Cloud computing has dramatically changed service deployment patterns. In this work, we analyze how attackers identify and target cloud services in contrast to traditional enterprise networks and network telescopes. Using a diverse set of cloud honeypots in 5~providers and 23~countries as well as 2~educational networks and 1~network telescope, we analyze how IP address assignment, geography, network, and service-port selection, influence what services are targeted in the cloud. We find that scanners that target cloud compute are selective: they avoid scanning networks without legitimate services and they discriminate between geographic regions. Further, attackers mine Internet-service search engines to find exploitable services and, in some cases, they avoid targeting IANA-assigned protocols, causing researchers to misclassify at least 15\% of traffic on select ports. Based on our results, we derive recommendations for researchers and operators.

翻译：云计算已深刻改变了服务部署模式。本研究通过对比传统企业网络与网络望远镜，分析攻击者如何识别并针对云服务实施攻击。我们在5个云服务提供商、23个国家部署多样化云蜜罐，同时结合2个教育网络和1个网络望远镜，研究IP地址分配、地理位置、网络属性及服务端口选择等因素如何影响云环境中被攻击的目标。研究发现，针对云计算的扫描器具有选择性：它们会避开无合法服务的网络，并对不同地理区域进行区分。此外，攻击者会利用互联网服务搜索引擎发现可攻击的服务，在某些情况下，他们会刻意避免针对IANA分配的协议，导致研究人员在特定端口上对至少15%的流量进行误分类。基于研究结果，我们为研究人员和运维人员提出了相关建议。