TCP/UDP Scanners
Who is scanning you?
See every scan, the network behind it and the exact packet it sent.
Watch on YouTube
Guest User
Please login to access your profile
Guest User
Please login to access your profile
Product reference
Learn how to investigate scanner records, read the live threat map, and connect Whatoblock data to your workflow.
Every scan our sensors record, one observation per row. Find out who is probing which services, from which networks, and what they sent.
TCP/UDP Scanners
See every scan, the network behind it and the exact packet it sent.
Watch on YouTubeOpen TCP/UDP Scanners in the dashboard. The video above walks through the same steps as this guide.
The number of records that match your current filters. It updates as soon as you change a filter.
Search, time range, filters and noise switches.
The matching observations, newest first by default.
Paste an address from your firewall or server logs into IP or record ID and press Search (or Enter). You get every observation from that source.
You can also paste a record ID to jump straight to one specific observation, for example one a teammate shared with you.
| Option | Shows |
|---|---|
| Last 24h (default) | The last 24 hours |
| Last 7d | The last 7 days |
| Last 31d | The last 31 days |
| Custom | Your own dates, in UTC, up to 31 days per range |
All times on the page are in UTC. Longer ranges contain far more records and can take a little longer to count.
Six filters let you narrow the records:
| Filter | Matches |
|---|---|
| Origin country | The country the scan came from |
| Target country | The country of the sensor that was hit |
| Detected protocol | The service identified in the packet, such as SSH, RDP, VNC or HTTP |
| AS number | The Autonomous System Number of the source network |
| Organization | The organization that owns the source IP |
| ISP | The provider of the source IP |
Every list shows how many records sit behind each value, so you can see where the volume is before you choose. Start typing to narrow the list, and click × to remove a filter.
Transport limits the records to TCP, UDP, or All.
Three switches remove traffic you usually don't need:
| Switch | Default | Effect |
|---|---|---|
| Hide unknown protocols | On | Hides observations whose protocol could not be identified |
| Hide known scanners | Off | Hides research scanners such as Censys, ZoomEye and Driftnet, so you see the scanners that matter |
| Hide spoofable UDP | Off | Hides all UDP observations, because UDP source addresses can be faked |
TCP source addresses are verifiable, while UDP source addresses can be spoofed. When you need verified sources, for example in a report, use TCP or turn on Hide spoofable UDP.
Each row is one observation:
| Column | Shows |
|---|---|
| Source IP | The address that sent the scan |
| Service | Transport, port and detected protocol, for example TCP :5900 VNC |
| Source network | Organization, ISP and AS number |
| Observation route | Origin country → target country |
| Observed UTC | The exact time, to the second |
| Actions | View the packet, export the record, or open the details |
Next to most values in a row there is a small filter icon. Click it to filter the whole page by that value instantly: a protocol, a network, an AS number or a country. Your other filters stay in place, so you can keep narrowing step by step.
Click View on a row to open its details:
View packet (the </> icon) shows the captured payload exactly as it reached our sensor:
Readable text, such as commands a bot ran after logging in to an SSH honeypot.
The bytes, spaced for reading.
The raw bytes as one string.
Use Copy text to copy it, or Export JSON to take it into your own tools.
Click Export to download the records that match your filters. Exports are part of CTI Unlimited.
.gz download. The link stays valid for 1 hour, and closing the dialog cancels the export.Paste it into IP or record ID → Search → review its ports, protocols and target countries → View a record → Investigate IP ↗ for the full profile.
Last 24h → Detected protocol RDP → Hide known scanners → open a few records and their packets.
Target country set to your country → Last 7d → check which protocols lead in the Detected protocol list → Copy link to share the view.
Transport TCP → Hide known scanners → Export → CSV.
Click the filter icon next to an interesting AS number → see everything that network is scanning → Open in Analysis for the big picture.
Turn millions of scans into charts, maps and reports.
TCP/UDP Scanners
Turn millions of scans into charts, maps and reports.
Watch on YouTubeOpen TCP/UDP Scanner Analysis in the dashboard, or press Open in Analysis on the TCP/UDP Scanners page to carry your filters over. The video above walks through the same steps as this guide.
