Long-form thinking on cyber defence, detection, and resilience — from Slackware-era honeypots through to AI-driven SOC analytics.
Showing posts tagged scanning — 2 results.
Three months of careful observation of scan traffic against my honeypot has revealed a pattern: most of the scans hitting random IPs come from coordinated networks of compromised hosts, not individual attackers. The implications are significant.
A scan footprint that does not match any tool I recognise. A walk through the diagnostic process — what I tried, what I ruled out, what I think it actually was.