UDP traffic

Datagrams matching port:1900 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

407

Datagrams

161

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

361 datagrams from 127 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

SSDP 361

Latest SSDP datagram, to 1900/udp

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

Unrecognised

46 datagrams from 34 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 46

Latest Unrecognised datagram, to 1900/udp

·.0·q5o6pE>:|·.?· ;·#·[K·L·-(pL·!W·VF7F·u·|/G·<·`!w+:DA?qj/=zP·xH

payload bytes

00000000  1e 2e 30 0b 71 35 6f 36  70 45 3e 3a 7c 07 2e 3f  |..0.q5o6pE>:|..?|
00000010  1e 0d 3b 01 23 1e 5b 4b  19 4c 16 04 2d 28 70 4c  |..;.#.[K.L..-(pL|
00000020  10 21 57 01 56 46 37 46  0c 75 00 08 7c 2f 47 1b  |.!W.VF7F.u..|/G.|
00000030  3c 03 1c 60 21 77 2b 3a  44 41 3f 71 6a 2f 3d 7a  |<..`!w+:DA?qj/=z|
00000040  50 15 78 48                                       |P.xH|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
SSDP	1900/udp	407	161	30.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

1900/udp SSDP407

Networks

AS403005 Blatant from 1 source69
AS215925 Vpsvault.host Ltd from 2 sources59
AS209630 LLC Vash Kredit Bank from 1 source40
AS396982 Google LLC from 37 sources38
AS6939 Hurricane Electric LLC from 22 sources22
AS209588 Flyservers S.A. from 1 source19
AS14061 DigitalOcean, LLC from 9 sources17
AS20052 Arbor Networks, Inc. from 10 sources15
AS8075 Microsoft Corporation from 12 sources12
AS51115 HLL LLC from 1 source12

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
31.56.19.21	AS403005 Blatant	AE	SSDP	69	2026-10-05 15:49
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	SSDP	40	2026-10-10 19:09
45.198.224.251	AS215925 Vpsvault.host Ltd	US	SSDP	32	2026-10-10 12:02
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	SSDP	27	2026-10-10 22:05
141.98.83.48	AS209588 Flyservers S.A.	PA	SSDP	19	2026-10-11 03:36
185.94.111.1	AS51115 HLL LLC	RU	SSDP	12	2026-10-11 02:25
16.5.0.234	AS401661 EMBNEX, LLC	BR	SSDP	8	2026-10-05 20:44
147.203.255.20	AS11320 LightEdge Solutions	US	SSDP	4	2026-10-07 06:26
172.105.13.33	AS63949 Akamai Connected Cloud	CA	SSDP	4	2026-10-07 18:59
52.73.169.169	AS14618 Amazon.com, Inc.	US	SSDP	4	2026-10-08 07:04
147.182.218.22	AS14061 DigitalOcean, LLC	US	SSDP	4	2026-10-07 22:16
193.47.62.187	AS216014 BestDC Limited	BG	SSDP	4	2026-10-10 22:38
146.190.66.18	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-10 07:45
167.114.107.175	AS16276 OVH SAS	CA	Unrecognised	3	2026-10-07 14:11
176.65.149.208	AS51396 Pfcloud UG (haftungsbeschrankt)	NL	SSDP	3	2026-10-07 09:06
45.153.34.163	AS197170 TechTies Inc.	NL	Unrecognised	3	2026-10-06 03:53
167.99.224.157	AS14061 DigitalOcean, LLC	US	SSDP	3	2026-10-11 04:32
146.88.241.170	AS20052 Arbor Networks, Inc.	US	SSDP	3	2026-10-10 06:06
102.216.212.122	AS329009 Spectrum Internet Service Ltd	GH	Unrecognised	3	2026-10-07 20:06
91.230.168.216	AS213412 ONYPHE SAS	US	SSDP	2	2026-10-07 22:10

Latest datagrams

2026-10-11 08:46:28141.11.209.245to 1900/udpUnrecognisedNL

·.0·q5o6pE>:|·.?· ;·#·[K·L·-(pL·!W·VF7F·u·|/G·<·`!w+:DA?qj/=zP·xH

payload bytes

00000000  1e 2e 30 0b 71 35 6f 36  70 45 3e 3a 7c 07 2e 3f  |..0.q5o6pE>:|..?|
00000010  1e 0d 3b 01 23 1e 5b 4b  19 4c 16 04 2d 28 70 4c  |..;.#.[K.L..-(pL|
00000020  10 21 57 01 56 46 37 46  0c 75 00 08 7c 2f 47 1b  |.!W.VF7F.u..|/G.|
00000030  3c 03 1c 60 21 77 2b 3a  44 41 3f 71 6a 2f 3d 7a  |<..`!w+:DA?qj/=z|
00000040  50 15 78 48                                       |P.xH|

2026-10-11 08:11:0164.62.197.117to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 08:05:3065.49.1.205to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 07:47:1064.62.197.81to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 07:21:58172.245.90.204to 1900/udpUnrecognisedUS

·.&G·G(!\xIzdhXc9\·!lF'7@<"unqE}!kE$·

payload bytes

00000000  0f 2e 26 47 03 47 28 21  5c 78 49 7a 64 68 58 63  |..&G.G(!\xIzdhXc|
00000010  39 5c 1f 21 6c 46 27 37  40 3c 22 75 6e 71 45 7d  |9\.!lF'7@<"unqE}|
00000020  21 6b 45 24 a8 e7                                 |!kE$..|

