Grey Noise | IP Geo Destination Launch Blog

Summary: GreyNoise released an IP Geo Destination feature, available to all customers through the Visualizer and API endpoints, that shows the destination countries of opportunistic scan traffic observed across its sensor network. Using recent DB2 database scanning as an example, GreyNoise said traffic from the DB2 Scanner over the last 7 days was evenly distributed across its sensors in 41 countries, and that all IPs scanning for DB2 instances in that period were tagged as malicious, many with multiple worm-related tags.
Key Takeaway: Every IP GreyNoise saw scanning for DB2 instances in the last seven days was tagged malicious, many tied to worms trying to propagate across internet-connected systems - and the same destination data lets defenders isolate scans aimed at a single country, such as Ukraine.

Read the original at GreyNoise Blog ↗