Headline numbers
The week of 2026-06-01 produced 200,000 total events across the BoarNet fleet, sourced from 2,057 distinct IPs. Of those, 17,734 IPs were novel — addresses the fleet had not previously logged — suggesting ongoing churn in the scanning population rather than a stable set of repeat offenders. The event-to-IP ratio is high (roughly 97 events per IP on average), but that average is skewed heavily by a small number of high-volume sources, as the ASN leaderboard makes clear.
Dropper delivery was attempted 286 times during the window. Of the 120 malware samples collected, 6 were confirmed malicious by community AV engines, with 114 distinct dropper URLs or staging paths observed — a ratio that suggests payload infrastructure is being rotated quickly, likely to evade reputation-based blocking.
Edge-device targets
Fingerprinted edge-device probing remained low in absolute terms but spans the categories defenders care about most. Generic soho-router fingerprint matches accounted for 11 events across 11 distinct IPs — a 1:1 IP-to-event ratio indicating opportunistic, non-repeat scanning rather than a focused campaign. Microsoft Exchange targets matched the same raw event count (11 events) but from a slightly tighter cluster of 8 IPs, consistent with automated vulnerability scanners sweeping known Exchange-facing paths.
Fortinet and Cisco ASA targets each recorded 3 events from 3 distinct IPs. While the absolute numbers are small, the 1:1 IP-to-event pattern repeats, reinforcing the opportunistic-scanner interpretation. CVE coverage in the data confirms that older, well-documented vulnerabilities remain active targets: cve-2022-22947 (Spring Cloud Gateway SPEL injection) generated 10 events from a single IP — a sign of scripted, high-volume probing from one source — while cve-2015-1880 and cve-2018-10561 each appeared from 2–3 distinct IPs. The presence of a 2015-vintage CVE in active probing underscores how long unpatched exposure windows persist in the wild.
Probe families
syn-only traffic is the dominant probe family at 96,816 events from 1,036 IPs, representing roughly 48% of all events. This is consistent with mass internet-wide port enumeration — scanners sending SYN packets to the fleet's 15 sink ports without completing handshakes. The unknown family (21,434 events, 439 IPs) reflects payloads the classifier did not match to a known protocol fingerprint; these warrant closer inspection as potential novel tooling or obfuscated probes.
Among application-layer families, postgres leads with 1,651 events across 27 IPs, followed by rdp (1,378 events, 84 IPs) and mongodb (558 events, 51 IPs). The rdp family's relatively wide IP spread (84 sources) compared to postgres (27 sources) suggests RDP scanning is more distributed — possibly sourced from a larger botnet or coordinated but loosely coupled infrastructure.
tls-on-nontls (450 events, 187 IPs) and http-on-nonstd (296 events, 123 IPs) are worth noting because their high distinct-IP counts relative to event totals indicate many sources each making a small number of attempts — characteristic of automated tooling that probes non-standard ports for misrouted or misconfigured services. mssql (134 events, 71 IPs) and socks5-proxy-check (77 events, 21 IPs) round out the top ten; the latter is a reliable indicator of infrastructure being recruited or verified for proxy abuse.
Geographic hotspots
US-geolocated traffic accounted for 97,579 events from 766 IPs — nearly half of total volume — driven primarily by cloud-hosted infrastructure rather than consumer or enterprise endpoints. AS14061 (DigitalOcean) alone contributed 85,995 events from 206 IPs, which is 43% of the entire week's event count from just one ASN. This level of concentration in a single cloud provider is a recurring pattern in honeypot data and reflects the ease of provisioning ephemeral VMs for scanning campaigns.
China-geolocated sources produced 29,004 events from 244 IPs, with significant contributions from both AS37963 (16,228 events, 20 IPs) and AS4134 (7,793 events, 84 IPs). The 20-IP concentration in AS37963 generating over 16 K events points to a small number of high-rate scanners. Singapore (10,322 events, 60 IPs), Indonesia (9,625 events, 21 IPs), and Malaysia (9,225 events, 12 IPs) round out the top five — Southeast Asian cloud and ISP infrastructure continues to be a consistent source of scan traffic in BoarNet data.
Finland's appearance at sixth place (7,603 events, just 2 IPs) is structurally similar to AS203003 (MAGNA-CAPAX, 6,918 events from a single IP) and AS24835 / RAYA-AS (3,658 events, 1 IP): extreme event-to-IP ratios from single nodes, likely dedicated scanning hosts or compromised servers running persistent tooling.
Malware corpus
The 286 dropper attempts resulted in 120 samples being captured, of which 6 were flagged as malicious by community AV engines. The low confirmation rate (5%) against a backdrop of 114 distinct dropper sources is consistent with freshly staged payloads that have not yet accumulated detection signatures — a common evasion posture. Defenders should treat all 120 samples as suspicious regardless of AV verdict given the delivery context. The high dropper-source diversity (114 distinct staging locations for 120 samples) further suggests that payload hosting is being actively rotated, possibly across compromised web servers or short-lived cloud instances, to limit the utility of blocklist-based defenses.