Follow the Access · 23 — The Mass Scanner: The Census That Precedes Every Attack

Follow the Access — Case 23. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Every case in this register begins in the middle of the story. The brute force of Case 02 begins with a login already found to guess at; the web-RCE of Case 06 begins with a vulnerable application already located; the leaked-secret scanner of Case 20 begins with a repository already being searched. In each, the attack acts on a target — but something had to find that target first, and that something is the subject of this case. Before any attack can act, something must survey the internet and locate the machines worth attacking. That survey is mass scanning: the continuous, automated reconnaissance that sweeps the entire internet, cataloguing every reachable machine, every open port, every service and its version, so that the vulnerable ones can be found and matched to the attack that fits them. It is the census beneath the whole register — the layer of reconnaissance on which every other vector stands.

The honeypot beneath these words does not have to infer this census; it is drowning in it. Of the source addresses it has recorded, 3,477 are classified as scanners — machines whose connections are not attacks but surveys, probing and enumerating what the honeypot exposes. Fingerprint them by how they speak, and they resolve into the standard reconnaissance toolchains: libssh in several versions, Go_SSH, AsyncSSH, libssh2, and the telltale signature of Nmap enumerating a service's supported algorithms. These are not intrusions. They are the survey — thousands of machines, at any moment, mapping the reachable internet one probe at a time, and the honeypot sits in the middle of that mapping, being catalogued along with everything else. The census is not a preliminary that happened once. It is a permanent condition, running now, against every reachable machine, including this one.

So the disposition is PROXIED, because the census is not run from the surveyor's own machines. Scanning the entire internet from your own address is loud, self-incriminating, and quickly blocklisted, so the reconnaissance is distributed across borrowed infrastructure — the compromised, conscripted machines the earlier cases produced, each made to scan from its own address so the operator hides behind a shifting front of other people's IPs. The honeypot's scanner population is, in large part, exactly this: the recycled victims of Cases 01 and 18, now performing the reconnaissance that finds the next victims. This is the case about the census that precedes every attack, run on borrowed machines by an operator who cannot be seen, and about how the map of the vulnerable internet is drawn by the internet's own captured devices.

1. The Layer Beneath the Register

Begin by placing mass scanning correctly, because it is not one vector among the others but the layer they all rest on, and seeing that changes how the whole register fits together. Every attack the register has followed requires a target, and targets do not announce themselves to attackers — they have to be found. The finding is reconnaissance, and at internet scale, reconnaissance is mass scanning: systematically connecting to addresses across the internet to discover what is there. Only after the scan has found a machine, and catalogued what it is running, can any of the register's attacks engage it. The scan is logically prior to everything else, which is why it deserves its own case even though, strictly, it breaks into nothing.

Consider how the earlier cases silently depended on it. The brute-force swarm of Case 02 tries passwords against logins — but it first had to find the logins, by scanning for machines with SSH or RDP exposed. The web-RCE of Case 06 exploits vulnerable web applications — but it first had to find them, by scanning for web servers and fingerprinting their software. The exposed-database wipe of Case 07, the Docker-socket cryptojacking of Case 08, the edge-appliance exploitation of Case 05 — every one begins with a scan that located an exposed instance of the specific thing the attack targets. The scan is the connective tissue: it is how the undifferentiated internet becomes a set of specific, located, characterized targets that specialized attacks can act on. Remove the scanning layer and the whole economy would grind to a halt, not because the attacks would stop working but because the attackers would not know where to point them.

This is why the register treats mass scanning as a vector in its own right despite it not being an intrusion. A vector, in this register's sense, is a mechanism by which access is obtained, and scanning is the mechanism by which the possibility of access is discovered — the step that turns "there are vulnerable machines somewhere" into "here is a vulnerable machine, at this address, running this exploitable version." Without that step, none of the access in the register happens. The scan is the reconnaissance foundation of the entire criminal economy, the survey that precedes and enables every attack, and following access to its source means following it back to the census that found the target in the first place. Everything else in the register is what happens after the scan finds you; this case is about the scan finding you, which happens to everyone, continuously, whether they are ever attacked or not.

2. A Census That Never Stops

Now the property that makes mass scanning so total: the internet is small enough to survey completely, over and over, forever. This is a fact about the size of the address space, and it has consequences that shape the entire threat landscape. The internet's IPv4 address space contains roughly four billion addresses — a large number, but a tractable one for a computer. Modern high-speed scanning tools, the ZMap and masscan class, can sweep the entire IPv4 internet on a single port in minutes to hours, sending a probe to every possible address and recording what answers. Four billion is not too many to check; it is a number a determined scanner gets through in an afternoon.

