A scanner is a compromised host that attackers repurpose to probe other systems for open services, weak configurations, or known vulnerabilities. Instead of attacking directly from their own infrastructure, they use the victim machine to generate network traffic that looks like ordinary outbound activity from a legitimate server.
Scanners matter because they help attackers expand a campaign while hiding its origin. A hijacked server can sweep IP ranges, test ports, and identify exposed applications for the next stage of abuse. Defenders often spot scanning through bursts of failed connections, repeated requests to many hosts, or unusual outbound traffic patterns. Egress filtering, network monitoring, and alerts for port-scan behavior can help detect and stop a server from being used this way.