Reactive Constraint-Based Geolocation of Internet Hosts

arXiv:2610.05545v1 [cs.NI] 4 Oct 2026

Reactive Constraint-Based Geolocation of Internet Hosts Spencer Ye

Chase Kanipe

sye15@jh.edu Johns Hopkins University Baltimore, MD, USA

ckanipe1@jhu.edu Johns Hopkins University Baltimore, MD, USA

Peter Ryan

Erik Rye

pr2427@nyu.edu New York University New York, NY, USA

rye@jhu.edu Johns Hopkins University Baltimore, MD, USA

Abstract

rather than initiating scans on its own. When these scanners respond to our SYN-ACK with an ACK or RST, we obtain an RTT measurement. We leverage these unsolicited scans for two geolocation purposes. First, because refuting a claimed location requires only a single vantage point, we demonstrate that the RTTs we receive can be used to falsify IP geolocations of two widely used commercial geolocation databases. Second, when we obtain RTT measurements to an Internet-wide scanner from three or more of our vantage points (whose locations are known), we can multilaterate its position. In sum, this work includes the following contributions:

Active IP geolocation techniques rely on the responsiveness of Internet hosts, while passive techniques depend on data sources that are unevenly adopted and prone to staleness and error. In this work, we invert the active IP geolocation problem by listening at a geographically distributed set of vantage points for unsolicited Internet scans. By reactively completing connections with these scanners, we obtain round-trip time (RTT) measurements from hosts that may otherwise be unresponsive and use those measurements for geolocation. Over the course of 20 days in August 2026, we recorded 46.8 million scans from 289 746 distinct scanners, with a reactive RTT for each scan. We show that reactive RTTs align with those obtained by sending active probes, with more than three-quarters of 990 204 measurement pairs differing by at most 10 ms. Over half of the scanners that yielded a reactive RTT did not answer our active probes, highlighting the value of our approach. We demonstrate the feasibility of multilateration using purely reactive RTTs for 56 112 distinct IP addresses. Finally, using speed-of-light constraints, we refute commercial geolocation claims for 6852 addresses.

1

(1) Twenty-day deployment of a Reactive CBG platform using 42 cloud-hosted vantage points in 29 countries on six continents (§4). (2) Validation of the consistency between reactive and active RTT measurements (§4.2). (3) Falsification of the geolocations of 6852 addresses in two commercial geolocation databases (§4.3). (4) Demonstration of the efficacy and limitations of Reactive CBG-based localization (§4.4). (5) Public release of our Reactive CBG system [1].

Introduction

2

Traditional IP geolocation methods are either active or passive. Active techniques, e.g., Constraint-Based Geolocation (CBG) [12], send packets toward the target to induce a response. Passive methods estimate a target’s location without direct interaction, e.g., from geofeeds or databases. Active IP geolocation relies on the responsiveness of routers and hosts to obtain Round-Trip Time (RTT) measurements, but filtering policies may prevent active probes from reaching their targets, prevent a response from being generated, or prevent that response from returning to a vantage point [4, 14]. Passive techniques do not require the target to be responsive, but frequently require the cooperation of a service provider. Geofeeds, a popular passive mechanism, are unevenly adopted and may report stale or incorrect locations. In this work, we introduce a third category, reactive IP geolocation, in which the target initiates the interaction. Our technique, called Reactive CBG, inverts the well-known CBG approach. Reactive CBG uses unsolicited inbound connections from Internet-wide scanners [7, 8, 27], whose location shapes what they observe [32],

Background and Related Work

Over the last 25 years, researchers have developed various techniques for IP geolocation. We describe active geolocation, which probes the target; passive geolocation, which does not interact with the target; and reactive network telescopes, which respond to unsolicited traffic.