The consequence is that no exposed machine is ever undiscovered for long. Connect a new device to the internet — a server, a router, a camera, anything reachable — and it will be found, catalogued, and probed within hours, often minutes, of appearing, because the scanners are always sweeping and the sweep always reaches it. There is no obscurity to hide in, no corner of the address space too remote to be checked, because the whole space is checked continuously. This is the mechanism behind a refrain that has run through the entire register: exposure equals discovery. When the register said, case after case, that an exposed service is found within hours of appearing, this is why — the census is perpetual, the address space is small enough to sweep endlessly, and anything reachable is therefore discovered almost immediately and revisited without end. To be on the internet is to be in the census, always, from the moment you connect.

This perpetual, total quality is what distinguishes internet-scale reconnaissance from the targeted reconnaissance of a traditional attack. A spy casing a specific building surveys one target with effort; the mass scanner surveys every target at once, continuously, as a matter of course, because the whole internet is cheap enough to survey that there is no reason not to survey all of it, all the time. The scanner does not decide to look at you; it looks at everything, and you are part of everything. This is why the defensive posture the register keeps returning to is not "avoid being found" — which is impossible, since everything is found — but "be uninteresting when found," because being found is not a risk to be managed but a certainty to be assumed. The census does not miss anyone. The only variable is what it learns about you when it arrives, which it will, within hours, no matter who you are.

3. The Scan as the Sorting Machine

Now the function that makes mass scanning the engine of the criminal economy rather than merely its eyes: the scan does not just find machines, it sorts them, and the sorting is what makes specialized attack possible at scale. A bare list of reachable addresses would be of limited use; what makes the census powerful is that the scanner fingerprints each machine it finds — determining what operating system it runs, what services it exposes, what versions those services are, and, crucially, whether those versions have known vulnerabilities. The output is not a list of addresses but a catalogue: a sorted inventory of the internet, keyed by what each machine is and what it is vulnerable to.

This catalogue is what lets the fragmented, specialized attack economy function efficiently. Recall that the register's attackers are specialists — the ransomware crew, the cryptojacker, the n-day operator each work one kind of target with one kind of tool. None of them wants to attack the whole internet; each wants only the specific targets their tool fits. The scan catalogue is what lets them find exactly those. The ransomware affiliate queries for exposed RDP; the Docker-cryptojacking crew for exposed orchestration APIs; the operator holding an exploit for a specific vulnerable version queries for machines running exactly that version, and gets a list. The scan turns the undifferentiated mass of the internet into a filterable inventory of opportunities, so that each specialized attacker can pull, from the catalogue, precisely the targets their particular attack will work against, and ignore the rest. This is division of labor again — the same specialization the access broker enabled — but at the reconnaissance layer: the scanner produces the map, and every specialist reads from it the targets that fit their trade.

The efficiency this creates is what makes the modern attack economy so fast and so comprehensive. When a new vulnerability is disclosed, the reason mass exploitation begins within hours — a pattern the register has cited repeatedly — is that the scanning catalogue already exists and can immediately be queried for machines running the vulnerable software, or freshly scanned for them at internet speed. The attacker does not have to hunt for vulnerable machines one by one; the census already knows where they are, or can find them all in an afternoon, and the exploit can be pointed at the whole population at once. The scan is the sorting machine that converts a disclosed flaw into a target list, a stolen credential type into a list of places to try it, an exploit into a campaign. It is the reconnaissance infrastructure that makes every downstream attack a matter of querying a map rather than searching a wilderness, and that map is the foundation the entire register is built on — the census that not only finds every machine but sorts every machine into the attacks it is vulnerable to.

4. PROXIED — The Census Run on Borrowed Machines

Now the disposition, and mass scanning earns PROXIED because the surveyor does not survey from his own address — he surveys from everyone else's. Scanning the entire internet is a conspicuous act: a machine that connects to millions of addresses is obviously scanning, and it quickly earns blocklisting, abuse complaints, and attention. An operator who scanned from his own infrastructure would be identified, blocked, and attributed almost immediately. So the reconnaissance is not run from the operator's machines; it is distributed across borrowed ones — the compromised, conscripted devices that the earlier cases produced — and this is why the disposition is PROXIED: the census runs through the same rented, captured infrastructure the register has followed throughout, so that the surveyor hides behind a constantly shifting front of other people's IP addresses.

