An internet-wide port scan in one 7MB GIF, by HD Moore

theatrus213y ago· 2 in thread

The number of services which shouldn't normally be open is always concerning. Like port 3306.

How do you know they aren't just honeypot mysql instances?

Quantity.

namuol13y ago· 2 in thread

Does anyone want to explain how to read this? I've been scratching my head for a while...

snarfy13y ago

I believe it's a heat map of the first octet of the ip address that responded.

Heh and here I was eyes glazed over by the pretty colors.

sltkr13y ago

Actually, that GIF file seems to be 11 MB, not 7 MB! But here's the same thing in 340 KB (courtesy of Gifsicle): http://i.imgur.com/ozZhyu4.gif

jcr13y ago

If you haven't seen it yet, HD Moore did a great presentation on scanning at DerbyCon 2012. Video is avaiilable here:

vacri13y ago

Would have been more interesting without the crazy space-filling-curve-esque pattern. Harder to read this way.

Awesome work!

An internet-wide port scan in one 7MB GIF, by HD Moore (opens in new tab)