Update: MGLNDD_* Scans, (Sat, Feb 24th)

Category :

SANS Full Feed

Posted On :

Almost 2 years ago, a reader asked us about TCP connections they observed. The data of these TCP connections starts with “MGLNDD_”: “MGLNDD_* Scans“.

Reader Michal Soltysik reached out to us with an answer: MGLN is Magellan, RIPE Atlas Tools. RIPE Atlas employs a global network of probes that measure Internet connectivity and reachability.

Thanks to Michal for explaining this in a video.

Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.