2.1

Active Geolocation

In 2001, Padmanabhan and Subramanian published an early empirical study on IP geolocation. One of the techniques used, GeoPing, established the basis for active geolocation: ping a target from many geographically distributed landmarks and infer position from the resulting delay vectors [22]. CBG was introduced by Gueye et al. in 2004. CBG converts delays into distance upper bounds and intersects the resulting disks into a feasible region [12]. Katz-Bassett et al. later factored router topology into CBG [18]. Wong et al. generalized the constraint framework to include both positive and negative constraints, respectively representing where 1

NewGeo ’26, October 12, 2026, Karlsruhe, Germany

Scanner

Spencer Ye, Chase Kanipe, Peter Ryan, and Erik Rye

address that scanned our vantage point [17].1 Figure 1 shows the elapsed time we compute when the scanner replies with an ACK; the RST case is equivalent. For each scanner and vantage point pair, we keep the minimum RTT over every connection during the capture period and use it for falsification (§3.2) and multilateration (§3.3).

Vantage Point

SYN

SYN-ACK

ACK

3.1 RTT

Figure 1: Our system measures the elapsed time between sending a SYN-ACK and receiving an ACK or RST from an Internet scanner. the target must and cannot lie [35]. Youn et al. reframed geolocation statistically, replacing hard distance bounds with maximumlikelihood estimates over the joint distribution of delay and distance [37]. Wang et al. and Rye et al. developed IP geolocation techniques that incorporate additional, external “hints” about an IP’s location [29, 33]; Darwich et al. undertook a replication study of Wang’s work [6].

2.2

3.2

Passive Geolocation

Reactive Telescopes

Prior work has used techniques similar to Reactive CBG, in which a vantage point responds to traffic the target sends first. Hiesgen et al. [15] operated a reactive network telescope that answered unsolicited TCP SYNs in real time to elicit the second phase of stateless scans, characterizing scanning activity invisible to passive telescopes. Responsive vantage points of this kind date back to 2004 [3, 23, 26, 36].

3

Falsification Methodology

A vantage point that observes a scanner at an RTT of 𝑟 milliseconds bounds it to a disk of radius 100𝑟 km; data traverses fiber at close to 2 3 𝑐 [30], so a millisecond of RTT covers at most 100 km of separation. We use the full 23 𝑐 bound rather than the tighter 49 𝑐 that Katz-Bassett et al. [18] show holds for all but 0.04 % of measured paths. A claimed location outside of that 100𝑟 km disk is impossible, irrespective of the scanner’s true position [10, 34]. We select the vantage point with the smallest RTT for each scanner. We discard the source if the distance from that vantage point to any other observing vantage point exceeds the sum of the two RTT-derived distance bounds plus 50 km. Otherwise, we test the location claim against the selected vantage point. A claim is impossible if its distance from that vantage point, less any accuracy radius the provider publishes, exceeds the bound by a margin of 50–300 km set by the vantage point’s positional uncertainty (Table 3 in the Appendix).

There has been significant recent interest in using provider-reported geolocation information (called “geofeeds”), since providers ostensibly have ground truth information about where their prefixes are being used [5]. However, uneven adoption, stale or incorrect geolocation information, and malicious behavior can confound their utility [9, 20]. Commercial geolocation databases such as MaxMind [21] and IPinfo [16] are now a widely used source of IP geolocation data, and their (in)accuracy has been the subject of significant prior work [10, 11, 25].

2.3

Reactive RTT Validation Methodology

To validate reactive RTTs against active RTTs, each vantage point sends three active probes to a scanner immediately after recording its reactive RTT. We send an ICMP (or ICMPv6) Echo Request and one TCP SYN each to ports 80 and 443. If we receive an ICMP Echo Reply in response to the Echo Request, or a TCP SYN-ACK or RST in response to the TCP SYNs, we record the elapsed time as the active RTT for that scanner. Not all scanners respond to our active probes. For example, a firewall may permit this scannerinitiated exchange while blocking independently initiated probes. We do not consider ICMP error messages (e.g., port unreachable, administratively prohibited) to be valid replies. To avoid re-probing the same scanner repeatedly, each vantage point enforces a 24-hour cooldown before it actively measures an IP address again.