2026-10-11 06:46:32205.210.31.57to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a                                                |.|

2026-10-11 05:59:09165.154.162.102to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 ST:upnp:rootdevice MAN:"SSDP:DISCOVER" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 53 54 3a  75 70 6e 70 3a 72 6f 6f  |1.1..ST:upnp:roo|
00000020  74 64 65 76 69 63 65 0d  0a 4d 41 4e 3a 22 53 53  |tdevice..MAN:"SS|
00000030  44 50 3a 44 49 53 43 4f  56 45 52 22 0d 0a 4d 58  |DP:DISCOVER"..MX|
00000040  3a 33 0d 0a 0d 0a                                 |:3....|

2026-10-11 05:52:37165.154.162.102to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 ST:upnp:rootdevice MAN:"SSDP:DISCOVER" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 53 54 3a  75 70 6e 70 3a 72 6f 6f  |1.1..ST:upnp:roo|
00000020  74 64 65 76 69 63 65 0d  0a 4d 41 4e 3a 22 53 53  |tdevice..MAN:"SS|
00000030  44 50 3a 44 49 53 43 4f  56 45 52 22 0d 0a 4d 58  |DP:DISCOVER"..MX|
00000040  3a 33 0d 0a 0d 0a                                 |:3....|

2026-10-11 05:50:07165.154.138.57to 1900/udpSSDPDE

M-SEARCH * HTTP/1.1 ST:upnp:rootdevice MAN:"SSDP:DISCOVER" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 53 54 3a  75 70 6e 70 3a 72 6f 6f  |1.1..ST:upnp:roo|
00000020  74 64 65 76 69 63 65 0d  0a 4d 41 4e 3a 22 53 53  |tdevice..MAN:"SS|
00000030  44 50 3a 44 49 53 43 4f  56 45 52 22 0d 0a 4d 58  |DP:DISCOVER"..MX|
00000040  3a 33 0d 0a 0d 0a                                 |:3....|

2026-10-11 05:49:36165.154.221.175to 1900/udpSSDPVN

M-SEARCH * HTTP/1.1 ST:upnp:rootdevice MAN:"SSDP:DISCOVER" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 53 54 3a  75 70 6e 70 3a 72 6f 6f  |1.1..ST:upnp:roo|
00000020  74 64 65 76 69 63 65 0d  0a 4d 41 4e 3a 22 53 53  |tdevice..MAN:"SS|
00000030  44 50 3a 44 49 53 43 4f  56 45 52 22 0d 0a 4d 58  |DP:DISCOVER"..MX|
00000040  3a 33 0d 0a 0d 0a                                 |:3....|

2026-10-11 04:32:19167.99.224.157to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1rnHost: 239.255.255.250:1900rnMan: "ssdp:discover"rnMX: 5rnST: ssdp:allrnrn

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 72 6e 48 6f 73  74 3a 20 32 33 39 2e 32  |1.1rnHost: 239.2|
00000020  35 35 2e 32 35 35 2e 32  35 30 3a 31 39 30 30 72  |55.255.250:1900r|
00000030  6e 4d 61 6e 3a 20 22 73  73 64 70 3a 64 69 73 63  |nMan: "ssdp:disc|
00000040  6f 76 65 72 22 72 6e 4d  58 3a 20 35 72 6e 53 54  |over"rnMX: 5rnST|
00000050  3a 20 73 73 64 70 3a 61  6c 6c 72 6e 72 6e        |: ssdp:allrnrn|

2026-10-11 04:32:12167.99.224.157to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:upnp:rootdevice Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 75 70 6e 70 3a  72 6f 6f 74 64 65 76 69  |ST:upnp:rootdevi|
00000040  63 65 0d 0a 4d 61 6e 3a  22 73 73 64 70 3a 64 69  |ce..Man:"ssdp:di|
00000050  73 63 6f 76 65 72 22 0d  0a 4d 58 3a 33 0d 0a 0d  |scover"..MX:3...|
00000060  0a 0d 0a                                          |...|

2026-10-11 04:32:10167.99.224.157to 1900/udpSSDPUS

M-SEARCH * HTTP/1.1 HOST:239.255.255.250:1900 ST:ssdp:all MAN:"ssdp:discover"

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 4f 53  54 3a 32 33 39 2e 32 35  |1.1..HOST:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 41 4e  |ST:ssdp:all..MAN|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 0d 0a                                       |....|

2026-10-11 03:36:14141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|

2026-10-11 03:21:41141.98.83.48to 1900/udpSSDPPA

M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:ssdp:all Man:"ssdp:discover" MX:3

payload bytes

00000000  4d 2d 53 45 41 52 43 48  20 2a 20 48 54 54 50 2f  |M-SEARCH * HTTP/|
00000010  31 2e 31 0d 0a 48 6f 73  74 3a 32 33 39 2e 32 35  |1.1..Host:239.25|
00000020  35 2e 32 35 35 2e 32 35  30 3a 31 39 30 30 0d 0a  |5.255.250:1900..|
00000030  53 54 3a 73 73 64 70 3a  61 6c 6c 0d 0a 4d 61 6e  |ST:ssdp:all..Man|
00000040  3a 22 73 73 64 70 3a 64  69 73 63 6f 76 65 72 22  |:"ssdp:discover"|
00000050  0d 0a 4d 58 3a 33 0d 0a  0d 0a                    |..MX:3....|