Not as annoying as getting DDoS'ed with amplification attacks because some people can't properly configure their servers... (Also I doubt the BND does this, as another commenter pointed out.)

That depends on whether the BND are testing that it could be used in an attack, or just seeing a port is open. Having UDP/11211 could mean you're running a vulnerable memcached service, but not necessarily so.

As others pointed out, its indeed the BSI not the BND. Sorry for the confusion.

Are you sure that it's not BSI?

You are correct, its the BSI.

Hah - one of my first ever network programming tasks was to do this at a UK hosting company. That and SMTP relays. Good that (some) governments are wise enough to try to keep this sort of thing in check.

I hope they aren't using a perl script triggered by a cronjob on a hand-rolled VM though..

Did that company happen to be fast?

Goodness, no. I imagine the um, fast, companies didn't bother.

It was a charming little outfit that has since sold out to iomart. Alas.

It's the BSI (https://en.wikipedia.org/wiki/Federal_Office_for_Information...) and I found the one warning I got years ago useful. ElasticSearch open default port I think.