3.3

Multilateration Methodology

We follow the CBG [12] methodology. For each vantage point we fit a bestline, the tightest line RTT = 𝑎 + 𝑏 𝑑 lying below that vantage point’s observed pairs of distance 𝑑 and RTT, with intercept 𝑎 and slope 𝑏; it converts a measured RTT 𝑟 into a distance ceiling 𝑑 max = (𝑟 − 𝑎)/𝑏, or the speed-of-light ceiling 100𝑟 km where 𝑟 falls below the intercept. Each ceiling defines a disk, and the scanner must lie in their intersection. We fit bestlines to the RTT mesh among our own vantage points, not to external landmarks. For each ordered vantage-point pair, we use the minimum TCP handshake RTT from repeated connections to port 8443. We intersect geodesic disks by grid search, coarse then fine at a resolution proportional to the tightest disk, seeding the fine pass from the least-violating point when the coarse pass

Methodology

Our system measures the RTTs of unsolicited Internet scans for the purposes of IP geolocation. To do so, we listen for incoming TCP SYN packets on 23 ports, chosen because they are well-known ports for common services and because they are frequently subject to Internet-wide port scans and banner grabs (Table 4 in the Appendix lists the ports). When an incoming scan occurs, we reply with a standard SYNACK packet. Upon receiving either an ACK or RST in response to our SYN-ACK, we compute the RTT and store that value for the IP

1We use the minimum of the RTT computed from libpcap timestamps and the Linux

kernel’s tcpi_min_rtt value for the socket. 2

Reactive Constraint-Based Geolocation of Internet Hosts

NewGeo ’26, October 12, 2026, Karlsruhe, Germany

Table 1: Scans and scanners observed during the experiment.

Scans seen Unique addresses no active RTT seen by 1 vantage point seen by ≥ 3 tested ( ≤ 100 ms) falsified 100

IPv4

IPv6

Total

%

43 174 815 261 875 145 701 173 830 54 928 93 796 6503

3 615 196 27 871 8017 16 312 8002 19 859 349

46 790 011 289 746 153 718 190 142 62 930 113 655 6852

— 100.0 53.1 65.6 21.7 39.2 2.4

Table 2: Source IP addresses by the organization type of their Autonomous System owners.

either direction (990,204) active slower (400,121)

% of pairs ≤ x

76% within ±10 ms 60

4.2

62% within ±5 ms

32% within ±1 ms

0 0.01

0.1

1

10

100

SYN-ACK retransmit 1, 3, 7 s

1k

10k

|active − reactive| (ms)

Figure 2: CDF of the absolute difference between the reactive and active RTTs measured to the same scanner, on a logarithmic axis, for all pairs and split by which RTT was smaller. Dotted lines mark the SYN-ACK retransmission timers at 1, 3, and 7 s [24]. misses. We report the region’s area and centroid; sources with no common intersection are left unresolved rather than relaxing any bound.

4

4.3

71.56 26.76 1.25 0.19 0.11 0.09

Reactive RTT Validation Results

Falsification Results

Next, we compared IP geolocation data from two popular commercial vendors (IPinfo [16] and MaxMind [21]2 ) with our computed reactive RTTs to determine whether any of the reported IP locations can be falsified. First, we filtered scanning IPs for those that had a reactive RTT of ≤ 100 ms. We applied this filter because a 100 ms RTT creates a disk with a radius of 10 000 km, covering about half of the Earth’s surface. This resulted in a set of 113 655 IPs that we then geolocated using IPinfo and MaxMind. Then, we computed how many of these IP addresses were placed farther from a vantage point than the maximum distance our reactive RTT allows, with an additional margin of 50–300 km for the vantage point location. We also subtracted the accuracy radius MaxMind publishes with each entry. We found 6852 (6 %) of these listed at impossible locations: 6175 by MaxMind and 1210 by IPinfo, with 533 impossible in both. Of those 6852, 2837 (41 %) never answered our active probes, so two of every five refutations Reactive CBG produces were unavailable to our active measurements. Raising the margin to a uniform 250 km

Results

We deployed our Reactive CBG system to 42 vantage points in 29 countries for 20 days from August 10–29, 2026. In this section, we describe the scan corpus, compare reactive and active RTTs, and present our falsification and multilateration results.

