Risky Biz Soap Box #61
Summary: In this sponsored Risky Biz Soap Box episode, GreyNoise founder and CEO Andrew Morris describes how mass scanning has shifted from incrementing IPv4 addresses and blasting SYN packets to starting with domain lists, because shared CDN hosts mean one IP can front hundreds of thousands of sites. He says roughly nine in ten things on the internet now use HTTP for non-web functions, and that tools like Masscan, Unicornscan and Zmap plus cheap cloud IP recycling have lowered the skill needed to scan at scale.
Why it matters: GreyNoise is looking to move beyond selling API data for SIEM enrichment toward actually blocking mass scanning from customer environments, and even working with telcos to scrub the most egregious traffic off the internet - a shift that changes what a SOC can expect from its scanning-intelligence feed.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026