diff --git a/.bandit-baseline.json b/.bandit-baseline.json
index 2db80bb..9a1054a 100644
--- a/.bandit-baseline.json
+++ b/.bandit-baseline.json
@@ -1,37 +1,37 @@
 {
   "errors": [],
-  "generated_at": "2026-08-26T18:28:21Z",
+  "generated_at": "2026-08-28T18:56:28Z",
   "metrics": {
     "./spoonmap.py": {
-      "CONFIDENCE.HIGH": 33,
+      "CONFIDENCE.HIGH": 36,
       "CONFIDENCE.LOW": 0,
       "CONFIDENCE.MEDIUM": 0,
       "CONFIDENCE.UNDEFINED": 0,
       "SEVERITY.HIGH": 0,
-      "SEVERITY.LOW": 20,
-      "SEVERITY.MEDIUM": 13,
+      "SEVERITY.LOW": 21,
+      "SEVERITY.MEDIUM": 15,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 5056,
+      "loc": 5448,
       "nosec": 0,
       "skipped_tests": 0
     },
     "_totals": {
-      "CONFIDENCE.HIGH": 33,
+      "CONFIDENCE.HIGH": 36,
       "CONFIDENCE.LOW": 0,
       "CONFIDENCE.MEDIUM": 0,
       "CONFIDENCE.UNDEFINED": 0,
       "SEVERITY.HIGH": 0,
-      "SEVERITY.LOW": 20,
-      "SEVERITY.MEDIUM": 13,
+      "SEVERITY.LOW": 21,
+      "SEVERITY.MEDIUM": 15,
       "SEVERITY.UNDEFINED": 0,
-      "loc": 5056,
+      "loc": 5448,
       "nosec": 0,
       "skipped_tests": 0
     }
   },
   "results": [
     {
-      "code": "18 import socket\n19 import subprocess\n20 import sys\n",
+      "code": "19 import socket\n20 import subprocess\n21 import sys\n",
       "col_offset": 0,
       "end_col_offset": 17,
       "filename": "./spoonmap.py",
@@ -42,16 +42,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Consider possible security implications associated with the subprocess module.",
-      "line_number": 19,
+      "line_number": 20,
       "line_range": [
-        19
+        20
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_imports.html#b404-import-subprocess",
       "test_id": "B404",
       "test_name": "blacklist"
     },
     {
-      "code": "28 import urllib.request\n29 import xml.etree.ElementTree as etree\n30 from importlib import metadata\n",
+      "code": "30 import urllib.request\n31 import xml.etree.ElementTree as etree\n32 from importlib import metadata\n",
       "col_offset": 0,
       "end_col_offset": 37,
       "filename": "./spoonmap.py",
@@ -62,16 +62,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.",
-      "line_number": 29,
+      "line_number": 31,
       "line_range": [
-        29
+        31
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_imports.html#b405-import-xml-etree",
       "test_id": "B405",
       "test_name": "blacklist"
     },
     {
-      "code": "84     try:\n85         subprocess.run(['stty', 'sane'], check=False, stderr=subprocess.DEVNULL)\n86     except (OSError, subprocess.SubprocessError):\n",
+      "code": "86     try:\n87         subprocess.run(['stty', 'sane'], check=False, stderr=subprocess.DEVNULL)\n88     except (OSError, subprocess.SubprocessError):\n",
       "col_offset": 8,
       "end_col_offset": 80,
       "filename": "./spoonmap.py",
@@ -82,16 +82,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Starting a process with a partial executable path",
-      "line_number": 85,
+      "line_number": 87,
       "line_range": [
-        85
+        87
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b607_start_process_with_partial_path.html",
       "test_id": "B607",
       "test_name": "start_process_with_partial_path"
     },
     {
-      "code": "84     try:\n85         subprocess.run(['stty', 'sane'], check=False, stderr=subprocess.DEVNULL)\n86     except (OSError, subprocess.SubprocessError):\n",
+      "code": "86     try:\n87         subprocess.run(['stty', 'sane'], check=False, stderr=subprocess.DEVNULL)\n88     except (OSError, subprocess.SubprocessError):\n",
       "col_offset": 8,
       "end_col_offset": 80,
       "filename": "./spoonmap.py",
@@ -102,16 +102,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 85,
+      "line_number": 87,
       "line_range": [
-        85
+        87
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "921     try:\n922         root = etree.parse(xml_file)\n923         for host in root.findall('host'):\n",
+      "code": "981     try:\n982         root = etree.parse(xml_file)\n983         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 36,
       "filename": "./spoonmap.py",
@@ -122,16 +122,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 922,
+      "line_number": 982,
       "line_range": [
-        922
+        982
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "943     try:\n944         root = etree.parse(xml_file)\n945         for host in root.findall('host'):\n",
+      "code": "1003     try:\n1004         root = etree.parse(xml_file)\n1005         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 36,
       "filename": "./spoonmap.py",
@@ -142,16 +142,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 944,
+      "line_number": 1004,
       "line_range": [
-        944
+        1004
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "1025     try:\n1026         proc = subprocess.Popen(masscan_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,\n1027                                 preexec_fn=_raise_fd_limit)\n1028         progress_thread = threading.Thread(target=_stream_masscan_progress, args=(proc,), daemon=True)\n",
