UDP traffic

Datagrams matching proto:nfs sent to HoneyLabs sensors over UDP in the last 24 hours. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

24 datagrams from 14 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

Sun RPC 24

Latest Sun RPC datagram, to 111/udp

·@·

payload bytes

00000000  ab 16 40 a7 00 00 00 00  00 00 00 02 00 01 86 a0  |..@.............|
00000010  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
Portmap	111/udp	20	12	7 to 28

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

111/udp Sun RPC20
2049/udp Sun RPC1
35526/udp Sun RPC1
41752/udp Sun RPC1
60665/udp Sun RPC1

Networks

AS398324 Censys, Inc. from 4 sources6
AS6939 Hurricane Electric LLC from 4 sources5
AS51115 HLL LLC from 1 source4
AS215925 Vpsvault.host Ltd from 1 source4
AS20052 Arbor Networks, Inc. from 2 sources3
AS211298 Driftnet Ltd from 2 sources2

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
185.94.111.1	AS51115 HLL LLC	RU	Sun RPC	4	2026-10-11 08:39
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	Sun RPC	4	2026-10-10 15:43
66.132.172.251	AS398324 Censys, Inc.	US	Sun RPC	3	2026-10-11 06:04
65.49.1.89	AS6939 Hurricane Electric LLC	US	Sun RPC	2	2026-10-11 01:14
146.88.241.110	AS20052 Arbor Networks, Inc.	US	Sun RPC	2	2026-10-10 11:52
193.163.125.168	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-10 19:06
64.62.156.52	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-11 01:33
66.132.172.230	AS398324 Censys, Inc.	US	Sun RPC	1	2026-10-11 08:11
216.218.206.69	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-10 09:37
146.88.241.130	AS20052 Arbor Networks, Inc.	US	Sun RPC	1	2026-10-10 14:21
64.62.197.71	AS6939 Hurricane Electric LLC	US	Sun RPC	1	2026-10-11 00:34
193.163.125.161	AS211298 Driftnet Ltd	GB	Sun RPC	1	2026-10-10 11:03
66.132.186.242	AS398324 Censys, Inc.	US	Sun RPC	1	2026-10-11 05:58
66.132.186.215	AS398324 Censys, Inc.	US	Sun RPC	1	2026-10-10 10:44

Latest datagrams

2026-10-11 08:39:27185.94.111.1to 111/udpSun RPCRU

·@·

payload bytes

00000000  ab 16 40 a7 00 00 00 00  00 00 00 02 00 01 86 a0  |..@.............|
00000010  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 08:14:19185.94.111.1to 111/udpSun RPCRU

uz·V·

payload bytes

00000000  75 7a 0f 56 00 00 00 00  00 00 00 02 00 01 86 a0  |uz.V............|
00000010  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 08:11:1966.132.172.230to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 08:02:39185.94.111.1to 111/udpSun RPCRU

payload bytes

00000000  01 a5 a4 90 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 07:24:44185.94.111.1to 111/udpSun RPCRU

'M·

payload bytes

00000000  27 4d 08 10 00 00 00 00  00 00 00 02 00 01 86 a0  |'M..............|
00000010  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 06:04:0666.132.172.251to 35526/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 05:58:3066.132.186.242to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 05:58:2966.132.172.251to 41752/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 03:34:1166.132.172.251to 60665/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:33:0664.62.156.52to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:14:5765.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 01:11:0365.49.1.89to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-11 00:34:0864.62.197.71to 111/udpSun RPCUS

payload bytes

00000000  1a a9 ff e1 00 00 00 00  00 00 00 02 00 01 86 a0  |................|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 19:06:33193.163.125.168to 2049/udpSun RPCGB

C·qn·

payload bytes

00000000  43 ec 71 6e 00 00 00 00  00 00 00 02 00 01 86 a0  |C.qn............|
00000010  00 00 00 04 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|

2026-10-10 15:43:5445.205.1.231to 111/udpSun RPCBR

er 7·

payload bytes

00000000  65 72 0a 37 00 00 00 00  00 00 00 02 00 01 86 a0  |er.7............|
00000010  00 00 00 02 00 00 00 04  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00                           |........|