Hello and welcome to the Friday, August 8th, 2025 edition of the Sands Inlet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

This episode is brought to you by the Sandsdot EDU graduate certificate program in incident response.

In diaries today, we have yet again one of our sands.org, undergraduate interns

that wrote up a little observation from their own honeypot.

Duncan Woosley observed all of a sudden a big influx of scans from

Anima. Looking at it closer, it actually turned out that this was associated with ESN 43350,

ASN autonomous systems or autonomous system numbers. That's basically the different networks connected to the

internet and ESN 43350, which is assigned to a company called Enforce Entertainment, well,

has a little bit of habit of often renting out its IP address space. So that, of course,

opens them up to more suspicious

and, well, sometimes malicious uses.

The traffic spiked over a couple days

between April and then later again in July.

The next question, of course,

always comes up here is block lists.

And last time I mentioned block lists in diary,

there was a question that came up,

why I don't like blocklist?

So should you block this particular ASN?

Well, maybe it really all depends on your own network.

Blocking sort of a big scanner like this can certainly reduce the noise in your network,

...