4.1

%

207 363 77 543 3649 572 340 279

To validate that reactive RTTs closely approximate active RTTs, we sent three types of active probes to every scanner, subject to the cooldown of §3.1. When we obtained multiple active RTTs from a target, we selected the minimum. Figure 2 displays the difference between the reactive and active RTTs over 990 204 measurement pairs. The majority (75.5 %) of RTT differences are 10 ms or less, with a median absolute difference of 2.8 ms. In relative terms, 78 % of RTT pairs differ by at most 10 % of the reactive RTT. The active RTT was faster in 590 081 pairs (59.6 %) and slower in 400 121 pairs (40.4 %); two pairs had equal RTTs. When reactive RTTs exceed their active analogs, they provide a looser bound for geolocation rather than producing incorrect falsifications or location estimates. However, the reactive RTT yields the tighter distance bound in 40.4 % of pairs; since any measured RTT upper-bounds distance, these tighter bounds remain valid. Reactive RTTs also provide value when they are the only RTT available, as for 153 718 of 289 746 scanning IP addresses (53.1 %; Table 1). Reactive RTTs therefore provide a defensible basis for CBG.

40

20

Count

Internet Service Provider Hosting Business Education Unknown Government

The vast majority of source IP addresses (>98 %) were associated with organizations classified as “Internet Service Provider” or “Hosting”, with cloud service providers accounting for four of the six organizations with the most unique source IP addresses.

active faster (590,081) 80

Category

Corpus

We received 46.8 million scans. Most (92 %) arrived over IPv4; because our servers are part of the NTP Pool [13], their IPv6 addresses are public and drew some IPv6 scanning [28, 31]. We received a high volume of scanning, particularly on ports 445 and 5900, from a small number of scanners; in total we observed 289 746 unique source IP addresses (Table 1). The ratio of IPv4 to IPv6 source IPs is about the same as the ratio of scans, with 90 % of source IPs being IPv4 addresses. Table 2 provides a high-level categorization of the organizations listed as registered owners of the Autonomous Systems contained within the corpus, binned per IPinfo’s IP to Company Database [16].

2We used the GeoLite2 City database and researcher access to IPinfo.

3

NewGeo ’26, October 12, 2026, Karlsruhe, Germany

Spencer Ye, Chase Kanipe, Peter Ryan, and Erik Rye 100

1.0

% of solved sources ≤ x

0.8

0.6

0.4

0.2

antipodal

margin 250 km

fraction of impossible claims

MaxMind GeoLite2 (n=6,175) IPinfo database (n=1,210)

1,000

5–9 (17,803) 10–19 (9,838) ≥ 20 (4,373)

60

40

20

0

0.0 100

80

all (56,112) 3–4 vantage points (24,098)

10

10,000

excess over the physical bound (km)

1k

10k

Figure 4: Equivalent radius (that of a disk with the region’s area) of the feasible region for the 56 112 of 62 930 scanners seen by three or more vantage points whose constraints had a common intersection. The region tightens as more vantage points observe a scanner.

Figure 3: CDF of excess distance beyond our reactive RTT bounds for refuted MaxMind and IPinfo location claims. We tested 113 655 source addresses with a reactive RTT of at most 100 ms.

retains 5227 of MaxMind’s refutations and 1142 of IPinfo’s (85 and 94 %), so the result does not hinge on the per-vantage-point margins. For each target IP that MaxMind or IPinfo places at an impossible geolocation, we computed the excess distance beyond what physical bounds permit. Figure 3 is a CDF of that excess. IPinfo’s curve is dominated by three /24 networks roughly 800 km beyond the distance the speed of light permits given our reactive RTTs.

