover"..|