+      "code": "1085     try:\n1086         proc = subprocess.Popen(masscan_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,\n1087                                 preexec_fn=_raise_fd_limit)\n1088         progress_thread = threading.Thread(target=_stream_masscan_progress, args=(proc,), daemon=True)\n",
       "col_offset": 15,
       "end_col_offset": 59,
       "filename": "./spoonmap.py",
@@ -162,17 +162,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1026,
+      "line_number": 1086,
       "line_range": [
-        1026,
-        1027
+        1086,
+        1087
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1083     try:\n1084         proc = subprocess.Popen(masscan_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,\n1085                                 preexec_fn=_raise_fd_limit)\n1086         progress_thread = threading.Thread(target=_stream_masscan_progress, args=(proc,), daemon=True)\n",
+      "code": "1143     try:\n1144         proc = subprocess.Popen(masscan_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,\n1145                                 preexec_fn=_raise_fd_limit)\n1146         progress_thread = threading.Thread(target=_stream_masscan_progress, args=(proc,), daemon=True)\n",
       "col_offset": 15,
       "end_col_offset": 59,
       "filename": "./spoonmap.py",
@@ -183,17 +183,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1084,
+      "line_number": 1144,
       "line_range": [
-        1084,
-        1085
+        1144,
+        1145
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1263     try:\n1264         proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n1265         proc.wait()\n",
+      "code": "1323     try:\n1324         proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n1325         proc.wait()\n",
       "col_offset": 15,
       "end_col_offset": 90,
       "filename": "./spoonmap.py",
@@ -204,16 +204,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1264,
+      "line_number": 1324,
       "line_range": [
-        1264
+        1324
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1282     try:\n1283         root = etree.parse(output_xml)\n1284         for host in root.findall('host'):\n",
+      "code": "1342     try:\n1343         root = etree.parse(output_xml)\n1344         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 38,
       "filename": "./spoonmap.py",
@@ -224,16 +224,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 1283,
+      "line_number": 1343,
       "line_range": [
-        1283
+        1343
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "1338     try:\n1339         masscan_process = subprocess.Popen(\n1340             masscan_cmd,\n1341             stdout=subprocess.DEVNULL,\n1342             stderr=subprocess.PIPE,\n1343             preexec_fn=_raise_fd_limit,\n1344         )\n1345         progress_thread = threading.Thread(target=run_progress_and_capture, args=(masscan_process,), daemon=True)\n",
+      "code": "1398     try:\n1399         masscan_process = subprocess.Popen(\n1400             masscan_cmd,\n1401             stdout=subprocess.DEVNULL,\n1402             stderr=subprocess.PIPE,\n1403             preexec_fn=_raise_fd_limit,\n1404         )\n1405         progress_thread = threading.Thread(target=run_progress_and_capture, args=(masscan_process,), daemon=True)\n",
       "col_offset": 26,
       "end_col_offset": 9,
       "filename": "./spoonmap.py",
@@ -244,21 +244,21 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1339,
+      "line_number": 1399,
       "line_range": [
-        1339,
-        1340,
-        1341,
-        1342,
-        1343,
-        1344
+        1399,
+        1400,
+        1401,
+        1402,
+        1403,
+        1404
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1398     try:\n1399         root = etree.parse(output_file)\n1400         for host in root.findall('host'):\n",
+      "code": "1458     try:\n1459         root = etree.parse(output_file)\n1460         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 39,
       "filename": "./spoonmap.py",
@@ -269,16 +269,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 1399,
+      "line_number": 1459,
       "line_range": [
-        1399
+        1459
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "1564     try:\n1565         proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n1566         proc.wait()\n",
+      "code": "1624     try:\n1625         proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)\n1626         proc.wait()\n",
       "col_offset": 15,
       "end_col_offset": 90,
       "filename": "./spoonmap.py",
@@ -289,16 +289,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1565,
+      "line_number": 1625,
       "line_range": [
-        1565
+        1625
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1594     try:\n1595         root = etree.parse(output_file)\n1596         for host in root.findall('host'):\n",
+      "code": "1654     try:\n1655         root = etree.parse(output_file)\n1656         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 39,
       "filename": "./spoonmap.py",
@@ -309,16 +309,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 1595,
+      "line_number": 1655,
       "line_range": [
-        1595
+        1655
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "1753     try:\n1754         proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,\n1755                                 stderr=subprocess.PIPE, text=True)\n1756         _t = threading.Thread(target=_progress_reader, args=(proc.stdout,), daemon=True)\n",