4.4

100

feasible region radius (km)

implementation, we can only geolocate hosts that initiate connections to our vantage points, which in practice limits our targets to Internet-wide scanners. For multilateration, we require a scanner to initiate a connection to at least three of our vantage points. CGNAT, last-mile and satellite delays loosen distance bounds, which affects localization accuracy. Finally, scanners may scan any TCP port, but we listened on only the 23 ports listed in Table 4 in the Appendix.

Multilateration Results

Only 62 930 (21.7 %) of scanners connected to three or more vantage points, the minimum for multilateration. Figure 4 shows the size of the feasible region for 56 112 IPs whose RTT-derived constraints had a common intersection. The remaining 6818 (11 %) had no common intersection, and their share rises with the number of constraints, from 7 % at three or four vantage points to 36 % at twenty or more. A hard-constraint method fails whenever one bound is too tight, typically because a scanner’s path is faster than any in our 42-point calibration mesh or the address is anycast; we report them rather than loosen the bounds, so the medians below cover the resolved subset. The median feasible region was smaller for scanners observed by more vantage points. Among the 24 098 IPs observed by three or four vantage points, the median equivalent radius was 7442 km, and only 2 % had a radius of 250 km or smaller. For the 9838 IPs observed by 10–19 vantage points, the median was 1039 km, with 2036 (21 %) at or below 250 km. For the 4373 IPs observed by at least 20 vantage points, the median was 427 km, with 1723 (39 %) at or below 250 km.

In this work, we demonstrated that unsolicited connections from Internet scanners can be used for geolocation, a technique we call Reactive CBG. Over 20 days across 42 vantage points in 29 countries, we recorded 46.8 million scans from 289 746 distinct sources. From these scans, we obtained reactive RTTs, which we used to (i) falsify IP geolocations given by two commercial geolocation services and (ii) coarsely multilaterate scanners that contact at least three vantage points. Because our reactive measurement system awaits connection attempts from Internet scanners, it sends no unsolicited traffic, works against targets that do not answer active probes, and can share infrastructure that provides other services without interference. Our results suggest that the primary contribution of Reactive CBG is falsification rather than localization, although our localization bounds tighten as more vantage points observe a scanner. We are open-sourcing our Reactive CBG platform [1] so that other researchers can build on our results.

5

Acknowledgments

6

Limitations

Our Reactive CBG methodology is subject to a number of limitations. First and foremost, due to the reactive nature of our CBG

Conclusion

We thank the anonymous reviewers and Robert Beverly for their thoughtful feedback. 4

Reactive Constraint-Based Geolocation of Internet Hosts

NewGeo ’26, October 12, 2026, Karlsruhe, Germany

References

[30] Ankit Singla, Balakrishnan Chandrasekaran, P. Brighten Godfrey, and Bruce Maggs. 2014. The Internet at the Speed of Light. In Workshop on Hot Topics in Networks (HotNets). [31] Hammas Bin Tanveer, Rachee Singh, Paul Pearce, and Rishab Nithyanand. 2023. Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild. In USENIX Security Symposium. [32] Gerry Wan, Liz Izhikevich, David Adrian, Katsunari Yoshioka, Ralph Holz, Christian Rossow, and Zakir Durumeric. 2020. On the Origin of Scanning: The Impact of Location on Internet-Wide Scans. In ACM Internet Measurement Conference (IMC). [33] Yong Wang, Daniel Burgener, Marcel Flores, Aleksandar Kuzmanovic, and Cheng Huang. 2011. Towards Street-Level Client-Independent IP Geolocation. In Symposium on Networked Systems Design and Implementation (NSDI). [34] Zachary Weinberg, Shinyoung Cho, Nicolas Christin, Vyas Sekar, and Phillipa Gill. 2018. How to Catch When Proxies Lie: Verifying the Physical Locations of Network Proxies with Active Geolocation. In ACM Internet Measurement Conference (IMC). [35] Bernard Wong, Ivan Stoyanov, and Emin Gün Sirer. 2007. Octant: A Comprehensive Framework for the Geolocalization of Internet Hosts. In Symposium on Networked Systems Design and Implementation (NSDI). [36] Vinod Yegneswaran, Paul Barford, and Dave Plonka. 2004. On the Design and Use of Internet Sinks for Network Abuse Monitoring. In International Symposium on Recent Advances in Intrusion Detection (RAID). [37] Inja Youn, Brian L. Mark, and Dana Richards. 2009. Statistical Geolocation of Internet Hosts. In International Conference on Computer Communication and Networks (ICCCN).

