Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners

Attack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners

Speakers: Yukiko Endo (NICT); Masato Jingu (NICT); Masaki Kubo (NICT)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=_ygUSx-tkYA

Overview

The proliferation of internet-wide scanning has become a significant challenge for security operations centers (SOCs) and incident responders. While many scans are conducted for legitimate purposes by security intelligence vendors, researchers, and asset management services, their sheer volume generates substantial "noise" that can obscure actual threats. This presentation by Yukiko Endo, Masato Jingu, and Masaki Kubo from Japan's National Institute of Information and Communications Technology (NICT) delves into the critical issue of identifying, tracking, and evaluating the impact of these ubiquitous internet survey scanners.

The talk highlights how a large percentage of network traffic and security alerts are attributed to benign, albeit resource-intensive, scanning activities. NICT, leveraging its extensive darknet monitoring infrastructure, has developed a robust methodology to detect scanner-like behavior, attribute it to specific organizations, and analyze its characteristics. The goal is not to stop these scans, which are vital for understanding and securing the internet, but to make them identifiable, explainable, and manageable for defenders.

By providing actionable intelligence on known scanners, their infrastructure, and their scanning patterns, NICT aims to empower SOC analysts to automatically filter out this noise, reduce operational overhead, and focus their efforts on genuine cyber threats. The research underscores the necessity for greater transparency from scanner operators and enhanced collaboration within the security community to build and maintain comprehensive, continuously updated scanner inventories.

Background

▶ Watch: Impact of internet-wide scanning on SOC operations (2:00)

The internet's landscape has dramatically evolved with the explosion of Internet of Things (IoT) devices, ranging from Wi-Fi routers to digital video recorders. While these devices offer convenience, their often-lax security makes them prime targets for compromise, leading to their weaponization in Distributed Denial of Service (DDoS) attacks or their abuse as residential proxies. Concurrently, the rise of powerful, accessible scanning tools like Masscan and Zmap has democratized the ability to survey the internet. This has led to a constant barrage of scanning activity on internet-facing assets, originating from a diverse array of sources including malicious actors, academic researchers, security vendors, and entities with unclear motives.

For security operations teams, this constant scanning presents a significant operational burden. A substantial volume of alerts generated by firewalls and Intrusion Detection Systems (IDS) can be attributed to these survey scanners, such as Censys, Shodan, and various Attack Surface Management (ASM) vendors. While these scans are typically not directly malicious, they consume valuable storage and compute resources, and more critically, demand the attention of already-overburdened analysts. Without immediate identification of the scanner's origin and intent, every unknown scan necessitates investigation, diverting resources from actual threat detection and response. NICT's observations confirm this challenge, with approximately 40% of IDS alerts in their networks being generated by survey scanners, effectively obscuring real threats.

The problem is not unique to NICT; it is a widely recognized community issue. While some community-maintained lists of known scanners exist, they often suffer from several limitations: they may focus only on a few well-known organizations, cater to specific use cases, lack transparency regarding their creation methodology (e.g., continuous observation vs. OSINT), or quickly become outdated due to the dynamic nature of IP address ownership and usage. Defenders require scanner intelligence that is comprehensive, continuously updated based on observed traffic, and provides actionable insights into the identity and purpose of scanning entities. This gap underscores the critical need for a systematic approach to tracking and evaluating internet-wide survey scanners.

Key Findings

▶ Watch: 67.5% of darknet traffic is scanner noise (10:00)

NICT's extensive darknet monitoring, spanning over 20 years and encompassing approximately 300,000 unused IP addresses globally, provides a unique vantage point to observe internet-wide scanning trends. Their analysis of 221.5 billion packets observed in the first quarter of 2026 (a 90-day period) yielded several critical findings:

• Overwhelming Scanner Noise: A staggering 67.5% of all observed darknet packets originated from internet-wide survey scanners. This "noise" significantly overshadowed packets from actual botnet scanning (less than one-third of traffic), highlighting the operational challenge posed by these activities.
• Identified vs. Unknown Scanners: NICT successfully identified 83 organizations responsible for scanning, categorizing them into Security Intelligence and Measurement Services (50 organizations), Research Organizations (around 20), Gray Scanners with unknown objectives (4, though decreasing), and Web Crawlers (6). This identified traffic, along with unknown scanner traffic, comprised the majority of the noise.
• Widespread Coverage: The vast majority of identified scanning organizations (72 out of 77, or 93.5%) conducted internet-wide or multi-country scanning, indicating a global reach rather than localized efforts. Only a few organizations, such as FRAT or ICT Isaac in Japan, focused on single-country scanning.
• Varying Persistence: While half of the security intelligence and measurement services scanned daily, research organizations exhibited more varied scanning frequencies, often scanning for less than a month, reflecting specific research objectives.
• Operational Impact: Integrating scanner intelligence into NICT's SOC workflow revealed significant impacts:
• Firewall Logs: Over 32% of all inbound firewall log entries (approximately 469 million daily) originated from service scanners, consuming more than 100 gigabytes per day in storage.
• IDS Alerts: More than 40% of all IDS alerts (approximately 33 million monthly) were generated by service scanners, totaling around 13 million alerts.
• Top Contributors: For IDS alerts, Censys was the top contributor at 28%, followed by Shadowserver (21%) and Pard Networks (20%). For firewall logs, Modat was number one at 21%.
• Differentiated Scanning Behavior: The distribution of scanner activity differed between firewall logs and IDS alerts. Modat, for instance, generated many firewall logs due to its broad port scanning attempts (even on closed ports), but fewer IDS alerts. Censys, conversely, generated more IDS alerts by focusing on listening ports, establishing sessions, and sending payloads that triggered signatures. This indicates a need for different filtering strategies.
• Periodicity: Scanners exhibited diverse timing patterns:
• Strong Periodicity: Pard Networks showed clear weekly patterns (taking Sundays off in the US), and Curator also had strong, fixed-interval spikes.
• Weak Periodicity: Shadowserver and Netscout showed some patterns, but with inconsistent timing.
• No Periodicity: Censys and Shodan scanned randomly with no clear schedule.
• Port Coverage: Security intelligence services generally scanned broader port ranges, with Censys and Driftnet notably performing full TCP and UDP port scans. Research organizations tended to concentrate on lower port ranges, reflecting specific research questions. UDP scanning was consistently more selective across all scanner types.
• Infrastructure Diversity: While some major scanners like Modat and Censys use their own Autonomous Systems (ASNs), many heavily utilize cloud providers (e.g., Google, Microsoft, Amazon) and ISP infrastructure for scalability and distributed measurement, complicating attribution efforts.
• Unknown Scanners: When an organization cannot be identified, NICT correlates darknet data with honeypot observations to inspect payloads and distinguish benign measurement from potentially malicious reconnaissance (e.g., directory traversal attempts for password files).

Technical Deep Dive

▶ Watch: Integrating scanner intelligence into SOC workflow (28:00)

NICT's methodology for tracking and evaluating internet-wide survey scanners is a sophisticated multi-stage process, primarily leveraging its extensive darknet monitoring infrastructure. For over two decades, NICT has operated a global darknet comprising approximately 300,000 unused IP addresses. As no legitimate traffic should ever reach these addresses, the darknet serves as an ideal sensor for observing unsolicited traffic, including malware scanning and, crucially, internet-wide survey scanning.

The process of creating scanner intelligence from darknet monitoring involves two key phases: detection and validation.

1. Detection of Scanner-Like Behavior:

From the raw darknet packets, NICT identifies traffic patterns indicative of survey scanning. This involves analyzing:

• Packet Volume: High volumes of packets originating from a single source or set of sources.
• Port Diversity: The range and number of destination ports targeted, with broad port scanning being a strong indicator of survey activity.
• JA3 Fingerprinting: A JA3 fingerprint is generated from the TCP/SSL handshake, providing a unique signature for the client application. While darknet only sees TCP packets, this fingerprint can help classify the scanning tool or client.
• User Agent Correlation: Since darknet packets do not contain application-layer payloads (like HTTP User-Agents), NICT correlates darknet observations with data from their honeypots. When a source IP observed on the darknet later connects to a honeypot, the honeypot can capture the full payload, including User-Agent strings (e.g., "User-Agent: Censys"), which are crucial for attribution.
• IP Address History: Analyzing the historical behavior of source IP addresses helps to establish patterns and identify persistent scanning entities.

Based on these indicators, candidate IP addresses are flagged as potential survey scanners.

2. Validation and Attribution:

The candidate IP addresses then undergo a rigorous validation process to identify the scanning organization and understand its purpose:

• WHOIS Lookups: Checking WHOIS records for the IP address and its associated Autonomous System Number (ASN) to determine ownership and registration details.
• DNS Records: Analyzing reverse DNS records (PTR records) and forward DNS entries (A records) for clues about the host's identity.
• Banner Grabbing: Performing scan-back operations to the source IP address to grab banners from open ports (e.g., HTTP server banners, SSH banners), which often reveal the operating system, service, or even the organization running the scanner.
• Open Source Intelligence (OSINT): Consulting public sources, security blogs, forums, and existing community lists to gather additional information.