+      "code": "1813     try:\n1814         proc = subprocess.Popen(cmd, stdout=subprocess.PIPE,\n1815                                 stderr=subprocess.PIPE, text=True)\n1816         _t = threading.Thread(target=_progress_reader, args=(proc.stdout,), daemon=True)\n",
       "col_offset": 15,
       "end_col_offset": 66,
       "filename": "./spoonmap.py",
@@ -329,17 +329,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 1754,
+      "line_number": 1814,
       "line_range": [
-        1754,
-        1755
+        1814,
+        1815
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "1793     try:\n1794         root = etree.parse(output_file)\n1795         for host in root.findall('host'):\n",
+      "code": "1853     try:\n1854         root = etree.parse(output_file)\n1855         for host in root.findall('host'):\n",
       "col_offset": 15,
       "end_col_offset": 39,
       "filename": "./spoonmap.py",
@@ -350,16 +350,56 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 1794,
+      "line_number": 1854,
+      "line_range": [
+        1854
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
+      "test_id": "B314",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "1939         try:\n1940             root = etree.parse(os.path.join(masscan_dir, fname))\n1941         except etree.ParseError:\n",
+      "col_offset": 19,
+      "end_col_offset": 64,
+      "filename": "./spoonmap.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 20,
+        "link": "https://cwe.mitre.org/data/definitions/20.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
+      "line_number": 1940,
       "line_range": [
-        1794
+        1940
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "2547                 # non-None and work_queue.join() in nmap_scan() hangs forever.\n2548                 nmap_process = subprocess.Popen(\n2549                     nmap_cmd,\n2550                     stdout=subprocess.DEVNULL,\n2551                     stderr=subprocess.PIPE,\n2552                     text=True,\n2553                     start_new_session=True,\n2554                 )\n2555                 nmap_err_thread, nmap_err_lines = _start_stderr_reader(nmap_process.stderr)\n",
+      "code": "2076     scanned = _expand_scanned_ports(p for p in scanned_ports if not p.startswith('U:'))\n2077     rng = random.Random(ip)\n2078     candidates = [p for p in range(49152, 65536) if p not in scanned]\n",
+      "col_offset": 10,
+      "end_col_offset": 27,
+      "filename": "./spoonmap.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 330,
+        "link": "https://cwe.mitre.org/data/definitions/330.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Standard pseudo-random generators are not suitable for security/cryptographic purposes.",
+      "line_number": 2077,
+      "line_range": [
+        2077
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random",
+      "test_id": "B311",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "2840                 # non-None and work_queue.join() in nmap_scan() hangs forever.\n2841                 nmap_process = subprocess.Popen(\n2842                     nmap_cmd,\n2843                     stdout=subprocess.DEVNULL,\n2844                     stderr=subprocess.PIPE,\n2845                     text=True,\n2846                     start_new_session=True,\n2847                 )\n2848                 nmap_err_thread, nmap_err_lines = _start_stderr_reader(nmap_process.stderr)\n",
       "col_offset": 31,
       "end_col_offset": 17,
       "filename": "./spoonmap.py",
@@ -370,22 +410,22 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 2548,
+      "line_number": 2841,
       "line_range": [
-        2548,
-        2549,
-        2550,
-        2551,
-        2552,
-        2553,
-        2554
+        2841,
+        2842,
+        2843,
+        2844,
+        2845,
+        2846,
+        2847
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "2615                         _discard_coverage_record(nse_output)\n2616                         nse_process = subprocess.Popen(\n2617                             nse_cmd,\n2618                             stdout=subprocess.DEVNULL,\n2619                             stderr=subprocess.PIPE,\n2620                             text=True,\n2621                             start_new_session=True,\n2622                         )\n2623                         # Same concurrent drain as the banner pass: an NSE run\n",
+      "code": "2908                         _discard_coverage_record(nse_output)\n2909                         nse_process = subprocess.Popen(\n2910                             nse_cmd,\n2911                             stdout=subprocess.DEVNULL,\n2912                             stderr=subprocess.PIPE,\n2913                             text=True,\n2914                             start_new_session=True,\n2915                         )\n2916                         # Same concurrent drain as the banner pass: an NSE run\n",
       "col_offset": 38,
       "end_col_offset": 25,
       "filename": "./spoonmap.py",
@@ -396,22 +436,22 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 2616,
+      "line_number": 2909,
       "line_range": [
-        2616,
-        2617,
-        2618,
-        2619,
-        2620,
-        2621,