[1] 2026. Reactive-CBG Artifacts. https://github.com/Network-Security-PrivacyResearch/reactive-cbg. [2] Michael Bailey, David Dittrich, Erin Kenneally, and Doug Maughan. 2012. The Menlo Report. IEEE Security & Privacy 10, 2 (2012), 71–75. [3] Michael D. Bailey, Evan Cooke, Farnam Jahanian, Jose Nazario, and David Watson. 2005. The Internet Motion Sensor: A Distributed Blackhole Monitoring System. In Network and Distributed System Security Symposium (NDSS). [4] Shehar Bano, Philipp Richter, Mobin Javed, Srikanth Sundaresan, Zakir Durumeric, Steven J. Murdoch, Richard Mortier, and Vern Paxson. 2018. Scanning the Internet for Liveness. ACM SIGCOMM Computer Communication Review (CCR) 48, 2 (2018), 2–9. [5] Randy Bush, Massimo Candela, Warren Kumari, and Russ Housley. 2024. RFC 9632: Finding and Using Geofeed Data. [6] Omar Darwich, Hugo Rimlinger, Milo Dreyfus, Matthieu Gouel, and Kevin Vermeulen. 2023. Replication: Towards a Publicly Available Internet Scale IP Geolocation Dataset. In ACM Internet Measurement Conference (IMC). [7] Zakir Durumeric, Michael Bailey, and J. Alex Halderman. 2014. An Internet-Wide View of Internet-Wide Scanning. In USENIX Security Symposium. [8] Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. 2013. ZMap: Fast Internet-Wide Scanning and Its Security Applications. In USENIX Security Symposium. [9] Rahel A. Fainchtein and Micah Sherr. 2024. You Can Find Me Here: A Study of the Early Adoption of Geofeeds. In Passive and Active Network Measurement Conference (PAM). [10] Manaf Gharaibeh, Anant Shah, Bradley Huffaker, Han Zhang, Roya Ensafi, and Christos Papadopoulos. 2017. A Look at Router Geolocation in Public and Commercial Databases. In ACM Internet Measurement Conference (IMC). [11] Matthieu Gouel, Kevin Vermeulen, Olivier Fourmaux, Timur Friedman, and Robert Beverly. 2021. IP Geolocation Database Stability and Implications for Network Research. In Network Traffic Measurement and Analysis (TMA). [12] Bamba Gueye, Artur Ziviani, Mark Crovella, and Serge Fdida. 2004. ConstraintBased Geolocation of Internet Hosts. In ACM Internet Measurement Conference (IMC). [13] Ask Bjørn Hansen. 2026. NTP Pool. https://www.ntppool.org. [14] John Heidemann, Yuri Pradkin, Ramesh Govindan, Christos Papadopoulos, Genevieve Bartlett, and Joseph Bannister. 2008. Census and Survey of the Visible Internet. In ACM Internet Measurement Conference (IMC). [15] Raphael Hiesgen, Marcin Nawrocki, Alistair King, Alberto Dainotti, Thomas C. Schmidt, and Matthias Wählisch. 2022. Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope. In USENIX Security Symposium. [16] IPinfo.io. 2026. IP Geolocation Database. https://ipinfo.io/products/ipgeolocation-database, database of 2026-08-31. [17] Hao Jiang and Constantinos Dovrolis. 2002. Passive Estimation of TCP RoundTrip Times. ACM SIGCOMM Computer Communication Review (CCR) (2002). [18] Ethan Katz-Bassett, John P. John, Arvind Krishnamurthy, David Wetherall, Thomas Anderson, and Yatin Chawathe. 2006. Towards IP Geolocation Using Delay and Topology Measurements. In ACM Internet Measurement Conference (IMC). [19] Erik Kline, Krzysztof Duleba, Zoltan Szamonek, Stefan Moser, and Warren Kumari. 2020. RFC 8805: A Format for Self-Published IP Geolocation Feeds. [20] Ioana Livadariu, Kevin Vermeulen, Maxime Mouchet, and Vasilis Giotsas. 2024. Geofeeds: Revolutionizing IP Geolocation or Illusionary Promises?. In ACM Conference on emerging Networking EXperiments and Technologies (CoNEXT). [21] MaxMind, Inc. 2026. GeoLite2 Free Geolocation Data. https://dev.maxmind.com/ geoip/geolite2-free-geolocation-data, database of 2026-08-28. [22] Venkata N. Padmanabhan and Lakshminarayanan Subramanian. 2001. An Investigation of Geographic Mapping Techniques for Internet Hosts. In ACM SIGCOMM. [23] Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, and Larry Peterson. 2004. Characteristics of Internet Background Radiation. In ACM Internet Measurement Conference (IMC). [24] Vern Paxson, Mark Allman, Jerry Chu, and Matt Sargent. 2011. RFC 6298: Computing TCP’s Retransmission Timer. [25] Ingmar Poese, Steve Uhlig, Mohamed Ali Kaafar, Benoit Donnet, and Bamba Gueye. 2011. IP Geolocation Databases: Unreliable? ACM SIGCOMM Computer Communication Review (CCR) (2011). [26] Niels Provos. 2004. A Virtual Honeypot Framework. In USENIX Security Symposium. [27] Philipp Richter and Arthur Berger. 2019. Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope. In ACM Internet Measurement Conference (IMC). [28] Philipp Richter, Oliver Gasser, and Arthur Berger. 2022. Illuminating Large-Scale IPv6 Scanning in the Internet. In ACM Internet Measurement Conference (IMC). [29] Erik C. Rye and Robert Beverly. 2023. IPvSeeYou: Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation. In IEEE Symposium on Security and Privacy.