Through this comprehensive validation, NICT assigns a label to each identified scanner (e.g., "Shodan," "Censys"). If scanner-like behavior is detected but attribution is not possible, it is labeled as an "unknown service scanner." The key is not just to detect the traffic but to link the behavior to an actual organization or clearly mark it as unknown. This identified scanner list is then published to a GitHub repository for community benefit.

Scanner Characteristics and Behavior:

NICT's analysis provided granular insights into the behavior of different scanning organizations:

• Top Scanners (First Quarter 2026):
• Modat: Generated the most packets, with 193 IP addresses across 3 ASNs (one being their own, making attribution easy). Observed up to 1.5 billion packets per day. IP-level activity showed variability, with some IPs scanning constantly and others starting mid-period.
• Pard Networks: Utilized 1,449 IP addresses hosted on cloud providers like Akamai and Google Cloud. Exhibited a distinct weekly periodicity, with reduced activity on what corresponds to Sundays in the US. Observed around 145 million packets per day.
• Censys: Operated 136 IP addresses, all within Censys-owned ASNs. Maintained a consistent scanning pattern, sending around 160 million packets per day, but showed changes in IP address ranges over time.
• Shadowserver: Used 984 IP addresses under a single ASN, generating about 78 million packets per day. IP addresses generally acted consistently.
• Shodan: Employed 999 IP addresses across five ASNs, some of which are also known to be used by attackers. Observed a relatively lower volume of about 39 million packets per day on the darknet, possibly because darknet IPs don't offer interesting responses.

• Port Coverage:
• Security Intelligence/Measurement Services: Tended to scan broader port ranges. Notably, Censys and Driftnet performed full TCP and UDP port scans.
• Research Organizations: Focused on more concentrated, lower port ranges, aligning with specific research objectives.
• UDP Scanning: Generally more selective than TCP, even among security intelligence services, with most scanning fewer than 500 UDP ports.

• Infrastructure Usage: While some scanners like Modat and Censys use their own ASNs, the heavy reliance on cloud providers (Google, Microsoft, Amazon) and ISP infrastructure by many scanners (e.g., Pard Networks) poses an attribution challenge for defenders. Cloud environments enable rapid scaling and distributed measurement, but also allow scanners to blend in with legitimate cloud traffic.

Handling Unknown Scanners:

For "unknown service scanners" – those exhibiting survey-like behavior but lacking clear attribution – NICT combines darknet data with honeypot observations. By inspecting payloads captured by honeypots, they can differentiate between benign measurement (e.g., simple HTTP GET requests with a clear User-Agent) and potentially malicious reconnaissance (e.g., directory traversal attempts to access sensitive files like /etc/passwd). This crucial step helps defenders avoid misinterpreting hostile activity as mere background noise.

Integrating Intelligence into SOC Operations:

Masato Jingu elaborated on the practical integration of this scanner intelligence into NICT's SOC workflow. The identified scanner list is fed into their SIEM (Security Information and Event Management) system, specifically using Splunk's lookup table functionality. This allows for automatic filtering of alerts originating from known benign scanners, significantly reducing noise and enabling analysts to prioritize real threats.

The impact of this integration was quantified:

• Firewall Logs: Scanners accounted for 32% of all inbound firewall log entries, consuming 100 GB per day in storage.
• IDS Alerts: 40% of all IDS alerts were attributed to scanners.

The distribution of top scanners differed between firewalls and IDS. Modat was prominent in firewall logs because it scans all ports, whether open or closed. Censys, conversely, topped IDS alerts as it focuses on open ports, establishing sessions and sending payloads that trigger IDS signatures. This highlights the need for different filtering strategies depending on the security control (firewall vs. IDS).

Finally, the analysis of scanner timing revealed distinct patterns:

• Strong Periodicity: Some scanners like Pard Networks and Curator exhibit highly regular, predictable scanning schedules, which can be leveraged for time-based filtering and anomaly detection.
• Weak Periodicity: Others, such as Shadowserver and Netscout, show some patterns but are less consistent, making prediction harder but still amenable to pattern analysis.
• No Periodicity: Scanners like Censys and Shodan operate randomly, making IP-based filtering using the scanner list the most effective approach.

Demo / Proof of Concept

▶ Watch: Quantifying scanner impact on firewall and IDS (30:00)

This talk did not feature a live software demonstration or a specific proof of concept in the traditional sense. Instead, the entire presentation served as a comprehensive demonstration of NICT's operational methodology and the tangible results of their ongoing research. The GitHub repository containing the quarterly-updated list of identified service scanners acts as the primary "proof of concept," showcasing the practical output and utility of their scanner intelligence for the broader security community. The detailed analysis of packet volumes, IP-level activity, port coverage, and operational impact within NICT's own SOC further validated the effectiveness and necessity of their approach.

