[plati]

I have a personal project where I would like to map out the internet for a certain service. This will require scanning one specific port on every IP address to first see if it responds, then out of the responsive IPs (there won't be too many) I will continue further. I used zmap and got about halfway done before the hosting provider for the server I was using sent me a bunch of abuse reports. This project has nothing to do with hacking, it's more of a data science thing, but I keep hitting honeypots and getting abuse reports.

My problem is that I cannot find a way to do this initial scanning without jeopardizing my good standing with my ISP or my, for example, Linode account. I don't want to infect people with botnets or use other peoples' botnets, I would prefer to do the scanning on my own. I initially thought to set up shop in a local coffee shop, but I'm sure they would file a police report. I can't use my university's wifi or VPN service for the same reason. For context, I am in the EU.

Is there any way I could continue with my project? I would only need to do this scan once.

[◔ßorder╙ineExtrⒶ]

Ethical hacking shouldn't be a problem with European authorities, just make sure you've got a valid excuse (run up a tech specs outline before the scanner. Helps for clarifying project scope + steps too, but also provide a reasonable way for authorities to understand what sorts of project you're planning to overtake).

If, on the other hand, this port-scanning falls under the slightly illegal side of things, you might want to take the neccessary cautions like IP shielder ~ which shouldn't be an issue to set-up with a little network admin and a private subnet list of IPs + double, triple check the packets are flowing through without any network interference, tracking or otherwise firewall limitations. Wireshark has always been my go-to for this sort of inspection, though I'm sure there are swifter newer solutions in the market.

Why 1 single port tho ? Increase the attack surface and see what the network throws back.

[LiNixx]

ZMap uses raw sockets and bypasses the tcp/ip stack to send raw ethernet frames, that's why it can scan the entire IPV4 space in such a short time, its also why using something like proxychains fucks up the data so it cant really be proxied and as you found out VPN VPS etc will just get your account banned as they will start receiving the abuse complaints

Honeypots are usually triggered by repeated scans or a shit ton of traffic from one ip. Though sometimes just a ping can trigger the report
You could try slowing the speed or using a different tool that's not so fast, but that can REALLY EXTEND the scanning time.

the alternate is to quit trying to be stealth and talk to your host and explain what you are doing, DigitalOcean I hear are open to allowing research projects like this, set up a page explaining your project and put that in your signatures of the scans or maybe just check scans.io as and see if you can find the data you're looking for that's already been collected.

[DramaKing]

There are bulletproof VPS providers that allow scanning. Just expect to get a dirty IP address that could be blacklisted by firewalls.