5

NewGeo ’26, October 12, 2026, Karlsruhe, Germany

Spencer Ye, Chase Kanipe, Peter Ryan, and Erik Rye

Table 3: The 42 vantage points used in this study. Margin is the distance by which a claim must exceed the speed-of-light bound before we call it impossible (§3.2): the greater of a 50 km floor and that position’s own uncertainty, which is 25 km for locations reported in RFC 8805 geofeeds [19] or supplied directly by hosting providers, 100 km where we corrected a position by round-trip time, and 250 to 300 km for a facility inferred from published datacenter or PeeringDB records. City

Ctry. Margin

City

Ctry. Margin

City

Ctry. Margin

City

Ctry. Margin

Dubai Port Melbourne Sofia Osasco Montréal Santiago Limassol Baden-Baden Berlin Tallinn Logroño

AE AU BG BR CA CL CY DE DE EE ES

Aubervilliers Worcester Hong Kong Budapest Rosh HaAyin Mumbai Noida Tokyo Seoul Almaty Santiago de Querétaro

FR GB HK HU IL IN IN JP KR KZ MX

Oslo Warsaw Belgrade Moscow Spånga Singapore Singapore Singapore Istanbul Atlanta Dallas

NO PL RS RU SE SG SG SG TR US US

Dallas Elk Grove Village Honolulu Kent Lenexa Los Angeles Miami Piscataway Isando

US US US US US US US US ZA

50 50 50 50 300 50 50 50 250 50 250

50 250 50 50 50 50 50 50 50 50 50

50 50 50 50 50 100 100 50 50 50 50

50 50 50 50 250 50 50 50 50

Table 4: The 23 TCP destination ports our vantage points accepted unsolicited connections on, with each port’s share of the 46.8 million scans and of the 289 746 distinct scanners. Scanner percentages total more than 100 % because a single scanner frequently probed several ports.

