What this ranking shows
Internet scanners automatically probe public IPs and ports for exposed services, vulnerabilities, and misconfigurations. Some activity supports legitimate research, while high-volume or persistent scanning can also signal reconnaissance before an attack.
Whatoblock's honeypot sensors emulate exposed services and record scanner sources, targeted protocols, geography, and frequency. This creates a consistent view of scanning behavior across the observation network.
The ranking highlights the ten most active scanner IPs in the current 31-day window. Activity timelines, targeted protocols, and first- and last-seen timestamps distinguish short bursts from sustained reconnaissance.