UDP traffic

Datagrams matching port:111 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

179

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

171 datagrams from 78 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 171

Latest Sun RPC datagram, to 111/udp

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Unrecognised

8 datagrams from 5 sources

Datagrams no decoder recognised. Their first bytes are kept.

Unrecognised 8

Latest Unrecognised datagram, to 111/udp

>·0000000·0·aN000000000000000000000000

payload bytes

00000000  3e ec e3 ca 30 30 30 30  30 30 30 02 30 bc 61 4e  |>...0000000.0.aN|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000020  30 30 30 30 30 30 30 30                           |00000000|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Portmap	111/udp	179	80	7 to 28

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

111/udp Sun RPC179

Networks

AS215925 Vpsvault.host Ltd from 2 sources32
AS216014 BestDC Limited from 1 source30
AS6939 Hurricane Electric LLC from 22 sources23
AS209630 LLC Vash Kredit Bank from 1 source12
AS398324 Censys, Inc. from 11 sources11
AS14061 DigitalOcean, LLC from 3 sources9
AS51115 HLL LLC from 1 source8
AS213412 ONYPHE SAS from 6 sources8
AS20052 Arbor Networks, Inc. from 5 sources8
AS202425 IP Volume inc from 2 sources7

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
193.47.62.187	AS216014 BestDC Limited	BG	Sun RPC	30	2026-10-10 07:45
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Sun RPC	20	2026-10-10 15:43
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	Sun RPC	12	2026-10-10 09:12
45.198.224.251	AS215925 Vpsvault.host Ltd	US	Sun RPC	12	2026-10-09 17:38
185.94.111.1	AS51115 HLL LLC	RU	Sun RPC	8	2026-10-08 23:30
185.242.226.87	AS202425 IP Volume inc	US	Sun RPC	6	2026-10-09 06:52
147.203.255.20	AS11320 LightEdge Solutions	US	Sun RPC	4	2026-10-07 18:44
206.189.14.75	AS14061 DigitalOcean, LLC	NL	Unrecognised	3	2026-10-07 00:19
137.184.210.250	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-05 13:50
157.230.83.56	AS14061 DigitalOcean, LLC	US	Unrecognised	3	2026-10-09 17:23
80.85.84.130	AS63949 Akamai Connected Cloud	GB	Sun RPC	3	2026-10-05 20:27
146.88.241.110	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-10 11:52
91.230.168.217	AS213412 ONYPHE SAS	US	Sun RPC	2	2026-10-09 23:09
91.231.89.89	AS213412 ONYPHE SAS	FR	Sun RPC	2	2026-10-09 23:24
146.88.241.130	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-10 14:21
65.49.1.89	AS6939 Hurricane Electric LLC	US	Sun RPC	2	2026-10-11 01:14
146.88.241.50	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-07 06:47
193.163.125.149	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-07 10:41
45.156.129.86	AS211680 Sistemas Informaticos, S.A.	PT	Sun RPC	1	2026-10-08 02:44
64.62.156.110	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-08 00:05

Latest datagrams

2026-10-11 01:33:0664.62.156.52to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:14:5765.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:11:0365.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 00:34:0864.62.197.71to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:43:5445.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:23:3245.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:13:1545.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:57:5845.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:21:02146.88.241.130to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:52:18146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:30:05146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:03:15193.163.125.161to 111/udpSun RPCGB

x·Y·

payload bytes

00000000  78 be 59 c2 00 00 00 00  00 00 00 02 00 01 86 a0  |x.Y.............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 10:44:2866.132.186.215to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 09:37:40216.218.206.69to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 09:12:49151.243.11.230to 111/udpSun RPCAE

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|