Getting removed from port scan results is good…right? The last place we want to see out domain is in the “as seen on…” memes. I would like to share thoughts on finding my own address not so mysteriously missing from a popular scanner.

It doesn’t take long to see repete source addreses in port scan logs. Sometimes one address will just hammer away like the “can you hear me now” guy run amok with massscan, more often low and slow but obvous on aggregation (like the one I was ~finally redacted by).

Next logical step is to see who your new friends are, geolocation is interesting, host and domain names tell you a lot.