Version 1.0 -- September 23, 2021
The acknowledged scanner repository tracks the ip addresses and other indicia of scanners which, we believe are non-hostile. Acknowledged scanners interact with the larger world in a number of ways, including:
- Providing public information on what they're scanning.
- Providing a service based on their scan data, such as a search engine, threat intelligence, or another security or networking quality product.
- Engaging with the research community by providing data in published papers, reports, etc.
- Providing an opt-out.
We don't know. We call these scanners "acknowledged" as opposed to "non-hostile" because these scanners who have made an effort to make themselves known. Outside of that, there is a spectrum of behavior.
Acknowledged scanners behave differently than run-of-the-mill hostile scanners. At a glance, they scan a wider variety of ports, and their behavior is less predictable on a daily basis (we hypothesize that this is because most acknowledged scanners are staggering a large number of different portscans, while the run-of-the-mill scanners are focusing on ports they have specific exploits for). For researchers, this results in two different models of behavior, while for operators its a potential source of false positives.
At this time, a list of approximately 40 known scanners and their observed IP addresses.
- The ''orgs.csv'' file contains a list of the organizations
- A utility, 'asutil.py' which will create lists of acknowledged scanner ips
- A list of IP addresses, broken down by scanners
This is a first release