Appendix Ethical Considerations Our reactive measurements do not initiate traffic. Instead, we respond only to unsolicited TCP SYNs we receive from Internet scanners. We reply to these scans with only a SYN-ACK packet to derive an RTT from a subsequent TCP ACK or RST. When we obtain a reactive RTT for an Internet scanner, we conduct follow-up measurements to compute an active RTT. These probes are sent only to an address that has just connected to us and consist of one ICMP Echo Request and one TCP SYN to each of ports 80 and 443. Therefore, for each scan that is directed at one of our vantage points, we send at most one SYN-ACK and three probes. To prevent excessive probing, we enforce a 24-hour cooldown between active probe rounds to the same address from the same vantage point, along with a sustained rate limit of two probes per second. Over the capture period we conducted 1.46 million probe rounds, about 1700 per vantage point per day, a small fraction of the traffic the probed hosts had initiated to our vantage points. We received no abuse reports or complaints during our study. We believe these limits are sufficient to prevent harm to scanners that contact our vantage points and are consistent with the principles of the Menlo Report [2].

Scans Port

Vantage Points and TCP Ports Used Table 3 lists the cloud-hosted vantage points we used for our Reactive CBG measurements. Table 4 lists the 23 TCP ports on which we responded to unsolicited incoming scans to obtain a reactive RTT measurement.

Generative AI The authors used Anthropic’s Claude Opus 5 for assistance with the development of the Reactive CBG RTT collection system and analysis tooling.

6

Service

Scanners

count

%

count

Web / proxy 443 HTTPS 80 HTTP 8443 HTTPS alt 8080 HTTP alt 8000 HTTP alt 8888 HTTP alt 3128 Squid proxy

%

2 154 815 2 069 905 406 968 340 945 249 055 241 308 78 809

4.61 4.42 0.87 0.73 0.53 0.52 0.17

Remote access 5900 VNC 23 Telnet 3389 RDP 5555 ADB / misc 2323 Telnet alt

22 068 644 47.17 8740 3.0 2 921 211 6.24 143 549 49.5 1 415 173 3.02 37 033 12.8 104 242 0.22 8384 2.9 60 107 0.13 6204 2.1

File transfer / sharing 445 SMB 21 FTP

11 485 412 24.55 537 324 1.15

75 819 26.2 73 878 25.5 16 231 5.6 30 198 10.4 10 431 3.6 11 275 3.9 6454 2.2

36 821 12.7 34 632 12.0

Databases 1433 MSSQL 27017 MongoDB 3306 MySQL 9200 Elasticsearch 5432 PostgreSQL 6379 Redis

633 460 545 841 442 231 302 301 291 396 142 377

1.35 1.17 0.95 0.65 0.62 0.30

36 798 12.7 10 923 3.8 34 008 11.7 10 437 3.6 9382 3.2 9830 3.4

Infrastructure / IoT 7547 TR-069 2375 Docker API 5060 SIP

106 342 100 831 91 314

0.23 0.22 0.20

14 613 5015 6583

5.0 1.7 2.3

Related documents

• Reactive Constraint-Based Geolocation of Internet Hosts#1201558
• Against Proxy Optimization#299966
• Implications of Various Address Allocation Policies for Internet Routing#133768
• Increasing Throughput in IP Networks with ESP-Based Forwarding: ESPBasedForwarding#501326
• BGP Prefix Segment in Large-Scale Data Centers#502319