The number of scans behind everything on the page. It changes with every filter you apply.
The same filters as on the TCP/UDP Scanners page.
Everything below the filters, all based on the same matching scans.
Every chart is also a filter. One click narrows the whole page, and the exact records are one more click away.
| Option | Shows |
|---|---|
| Last 24h (default) | The last 24 hours |
| Last 7d | The last 7 days |
| Last 31d | The last 31 days |
| Custom | Your own dates, in UTC, up to 31 days per range |
| Filter | Matches |
|---|---|
| Origin country | The country the scans came from |
| Target country | The country of the sensor that was hit |
| Detected protocol | The service identified in the packet, such as SSH, RDP, VNC or HTTP |
| AS number | The Autonomous System Number of the source network |
| Organization | The organization that owns the source IP |
| ISP | The provider of the source IP |
Every filter suggests its values with their number of scans. Start typing and the list narrows to the values that match. Click × to remove a filter.
Transport limits the page to TCP, UDP, or All.
| Switch | Default | Effect |
|---|---|---|
| Hide unknown protocols | On | Hides scans whose protocol could not be identified |
| Hide known scanners | Off | Hides research scanners such as Censys, ZoomEye and Driftnet, so you see the scanners that matter |
| Hide spoofable UDP | Off | Hides all UDP scans, because UDP source addresses can be faked |
| Card | Shows |
|---|---|
| Unique source IPs | How many different addresses sent these scans |
| Spoofable UDP records | UDP scans, whose source address could be faked |
| Top detected protocol | The most scanned protocol, with its share of matching scans |
| Top origin country | The country most scans came from, with its share |
The ten most scanned protocols, with everything else grouped as Other protocols.
Where the scans come from.
Which countries were hit.
Both show the ten leading countries plus Other countries, each with its scans and share. Click a country to filter by it.
A world view of the same data.
The busiest source IPs as a treemap. The bigger the tile, the more scans.
Scans on the left scale and Unique IPs on the right.
| Time range | Granularity |
|---|---|
| Last 24h | Hourly |
| Last 7d | Daily, can switch to hourly |
| Last 31d | Daily, can switch to weekly |
The networks the scans come from, with their rank, scans, share, top protocol and last seen time (UTC).
The two pages share the same filters:
Chart clicks, treemap tiles and View open the matching records.
Open in Analysis brings your filters back to the charts.
Spot a pattern here, and pull the evidence there.
Copy link saves this exact view, with every filter and every setting (including the scanner limit, the map view and the time granularity), as one link. Drop it into a ticket or send it to a teammate, and they see exactly what you see.
Click Report to share the view with someone outside the dashboard. Reports are part of CTI Unlimited.
The protocol chart, the map and the activity chart also work from the keyboard. Use the arrow keys to explore and Enter to filter.
Find the peak in Scan activity over time → click it to open that hour's records → Open in Analysis → read the leading protocol, the number of IPs and the top organization for just that hour.
Last 7d → Hide known scanners → Top organizations → View the top rows' records.
Geographic distribution → Target → click your country → check Detected protocols and Most active scanners.
Set your filters → Report → Download PDF.
More tutorials on the Whatoblock YouTube channel.
A live global visualization of threat activity. Watch live attack lines and threat events unfold on an interactive map.
The Threat Map is available at threatmap.whatoblock.com. It is completely free, requires no account, and works on any device.
The map ingests data from three threat intelligence sources. Each source is rendered with a distinct color:
Switch between two rendering modes from the settings panel. The map opens on the 3D globe.
The settings panel (top left on desktop, menu button on mobile) provides:
The map detects your device on the first visit and picks the right level of effects for a phone or tablet, a laptop or a desktop. There is nothing to set.
The stats panel (top right) updates live with:
Total events in the last 24 hours and breakdowns per source (Botnet, Scanner, Heartbeat), with a country count.
The five countries receiving the most attacks, ranked by event count with relative bar charts.
The five countries generating the most threat activity.
The news panel (bottom left on desktop, opened with the Live activity button on mobile) shows a scrollable feed of the latest threat events as they appear on the map, including origin, target, source type, and masked IP addresses.
148.240.xxx.xxx) for privacy.