A Commercial Scanner Cataloging My Services
Not every hit on a honeypot is an attack. This one was a commercial scanner recording what my box exposes. I closed it as benign, and wrote it up because deciding what not to escalate is as much a part of triage as catching what to escalate.
Triage summary
Benign- Disposition
- Benign: legitimate commercial scanner
- Source
- 91.231.89.129 (ONYPHE, AS213412)
- Target
- 9770/TCP
- Action taken
- Closed as informational; not reported
Evidence
- ▸One TCP handshake to 9770/TCP, a banner grab, then an immediate RST, about 98 milliseconds from start to finish.
- ▸The source, 91.231.89.129, belongs to ONYPHE (AS213412), a company that scans the internet and sells searchable access to what it finds.
- ▸It showed up at all because T-Pot’s Blackhole mode, which null-routes known mass scanners like this one, was left off.
Why benign is not the same as nothing
The scan does no harm, and reporting a legitimate research scanner to an abuse database would be a false report. But ONYPHE’s product is a searchable record of what my box exposes, available to anyone who pays, including people looking for targets. The scan is the first step of someone else’s reconnaissance, done for them in advance.
What I would alert on
Not the scan itself. In a SOC I would tag known research scanners so they drop out of the triage queue, and alert on a pairing instead: a service gets catalogued, then sees targeted traffic in the following days.