The honeypot's data shows this loop directly, and it is one of the register's most satisfying confirmations. The honeypot's scanner-classified addresses and its botnet-classified addresses overlap heavily, and its entity graph links them by shared tooling and shared operators — meaning the machines doing the scanning are, in large part, the same machines that were themselves compromised and conscripted in the earlier cases. The box taken by a default password in Case 01, mined for its CPU, and enlisted into a botnet in Case 18, is — in a great many cases — the box now performing the reconnaissance of Case 23, scanning the internet from its own residential or hosting IP on behalf of an operator it will never see. The reconnaissance that finds the next victims is performed by the previous victims. This is what makes the scanning both proxied and self-sustaining: proxied, because it runs on borrowed machines so the operator cannot be located; self-sustaining, because every machine the scan helps compromise becomes, in turn, another scanner seeking the next, so the census grows itself as it runs.

The disposition PROXIED therefore captures something structural about reconnaissance in this economy: the map of the vulnerable internet is drawn by the internet's own captured devices, on behalf of operators who never expose their own address to the survey. This is why attributing and stopping mass scanning is so hard — you cannot block "the scanner," because the scanner is not one machine or one address but a diffuse, shifting population of compromised hosts, each of which is itself a victim, all of them coordinated by an operator hiding behind them. Blocking the scanning IPs accomplishes little, because they are legion and disposable and will be replaced by the next batch of conscripted machines. The census is a proxied operation in the fullest sense — a survey conducted by proxies, through proxies, for a surveyor who is never on the wire himself. The register has followed the disposition of compromised machines to mining, to ransom, to botnets; here it follows one more of their fates, the quietest and most foundational: to become the eyes of the economy that captured them, mapping the internet for the next attack while the operator who owns them remains, like the map he is drawing, everywhere and nowhere at once.

5. You Are Already Being Scanned

The register owes the defense, and mass scanning demands the register's most philosophically distinct one, because unlike every other vector, the goal here is not to stop the activity — you cannot, and much of it is not even hostile — but to make the activity harmless. The scan cannot be prevented: it is constant, it comes from everywhere, and it is, at the packet level, often indistinguishable from legitimate traffic. So the defense begins with acceptance: you are already being scanned, right now, continuously, and you always will be, so the only question worth asking is what the scan finds when it reaches you.

That question reframes the entire defense as a question of exposure and hardening. The single most powerful measure is to minimize exposure, because what is not exposed is not catalogued: every service that does not need to face the internet should not, so that the census, when it sweeps your address, finds as little as possible to record. A machine that exposes nothing is in the census as an address that does not answer, of no interest to any specialized attacker's query. For the services that must be exposed, keep them patched and hardened, so that when the scan fingerprints them — and it will — the fingerprint does not match a known-exploitable version, and your machine does not appear in the query results of the n-day operator hunting for exactly what you are running. Restrict management interfaces (SSH, RDP, admin panels) to known source addresses, removing them from the public census entirely, so they are not even seen by the sweep. And, for those able, monitor for the difference between the constant background scanning and a sudden, focused reconnaissance of your specific range, which can be an early warning of a targeted attack being prepared — the census is impersonal, but a scan narrowed to you is a signal worth heeding.

The honest complication the defense must acknowledge is that scanning is dual-use, which is why it cannot simply be blocked as an attack. A great deal of internet-wide scanning is benign or beneficial: security researchers mapping the internet's exposure, academic measurement projects, and legitimate services like Shodan and Censys that scan the whole internet to build the very inventories defenders use to find their own exposed assets. At the level of a single probe, the researcher's scan and the attacker's scan look the same, and treating all scanning as hostile would block the defensive tools along with the offensive ones. This is why the register's advice is not "stop the scan" but "be uninteresting to the scan" — because the scan is a fact of the internet, as unavoidable as weather, run by the benign and the malicious alike, and the only thing within your control is what it learns about you. The operative assumption, the register's constant refrain made literal, is this: the census has already found you, catalogued you, and will revisit you within the hour, so your security is decided not by whether you are scanned but by whether the scan finds a target — and that is decided entirely by how little you expose and how well you harden what you must. You cannot leave the census. You can only make sure that when it reads your entry, there is nothing there worth the next attacker's time.

6. The counter-narrative, steelmanned

The strongest objection to this case is that scanning is not an attack and does not belong in a register of attacks — it is reconnaissance, harmless in itself, and much of it is entirely legitimate, so treating it as a vector inflates a benign background hum into a threat.

The argument runs like this. A scan breaks nothing, steals nothing, and damages nothing; it merely observes what is publicly reachable, which is not an attack any more than reading a public phone book is a burglary. Much of it, the objection continues, is performed by legitimate researchers and services doing valuable work, and the case admits as much — so lumping the benign majority together with the malicious minority under the heading of a "vector" is a category error that criminalizes a neutral, often beneficial activity. And the defensive advice, "minimize exposure and patch," is just the standard hygiene the register has recommended a dozen times already, not anything specific to scanning. On this view the mass scanner is not a vector but the ambient condition of being on the internet, and giving it a case overstates its status.

