Honeypots

47 different chunks of the internet, each a full /24 block of up to 256 addresses, started scanning my infrastructure within 68 seconds of each other. 47 entire networks, most of them belonging to a single hosting provider. 6 months of logs turned up more than a dozen of these synchronized waves, and at least 3 of them weren't one-time events. The same operators came back days later and ran the exact same target list again, like clockwork.