Indeed

Right, it would be started basically exactly the opposite. Certainly not a statement followed by an if block.

Those would all start with the if, followed by two conditions, not a statement and then an if. There would be a condition to evaluate, followed by then/else?

Maybe it’s just worse when written. The period at the end of the sentence makes it hard to see how it could be misunderstood.

To your point though, not sure if I’m aware of any programming language that would continue a statement with a following if block. Far more likely that it would fail due to lack of an element to apply the 6 to rather than having a pointer to the previous object, or he would try getting what ever the literal version of a 6 would be, or maybe some slang version.

Funny thing is even that number would be based on all the people who can pay 20 but not 800. If it all has to be balanced by the users it would probably be an order of magnitude… Or the market would play like it logically should and it would be like 3 companies paying a million a month. But what would they do with it? Sell it at a loss for like 20 per user and hope they figure out some way to make money :)

A benign scan could just be looking for an ftp server to connect to or a repeater or relay server of some sort. There are plenty of open services people make available for free and the fact that you would consider it an attack it doesn’t make it one.

At minimum you could be alerted to look for someone attempting to connect to your ftp server with a single basic anonymous authentication vs someone flooding that port with known malicious software attacks, and block the latter across your entire network and effectively ignore the former. Really it seems like you’re advertising your lack of imagination in this context than a legitimate lack of possible uses for spoofing open ports.

At a guess, you might tell the difference between some benign scan and an attempt to actually take advantage of the port, perhaps to use as a trigger to automatically ban an ip address? or a way to divert malicious resources to an easy looking target so they are less available in other areas?

The difference between someone scanning for open ports and someone attacking a port they find open seems significant enough to at least track and watch for patterns… Whether that’s useful for the majority of users or not is rarely why a feature is implemented.