attribution

Z3R0DAY treats unauthorised internal scanner as hostile

An internal IP is scanning ports without authorisation. How to investigate, attribute the source, and identify the inbound session that established control.