UDP traffic

Datagrams matching port:111 sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

24 datagrams from 13 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 24

Latest Sun RPC datagram, to 111/udp

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Portmap	111/udp	24	13	7 to 28

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

111/udp Sun RPC24

Networks

AS6939 Hurricane Electric LLC from 6 sources7
AS209630 LLC Vash Kredit Bank from 1 source4
AS216014 BestDC Limited from 1 source4
AS215925 Vpsvault.host Ltd from 1 source4
AS20052 Arbor Networks, Inc. from 2 sources3
AS398324 Censys, Inc. from 1 source1
AS211298 Driftnet Ltd from 1 source1

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Sun RPC	4	2026-10-10 15:43
193.47.62.187	AS216014 BestDC Limited	BG	Sun RPC	4	2026-10-10 07:45
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	Sun RPC	4	2026-10-10 09:12
65.49.1.89	AS6939 Hurricane Electric LLC	US	Sun RPC	2	2026-10-11 01:14
146.88.241.110	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-10 11:52
64.62.156.52	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-11 01:33
64.62.156.57	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-10 07:57
216.218.206.69	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-10 09:37
146.88.241.130	AS20052 Arbor Networks, Inc.	US	Sun RPC	1	2026-10-10 14:21
216.218.206.85	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-10 08:57
64.62.197.71	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-11 00:34
193.163.125.161	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-10 11:03
66.132.186.215	AS398324 Censys, Inc.	US	Sun RPC	1	2026-10-10 10:44

Latest datagrams

2026-10-11 01:33:0664.62.156.52to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:14:5765.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:11:0365.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 00:34:0864.62.197.71to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:43:5445.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:23:3245.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:13:1545.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:57:5845.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:21:02146.88.241.130to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:52:18146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:30:05146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:03:15193.163.125.161to 111/udpSun RPCGB

x·Y·

payload bytes

00000000  78 be 59 c2 00 00 00 00  00 00 00 02 00 01 86 a0  |x.Y.............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 10:44:2866.132.186.215to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 09:37:40216.218.206.69to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 09:12:49151.243.11.230to 111/udpSun RPCAE

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|