UDP traffic

Datagrams matching proto:nfs sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

201

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

201 datagrams from 95 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 201

Latest Sun RPC datagram, to 111/udp

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Portmap	111/udp	171	78	7 to 28

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

111/udp Sun RPC171
500/udp Sun RPC9
2049/udp Sun RPC9
4378/udp Sun RPC1
7360/udp Sun RPC1
8252/udp Sun RPC1
8674/udp Sun RPC1
18058/udp Sun RPC1
18788/udp Sun RPC1
31078/udp Sun RPC1
35384/udp Sun RPC1
44807/udp Sun RPC1

Networks

AS215925 Vpsvault.host Ltd from 2 sources32
AS216014 BestDC Limited from 1 source30
AS6939 Hurricane Electric LLC from 22 sources23
AS398324 Censys, Inc. from 12 sources22
AS20052 Arbor Networks, Inc. from 12 sources17
AS211298 Driftnet Ltd from 14 sources15
AS209630 LLC Vash Kredit Bank from 1 source12
AS51115 HLL LLC from 1 source8
AS213412 ONYPHE SAS from 6 sources8
AS202425 IP Volume inc from 2 sources7

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
193.47.62.187	AS216014 BestDC Limited	BG	Sun RPC	30	2026-10-10 07:45
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Sun RPC	20	2026-10-10 15:43
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	Sun RPC	12	2026-10-10 09:12
45.198.224.251	AS215925 Vpsvault.host Ltd	US	Sun RPC	12	2026-10-09 17:38
66.132.172.251	AS398324 Censys, Inc.	US	Sun RPC	11	2026-10-10 01:58
185.94.111.1	AS51115 HLL LLC	RU	Sun RPC	8	2026-10-08 23:30
185.242.226.87	AS202425 IP Volume inc	US	Sun RPC	6	2026-10-09 06:52
147.203.255.20	AS11320 LightEdge Solutions	US	Sun RPC	4	2026-10-07 18:44
146.88.241.110	AS20052 Arbor Networks, Inc.	US	Sun RPC	3	2026-10-10 11:52
80.85.84.130	AS63949 Akamai Connected Cloud	GB	Sun RPC	3	2026-10-05 20:27
91.231.89.89	AS213412 ONYPHE SAS	FR	Sun RPC	2	2026-10-09 23:24
146.88.241.60	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-09 11:39
193.163.125.168	AS211298 Driftnet Ltd	GB	Sun RPC	2	2026-10-10 19:06
91.230.168.217	AS213412 ONYPHE SAS	US	Sun RPC	2	2026-10-09 23:09
146.88.241.130	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-10 14:21
65.49.1.89	AS6939 Hurricane Electric LLC	US	Sun RPC	2	2026-10-11 01:14
146.88.241.50	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-07 06:47
146.88.241.90	AS20052 Arbor Networks, Inc.	US	Sun RPC	1	2026-10-09 13:25
45.156.129.86	AS211680 Sistemas Informaticos, S.A.	PT	Sun RPC	1	2026-10-08 02:44
193.163.125.208	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-05 12:23

Latest datagrams

2026-10-11 01:33:0664.62.156.52to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:14:5765.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:11:0365.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 00:34:0864.62.197.71to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 19:06:33193.163.125.168to 2049/udpSun RPCGB

C·qn·

payload bytes

00000000  43 ec 71 6e 00 00 00 00  00 00 00 02 00 01 86 a0  |C.qn............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:43:5445.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:23:3245.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:13:1545.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:57:5845.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 14:21:02146.88.241.130to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:52:18146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:30:05146.88.241.110to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 11:03:15193.163.125.161to 111/udpSun RPCGB

x·Y·

payload bytes

00000000  78 be 59 c2 00 00 00 00  00 00 00 02 00 01 86 a0  |x.Y.............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 10:44:2866.132.186.215to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 09:37:40216.218.206.69to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|