Merit Telescope Darknet Scanners dataset (04/26/2011)

Summary of scanning activities observed at Merit's darknet monitor. The dataset includes: 1) the IP addresses that have been observed in the darknet monitor to perform scanning, 2) the amount of unsolicited packets that these IPs transmitted. This dataset is updated daily. A scanner is defined as an IP that has transmitted more than X amount of packets into Merit's NET35 darknet space (X is a configurable threshold currently set to 1000 packets). REMARKS: 1) this dataset may also include backscatter activity or other types of traffic associated with network misconfiguration or other user errors. In other words, the fact that an origin IP has sent more than 1000 packets does not necessarily mean its performing scanning, 2) this dataset does not differentiate between malicious and benign scanning (e.g., for research purposes). Researchers interested compiling their own list of scanners, using their own definition of scanning, may request access to Merit's darknet dataset ("Longitudinal Darknet 35/8").