Hello and welcome to the Wednesday, May 21st, 2025 edition of the Sands and its Storms anders Stormcast.

My name is Johannes Ulrich, and this episode brought to you by the Graduate Certific Program in Cyber Defense Operations is recorded again in Jacksonville, Florida.

Well, today's diary is not a hot new threat for a change,

but something that has been happening for a while.

The reason I wrote about it today was earlier today,

Caleb in our Slack channel asked the question

whether or not a researcher scanning the internet

actually obey RFC 9511. Now, you may ask what is RFC 9511.

It's a standard that suggests researchers who are scanning the internet, well, should do something

to identify their scans as originating from a research project and also help people who are targeted by

these scans to contact whoever is the origin organization of these scans. There are a number of

methods that this particular RFC proposes. For example, you can set up a web server on the system performing

the scans and then a standard file on that web server will identify the origin of the scan.

Also, you can basically add some information like a URL or such as part of the payload of the data that you're sending.

The most common implementation I see is that researchers are adding a string like a URL to the user

agent when they're scanning web applications. And that's, of course, one thing that we are looking at.

For a few years now, we are publishing a list of IP addresses

that we consider part of research organizations performing scan.

Now, some of them are commercial, but the idea is the same

that they're scanning the Internet to, for example, identify

infected systems or identify weekly configured systems. Shodan, probably being the largest

one, census also being quite robust and oftenly cited when it comes to these type of scans.

...