Discovery
Candidate clusters
Client fingerprints carried by at least 20 source IPs, confined to 4 or fewer networks, and aimed at 6 or fewer ports. That concentration is the shape of one coordinated operation rather than a broad scanner. These are candidates for review, not confirmed campaigns. Open one to see the full population behind it and judge for yourself. Recomputed hourly over the last 30 days.
The fingerprint landscape
111 fingerprints 路 10 glowing candidates
Each dot is a client fingerprint. Common tools spread right across many networks; a concentrated operation glows up and to the left, inside the shaded zone. Hover for detail, tap a glowing dot to dig into its population.
Concentrated candidates, by concentration
Concentration scores scale (source IPs) against tightness (few networks, few ports); a wide port sweep is the signature of scanning, so the few-ports filter keeps focused operations and drops the noise. The network-type badge is where the IPs live: a cluster on consumer ISP space is the classic compromised-device shape, while cloud or hosting points to rented infrastructure. Verify any candidate on its fingerprint page before treating it as a campaign.