The author ran a TFTP honeypot on a $5 per month VPS and a Dell R530 home server for more than a month, recording 20 to 50 TFTP packets per day. TFTP is a simple file‑transfer protocol that listens on UDP port 69. The honeypot was intended to observe who probed the service and what types of requests were made. Overall, 35 pairs of probes from Palo Alto Networks IPv4 addresses arrived about 45 seconds apart, with intervals between the first requests ranging from 14 to 33.65 hours. Netscout, Internet Census and Censys were identified as scanning for TFTP servers, sending requests for generic filenames such as /a or random character strings. Other probes included RRQs for boot.ini, pxelinux.0 and various .cfg files, some designed to test directory traversal or server software identification. The seven companies mostly used IP addresses without DNS A records and often did not resolve to named hosts. Shodan occasionally used its own addresses or DigitalOcean addresses, sending non‑conforming UDP payloads in bursts. The author parsed logs by CIDR and identified the originating organizations, noting that most scans were routine identification rather than exploitation attempts. No evidence of active TFTP server vulnerability exploitation was observed. The ultimate purpose of the scans remains unclear, though they appear aimed at mapping TFTP server presence rather than exploiting weaknesses.