Discovery
Candidate clusters
Client fingerprints carried by at least 20 source IPs, confined to 4 or fewer networks, and aimed at 6 or fewer ports. That concentration is the shape of one coordinated operation rather than a broad scanner. These are candidates for review, not confirmed campaigns. Open one to see the full population behind it and judge for yourself. Recomputed hourly over the last 30 days.
This list finds coordination that concentrates. An operator who spreads across many networks on purpose produces the opposite shape, a near-1:1 ratio of addresses to networks, and will not appear here however deliberate it is. A fingerprint page reads that shape separately and will call it dispersed, so absence from this list is not evidence that a fingerprint is benign.
The fingerprint landscape
109 fingerprints 路 22 glowing candidates
Each dot is a client fingerprint. Common tools spread right across many networks; a concentrated operation glows up and to the left, inside the shaded zone. Hover for detail, tap a glowing dot to dig into its population.
Concentrated candidates, by concentration
Concentration scores scale (source IPs) against tightness (few networks, few ports); a wide port sweep is the signature of scanning, so the few-ports filter keeps focused operations and drops the noise. The network-type badge is where the IPs live: a cluster on consumer ISP space is the classic compromised-device shape, while cloud or hosting points to rented infrastructure. Verify any candidate on its fingerprint page before treating it as a campaign.