[cobertos]

> However, in the context of data from Terrace and others we believe a more likely factor is the vantage point itself. Internet scanning often consists of large campaigns coordinated by specific actors,

How does one do a measurement of traffic like this? You would have to own the nodes in the packet route to be able to see traffic, but TerraceNetworks or GreyNoise don't seem to be companies that do that. How do they get the data to analyze?

[signalblur]

Greynoise and others have shell companies and spin up exposed infra specifically to pick up scanning activity.

They have them all over the world to get attackers scanning only certain regions etc.

I should also note - I’m extremely skeptical of the OPs claims or inference that the attackers have potentially fingerprinted greynoises sensors. To suggest this while some traffic increased from specific ASN’s seems unlikely that this was the case.

If it’s not clear - this was written by a competitor of theirs.

[RupertSalt]

If you want a disinterested perspective from the Research & Education community, look to CAIDA, the Center for Applied Internet Data Analysis: https://www.caida.org/

Also I just found "Hawkeye" the author of TinyFugue, Ken Keys, employed here! Cool beans!

[ericpauley]

We cannot know for certain what the root cause is. However, honeypot fingerprinting is a well-known risk for any vantage point, particularly a high-profile one.

[ericpauley]

This is a very challenging problem, especially if you don’t want to be over-concentrated on specific threat actors (as we suspect has happened here).