Traffic Characteristics of an Active Network Telescope from a Destination IP Address Perspective

Network telescopes provide a powerful tool to observe and analyze malicious network activities. In this work, we investigate the traffic characteristics of an active network telescope from the destination IP address space perspective. We analyze a primary data set collected from an active network telescope monitoring two /24 IPv4 prefixes. The analysis reveals that malicious traffic targeting the destination IP space is not purely homogeneous; instead, certain IP addresses consistently emerge as soft targets, receiving disproportionately high connection volumes. Statistical analyses are performed to characterize multiple features, including correlation structure, randomness, and interspike gap estimation. The estimated mean interspike gap ranges between 22.48 and 38.22. Moreover, peaks at these soft-targeted IPs are driven by a large number of distinct source IPs rather than repeated connections from a single source IP. Port-level investigation reveals that the overall destination IP space is dominated by well-known service ports, whereas highly uncorrelated and soft-targeted IPs predominantly receive traffic on non-standard and dynamic or private ports. Payload-level analysis shows that overall, 30% of connections carry no payload, 12% are benign HTTP, 14% correspond to critical HTTP exploitation, and 42% are non-HTTP. While HTTP-based payloads show a homogeneous traffic distribution across the destination IP space, non-HTTP payloads are not uniform, and high connection volumes at specific IPs are driven mainly by non-HTTP payloads. Moreover, specific TCP/IP header-based attack types are also analyzed from the destination IP space perspective.