Defensive Implications

▶ Watch: Analyzing UDP payloads for malicious intent (42:00)

The insights presented by NICT offer several critical defensive implications for security professionals and organizations:

1. Leverage Scanner Intelligence: Defenders should actively integrate community-maintained scanner lists, such as NICT's GitHub repository, into their security tools. This means configuring SIEMs (e.g., Splunk lookup tables), firewalls, and IDS/IPS to automatically identify and potentially filter or de-prioritize traffic from known benign scanners. This is a foundational step to reduce operational noise.

1. Differentiate Filtering Strategies: Recognize that scanner traffic impacts firewalls and IDS differently. Scanners that broadly probe all ports (like Modat) will generate many firewall logs, even if ports are closed. Scanners that target open ports and send payloads (like Censys) will trigger more IDS alerts. Tailor filtering rules accordingly; a blanket block might be too aggressive for a firewall but appropriate for an IDS that only alerts on payload matches.

1. Understand Scanner Periodicity: Utilize the knowledge of scanner timing patterns. For scanners with strong periodicity (e.g., Pard Networks), defenders can predict when traffic will arrive, making scheduled filtering or anomaly detection easier. For random scanners (e.g., Censys), IP-based filtering using the updated scanner list remains the most effective strategy.

1. Attribute Cloud/ISP Traffic: Be aware that many scanners leverage cloud hosting providers (Google, Microsoft, Amazon) and ISP infrastructure. Do not assume that traffic from these ASNs is always benign or always malicious. Robust attribution methods, combining WHOIS, DNS, banner grabbing, and OSINT, are crucial to identify the actual operator behind the cloud IP.

1. Correlate Darknet and Honeypot Data: For organizations operating their own darknets or honeypots, correlating these data sources can provide deeper insights into unknown scanner behavior. Inspecting payloads from unknown sources via honeypots is essential to distinguish between harmless reconnaissance and potentially malicious activity, preventing critical threats from being overlooked as "noise."

1. Advocate for Transparency: As a community, defenders should encourage scanner operators to be more transparent. This includes clearly identifying themselves in their traffic (e.g., User-Agent strings), providing contact information, making opt-out mechanisms accessible, and considering ways to minimize the impact of their scans on target networks. Increased transparency directly translates to reduced investigative overhead for defenders.

1. Promote Collaboration and Data Sharing: The dynamic nature of scanning infrastructure necessitates continuous updates. Instead of each organization independently maintaining scanner lists, the security community should collaborate. Sharing observed scanner activity information, standardizing metadata for attribution, and collectively building and maintaining a community-driven scanner inventory (like the proposed GitHub repository) will significantly enhance collective defense capabilities and reduce redundant efforts.

Key Takeaways

• Internet-wide scanning is a dominant force on the internet: It constitutes a significant portion of network traffic (67.5% of NICT's darknet traffic), far exceeding traditional background noise and botnet activity.
• Identifying scanners is crucial for effective defense: Knowing "who" is scanning allows defenders to differentiate between benign measurement activity and actual threats, enabling prioritization of resources and focus on critical incidents.
• Operational overhead is substantial: Scanner noise consumes significant storage (100 GB/day for firewall logs) and generates a large volume of alerts (40% of IDS alerts), leading to analyst fatigue and obscured real threats.
• Filtering strategies must be nuanced: Different scanners exhibit varying behaviors in terms of port coverage, persistence, and periodicity, requiring distinct filtering approaches for firewalls versus IDS, and for random versus scheduled scans.
• Cloud infrastructure complicates attribution: The widespread use of cloud providers by scanners makes attribution challenging, necessitating robust investigative techniques beyond simple ASN lookups.
• Transparency and collaboration are essential: Scanner operators should be more transparent about their activities, and the security community must collaborate to build and maintain shared, continuously updated scanner intelligence to reduce collective operational burdens.

About the Speaker(s)

Yukiko Endo is from NICT (National Institute of Information and Communications Technology), Japan's national research institute dedicated to cyber security research and development. She is part of the cyber threat analysis office, where she and her team operate a daily security operation using a cyber attack monitoring system. Her work involves monitoring cyber attacks, analyzing attack activities, and supporting incident response.

Masato Jingu is a SOC analyst at NICT. He is responsible for protecting NICT's internal network and has hands-on experience integrating security intelligence, such as scanner lists, into SOC workflows to filter alerts and prioritize real threats. His insights highlight the practical impact of scanner noise on daily security operations.

Masaki Kubo is also from NICT and contributed to the discussion on open challenges and recommendations for both scanner operators and defenders. His expertise focuses on the evolving ecosystem of internet-wide scanning and the importance of transparency and collaboration within the security community to manage this dynamic landscape.