The register accepts that scanning breaks nothing and insists that this is exactly why it must be included. Yes, the scan is reconnaissance, not intrusion, and yes, much of it is benign — the case says both plainly and treats the dual-use nature as central rather than hiding it. But the objection mistakes "not itself an attack" for "not part of the attack," and the whole point of the case is that reconnaissance is the enabling layer beneath the attacks, the step without which none of the register's intrusions could be aimed. A register that catalogued twenty-two ways attackers act on targets but never examined how targets are found would be describing the strikes while ignoring the targeting, and the targeting is not incidental — it is what makes the strikes possible at scale and what makes "exposure equals discovery" a law rather than a slogan. The reconnaissance layer is where the register's recurring facts (found within hours, mass-exploited within days) actually come from, and explaining them requires examining the census that produces them. On the "just hygiene" objection: the defensive advice is indeed familiar, but the case supplies the reason it is correct — you patch and minimize exposure precisely because the census is perpetual and total, so the reasoning is specific to scanning even where the measures are shared. And the case's genuinely distinct content is not the defense but the disposition: the finding, grounded in the honeypot's own scanner/botnet overlap, that the reconnaissance is proxied through the register's own earlier victims, closing the loop that the box mined and conscripted in earlier cases is the box scanning in this one. That is a structural fact about how the criminal economy's eyes are built, and it is worth a case. The mass scanner earns its place not as an attack but as the survey that aims every attack — the quiet, constant, proxied census that is the true first step of everything else the register documents.

7. Disposition — PROXIED

Case 23 followed mass internet scanning — the continuous, automated census that precedes and enables nearly every vector in the register. Before any attack can act, something must find the target, and the scan is that something: sweeping the entire internet, cataloguing every reachable machine, port, service, and version, and sorting the undifferentiated internet into a filterable inventory of opportunities that each specialized attacker queries for exactly the targets their tool fits. The honeypot watches the census first-hand — 3,477 scanner-classified addresses, fingerprinted into the standard reconnaissance toolchains, probing and enumerating thousands at a time. And because the address space is small enough to sweep in hours, the census is perpetual and total: exposure equals discovery, and everything reachable is found within the hour, which is the mechanism behind that refrain everywhere in the register.

The disposition — the foothold's fate — is PROXIED, because the census is run on borrowed machines. Scanning from one's own address is loud and self-incriminating, so the reconnaissance is distributed across the compromised, conscripted devices of the earlier cases — each made to scan from its own IP so the operator hides behind a shifting front of other people's addresses. The honeypot's scanner and botnet populations overlap heavily and are linked by shared operators, closing the register's oldest loop: the box mined in Case 01 and conscripted in Case 18 is, in large part, the box scanning in Case 23. The reconnaissance layer is itself a proxied operation, drawn by the internet's own captured devices for a surveyor who is never on the wire — and self-sustaining, because each victim found becomes a scanner seeking the next.

The defense is unlike any other in the register, because the goal is not to stop the scan — impossible, constant, and largely benign — but to make it find nothing: minimize exposure so there is nothing to catalogue, patch and harden what must be exposed so the fingerprint matches no exploitable version, restrict management interfaces off the public census, and watch for the focused scan that precedes a targeted strike. You cannot leave the census; you can only be uninteresting to it. The vectors do not lie: the survey swept your address within the hour, catalogued exactly what you run, and filed you under the attacks you are vulnerable to — a map of the whole vulnerable internet, drawn by the internet's own captured machines, for an operator who was never there. We do not judge. We record. We let people judge — and then, if they are wise, assume the census has already found them, and make sure it found nothing worth the next attacker's time.

Follow the Access continues. Case 23 disposition: PROXIED. Confidence: HIGH — the scanner population and its toolchains are direct first-party honeypot capture (3,477 scanner IPs; libssh/Go_SSH/AsyncSSH/libssh2/Nmap-enumeration HASSH fingerprints); high-speed internet-wide scanning (ZMap/masscan class) and the reconnaissance-to-targeting pipeline are well-documented; and the proxied-scanning observation is grounded in the honeypot's own scanner/botnet overlap and entity graph, closing the loop to Cases 01 and 18. The dual-use nature (benign researchers and services like Shodan/Censys alongside malicious operators) is stated honestly as central to the defense. The PROXIED disposition reflects the distributed-via-compromised-nodes execution of the census. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the census, the borrowed eyes that draw it, and the map that files every machine under the attack that fits it.