Network telescopes serve as a critical passive monitoring tool for capturing unsolicited Internet traffic, providing insights into global scanning and reconnaissance behavior. This study analyzes a 10-day dataset during January 2025 consisting of approximately 22 million packets collected by the ORION network telescope at Merit Network. By employing privacy-preserving metadata analysis and lightweight behavioral heuristics, we identify scanning and backscatter patterns without payload inspection. Our results reveal a highly structured and centralized ecosystem, where the top 1% of source IP addresses generate over 81% of total traffic. A significant finding is the dominance of Port 23 (Telnet) and Port 2323 (Telnet Alt), which highlights the persistent nature of IoT security threats and widespread attempts to exploit weak credentials in legacy IoT devices. Furthermore, synchronized surges in packet volume and Shannon entropy indicate coordinated, multi-vector reconnaissance campaigns. These findings offer a practical framework for identifying large-scale threat activity and support cybersecurity research and education.

翻译：网络望远镜作为一种关键的被动监控工具，用于捕获非自愿互联网流量，提供对全球扫描和侦察行为的深入洞察。本研究分析了2025年1月期间一个为期10天的数据集，该数据集由Merit网络的ORION网络望远镜收集，包含约2200万个数据包。通过采用隐私保护的元数据分析和轻量级行为启发式方法，我们在无需检查有效载荷的情况下识别了扫描和反向散射模式。我们的结果揭示了一个高度结构化且集中的生态系统，其中前1%的源IP地址产生了超过81%的总流量。一个重要发现是端口23（Telnet）和端口2323（备用Telnet）的主导地位，这凸显了物联网安全威胁的持续性，以及针对传统物联网设备弱凭证进行广泛利用的企图。此外，数据包流量和香农熵的同步激增表明存在协同的多向量侦察活动。这些发现为识别大规模威胁活动提供了一个实用框架，并支持网络安全研究和教育。