UDP traffic

Datagrams matching port:1900 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

394

Datagrams

151

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

350 datagrams from 119 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 350

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

Unrecognised

44 datagrams from 32 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 44

Latest Unrecognised datagram, to 1900/udp

L.so·?·nYZ/Y·E·-·.·h%x_·qtL>·?-·E·X·31"x4?&OQTWb=}Z·^·*L jy5i?8A^T·

payload bytes

00000000  4c 2e 73 6f 01 3f 18 6e  59 5a 2f 59 03 45 02 1d  |L.so.?.nYZ/Y.E..|
00000010  2d 1b 12 2e 08 10 68 25  78 5f 1b 03 71 74 4c 3e  |-.....h%x_..qtL>|
00000020  13 3f 2d 15 7f 45 03 58  1f 33 31 22 78 34 3f 26  |.?-..E.X.31"x4?&|
00000030  4f 51 54 57 62 3d 7d 5a  1c 18 5e 0e 0c 2a 4c 20  |OQTWb=}Z..^..*L |
00000040  6a 79 35 69 3f 38 41 5e  54 99                    |jy5i?8A^T.|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	394	151	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

1900/udp SSDP394

Networks

AS403005 Blatant from 1 source69
AS215925 Vpsvault.host Ltd from 2 sources59
AS209630 LLC Vash Kredit Bank from 1 source40
AS396982 Google LLC from 36 sources37
AS209588 Flyservers S.A. from 1 source19
AS6939 Hurricane Electric LLC from 19 sources19
AS20052 Arbor Networks, Inc. from 10 sources15
AS14061 DigitalOcean, LLC from 8 sources14
AS8075 Microsoft Corporation from 12 sources12
AS51115 HLL LLC from 1 source12

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
31.56.19.21	AS403005 Blatant	AE	SSDP	69	2026-10-05 15:49
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	SSDP	40	2026-10-10 19:09
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SSDP	32	2026-10-10 12:02
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	SSDP	27	2026-10-10 22:05
141.98.83.48	AS209588 Flyservers S.A.	PA	SSDP	19	2026-10-11 03:36
185.94.111.1	AS51115 HLL LLC	RU	SSDP	12	2026-10-11 02:25
16.5.0.234	AS401661 EMBNEX, LLC	BR	SSDP	8	2026-10-05 20:44
193.47.62.187	AS216014 BestDC Limited	BG	SSDP	4	2026-10-10 22:38
52.73.169.169	AS14618 Amazon.com, Inc.	US	SSDP	4	2026-10-08 07:04
147.182.218.22	AS14061 DigitalOcean, LLC	US	SSDP	4	2026-10-07 22:16
172.105.13.33	AS63949 Akamai Connected Cloud	CA	SSDP	4	2026-10-07 18:59
147.203.255.20	AS11320 LightEdge Solutions	US	SSDP	4	2026-10-07 06:26
167.114.107.175	AS16276 OVH SAS	CA	Unrecognised	3	2026-10-07 14:11
146.190.66.18	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-10 07:45
102.216.212.122	AS329009 Spectrum Internet Service Ltd	GH	Unrecognised	3	2026-10-07 20:06
146.88.241.170	AS20052 Arbor Networks, Inc.	US	SSDP	3	2026-10-10 06:06
176.65.149.208	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	SSDP	3	2026-10-07 09:06
45.153.34.163	AS197170 TechTies Inc.	NL	Unrecognised	3	2026-10-06 03:53
188.92.79.113	AS43513 Sia Nano IT	LV	SSDP	2	2026-10-09 02:53
198.235.24.129	AS396982 Google LLC	US	SSDP	2	2026-10-09 16:43

Latest datagrams

2026-10-11 03:36:14141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 03:21:41141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 03:12:12141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 02:55:3564.62.197.80to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 02:50:44204.48.22.204to 1900/udpUnrecognisedUS

L.so·?·nYZ/Y·E·-·.·h%x_·qtL>·?-·E·X·31"x4?&OQTWb=}Z·^·*L jy5i?8A^T·

payload bytes

00000000  4c 2e 73 6f 01 3f 18 6e  59 5a 2f 59 03 45 02 1d  |L.so.?.nYZ/Y.E..|
00000010  2d 1b 12 2e 08 10 68 25  78 5f 1b 03 71 74 4c 3e  |-.....h%x_..qtL>|
00000020  13 3f 2d 15 7f 45 03 58  1f 33 31 22 78 34 3f 26  |.?-..E.X.31"x4?&|
00000030  4f 51 54 57 62 3d 7d 5a  1c 18 5e 0e 0c 2a 4c 20  |OQTWb=}Z..^..*L |
00000040  6a 79 35 69 3f 38 41 5e  54 99                    |jy5i?8A^T.|

2026-10-11 02:33:01195.85.207.31to 1900/udpUnrecognisedTR
d.'wPJ]31_·
payload bytes
```
00000000  64 2e 27 77 50 4a 5d 33  31 5f f0                 |d.'wPJ]31_.|
```

2026-10-11 02:25:49185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 02:18:51185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:07:07185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 01:02:08185.94.111.1to 1900/udpSSDPRU

M-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 Man: "ssdp:discover" MX: 3 ST: ssdp:all

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1..Host: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 0d  |55.255.250:1900.|
00000030  0a 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |.Man: "ssdp:disc|
00000040  6f 76 65 72 22 0d 0a 4d  58 3a 20 33 0d 0a 53 54  |over"..MX: 3..ST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 0d 0a 0d 0a        |: ssdp:all....|

2026-10-11 00:10:42147.185.132.76to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-10 22:40:3720.40.214.173to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:40:0320.29.53.174to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:39:5452.165.97.149to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-10 22:38:25193.47.62.187to 1900/udpSSDPBG

M-SEARCH * HTTP/1.1 HOST:239.255.255.250:1900 ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0a 48 4f 53 54  3a 32 33 39 2e 32 35 35  |1.1.HOST:239.255|
00000020  2e 32 35 35 2e 32 35 30  3a 31 39 30 30 0a 53 54  |.255.250:1900.ST|
00000030  3a 73 73 64 70 3a 61 6c  6c 0a 4d 41 4e 3a 22 73  |:ssdp:all.MAN:"s|
00000040  73 64 70 3a 64 69 73 63  6f 76 65 72 22 0a 0a     |sdp:discover"..|