November 6, 2026research

How we count attackers (and why everyone else’s number is wrong)

53,838 IPs audited: 8% of the sources hitting our honeypots are research scanners, not attackers. Here is the forward-confirmed method, the exact numbers, and the limits.

#methodology#scanner#threat-intel#attacker-counts

The number everyone publishes and nobody audits

Ask any threat-intel feed for its headline metric and you will get some variant of "active attackers": unique IPs observed in the last 24 hours or 7 days. It is the first number on every dashboard, the first line of every pitch deck, and — at most vendors — the least examined number in the product.

We audited ours. The result changed our public counters, our leaderboard, and this post is the methodology, the numbers, and the limits — published so you can hold us to them.

What we found

BlackDome runs six honeypot sensors (Sydney, Helsinki, New York, London, Bangalore, Toronto), each emulating 20 services, recording every connection with session evidence. Over the last 30 days we observed 53,838 unique source IPs. Of those:

  • 49,446 (92%) were real attackers — interactive or exploit-driven traffic against our decoys.
  • 4,392 (8%) were forward-confirmed research scanners — internet-measurement infrastructure from Shodan, Censys, Shadowserver, Stretchoid, Onyphe, BinaryEdge, Reposify, Internet Measurement, Modat, academic projects (Georgia Tech, Max Planck, TU Dresden), and others.

By event volume the split is even starker: scanners generate 0.8% of events (128K of 15.5M over 30 days) — but up to 20% of unique IPs on a quiet day (yesterday: 3,584 real attackers vs 720 scanners, 17%).

That is the inflation mechanism: a small number of scanner platforms, each sweeping from many addresses, inflates "unique attacker" counts by 15–20% without generating meaningful attack data. If a feed's attacker number and its attack volume do not reconcile, this is usually why.

How we classify (and how we resist being fooled)

We tag scanners by forward-confirmed reverse DNS:

  1. Take the source IP of an observed connection.
  2. Look up its PTR record.
  3. Confirm the hostname resolves forward back to the same IP.

A PTR alone is not evidence — anyone can set shodan.example.com on their host. The forward confirmation step means spoofed hostnames do not count. Hostnames are matched against a curated list of measurement operators, maintained in our edge repo (data/scanner_cidrs.txt plus the operator list) and checked every five minutes by a dedicated classifier worker.

Classification results live in a first-class table (blackdome_scanner_ips) with the method, the evidence PTR, and a re-check expiry — so tags decay and are re-verified, not assumed forever.

What changed on our public surface

  • Homepage counters now show both numbers side by side: real attackers and research scanners, separately, over the same 24-hour window.
  • The Explorer leaderboard excludes scanners from ranking. The top of our leaderboard is attacker infrastructure, not a census of the measurement internet.
  • Country and daily-rollup statistics exclude scanners from attacker metrics and carry separate scanner metrics (research_scanners_unique, research_scanner_events) so the split is auditable downstream.

The honest limits

  • Coverage is a floor. Scanners without PTR records — some cloud-hosted measurement runs among them — still count as attackers until we add published CIDR ranges to the list. Our attacker counts are, if anything, slightly conservative in the scanner direction.
  • Classification is behavioral geography, not morality. Research scanners are not adversaries, but they are also not attacks against your organization; they belong in a separate bucket, which is where we put them.
  • One scanner's "scan" is another feed's "attack." We publish our threshold behaviour too: scan-only traffic above 120 events per source IP per minute is summarized, not stored per-event.

Why this matters if you buy threat intel

When you evaluate any feed — including ours — ask two questions:

  1. Do your attacker counts exclude research scanners, and can you show the method?
  2. Do your unique-IP counts reconcile with your event volumes, or is there a 5–20x gap?

Feeds that cannot answer those questions are selling you the measurement internet as adversary activity. We would rather publish the split and be compared on the real half.

The data

  • Scanner classification: forward-confirmed reverse DNS, curated operator list, 5-minute classification cadence, 30-day backfill across all attacker IPs.
  • Live split: see the Active Attackers (24h) and Research Scanners (24h) counters on the BlackDome homepage.
  • Paid intel customers get the same per-IP tag in the API, so your detections can filter, flag, or fold scanners exactly the way we do.
  • Sensor and capture details: Sensor Network.