Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs. Like when I see an "authorized" scan: Or when I'm owned for the umpteenth time: I regularly see URLs or email addresses for when you want to know more, or get in touch, with the persons behind a scanner: (around the end of this list, you'll see the Belarus email address we wrote about recently) Many variants of masscan: Even a KGB variant.

Read the full article at SANS Internet Storm Center →