I Know Who You Scanned Last Summer: Mapping the Landscape of Internet-Wide Scanners

In today's Internet, a plethora of services are, intentionally or unintentionally, publicly accessible. Internet-wide port scanning is a widely used method to discover such services. Malicious actors as well as researchers use port scans to detect and analyze exposed Internet services. Vulnerabilities in Internet of Things (IoT) devices and their associated services have been a target of widespread malicious activity involving botnets, such as the Mirai botnet. As a result, IoT protocols are of particular relevance to vulnerability scanning and Internet security. This development raises the question of who is scanning the Internet, particularly IoT ports, and their intentions. In this work, we analyze the traffic received over the period of 8 months on 6 honeypots located across different continents. On each honeypot, we provide selected IoT services, namely AMQP, CoAP, MQTT, and OPC UA. We identify scanners that scan these honeypots and categorize their scanning behavior, e.g., the scanning range and frequency. We identified 43 organizations responsible for 30.3 % of overall traffic, of which 21 scan at least one of the selected IoT services. We further analyze the scanning tools used. We identified traffic generated by scanning tools such as Masscan, ZMap” and the Mirai botnet.