-        2622
+        2909,
+        2910,
+        2911,
+        2912,
+        2913,
+        2914,
+        2915
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "3147         try:\n3148             root = etree.parse(fpath)\n3149             for host in root.findall('host'):\n",
+      "code": "3454         try:\n3455             root = etree.parse(fpath)\n3456             for host in root.findall('host'):\n",
       "col_offset": 19,
       "end_col_offset": 37,
       "filename": "./spoonmap.py",
@@ -422,16 +462,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 3148,
+      "line_number": 3455,
       "line_range": [
-        3148
+        3455
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "3185                 try:\n3186                     proc = subprocess.Popen([\n3187                         'nmap', '-T4', '-sS', '-sV', '--version-intensity', '0',\n3188                         '-Pn', '-p', port,\n3189                         *(['--source-port', source_port] if source_port else []),\n3190                         ip, '-oX', out_file\n3191                     ])\n3192                     proc.wait()\n",
+      "code": "3492                 try:\n3493                     proc = subprocess.Popen([\n3494                         'nmap', '-T4', '-sS', '-sV', '--version-intensity', '0',\n3495                         '-Pn', '-p', port,\n3496                         *(['--source-port', source_port] if source_port else []),\n3497                         ip, '-oX', out_file\n3498                     ])\n3499                     proc.wait()\n",
       "col_offset": 27,
       "end_col_offset": 22,
       "filename": "./spoonmap.py",
@@ -442,21 +482,21 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Starting a process with a partial executable path",
-      "line_number": 3186,
+      "line_number": 3493,
       "line_range": [
-        3186,
-        3187,
-        3188,
-        3189,
-        3190,
-        3191
+        3493,
+        3494,
+        3495,
+        3496,
+        3497,
+        3498
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b607_start_process_with_partial_path.html",
       "test_id": "B607",
       "test_name": "start_process_with_partial_path"
     },
     {
-      "code": "3185                 try:\n3186                     proc = subprocess.Popen([\n3187                         'nmap', '-T4', '-sS', '-sV', '--version-intensity', '0',\n3188                         '-Pn', '-p', port,\n3189                         *(['--source-port', source_port] if source_port else []),\n3190                         ip, '-oX', out_file\n3191                     ])\n3192                     proc.wait()\n",
+      "code": "3492                 try:\n3493                     proc = subprocess.Popen([\n3494                         'nmap', '-T4', '-sS', '-sV', '--version-intensity', '0',\n3495                         '-Pn', '-p', port,\n3496                         *(['--source-port', source_port] if source_port else []),\n3497                         ip, '-oX', out_file\n3498                     ])\n3499                     proc.wait()\n",
       "col_offset": 27,
       "end_col_offset": 22,
       "filename": "./spoonmap.py",
@@ -467,21 +507,21 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 3186,
+      "line_number": 3493,
       "line_range": [
-        3186,
-        3187,
-        3188,
-        3189,
-        3190,
-        3191
+        3493,
+        3494,
+        3495,
+        3496,
+        3497,
+        3498
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "3208             try:\n3209                 proc = subprocess.Popen([\n3210                     'nmap', '-T4', '-sS', '-Pn', '-p', port,\n3211                     '--script', f'{_NSE_DIR}/azure-sql-detect.nse',\n3212                     '--script-timeout', '30s',\n3213                     *(['--source-port', source_port] if source_port else []),\n3214                     ip, '-oX', nse_out_file\n3215                 ])\n3216                 proc.wait()\n",
+      "code": "3515             try:\n3516                 proc = subprocess.Popen([\n3517                     'nmap', '-T4', '-sS', '-Pn', '-p', port,\n3518                     '--script', f'{_NSE_DIR}/azure-sql-detect.nse',\n3519                     '--script-timeout', '30s',\n3520                     *(['--source-port', source_port] if source_port else []),\n3521                     ip, '-oX', nse_out_file\n3522                 ])\n3523                 proc.wait()\n",
       "col_offset": 23,
       "end_col_offset": 18,
       "filename": "./spoonmap.py",
@@ -492,22 +532,22 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Starting a process with a partial executable path",
-      "line_number": 3209,
+      "line_number": 3516,
       "line_range": [
-        3209,
-        3210,
-        3211,
-        3212,
-        3213,
-        3214,
-        3215
+        3516,
+        3517,
+        3518,
+        3519,
+        3520,
+        3521,
+        3522
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b607_start_process_with_partial_path.html",
       "test_id": "B607",
       "test_name": "start_process_with_partial_path"
     },
     {
-      "code": "3208             try:\n3209                 proc = subprocess.Popen([\n3210                     'nmap', '-T4', '-sS', '-Pn', '-p', port,\n3211                     '--script', f'{_NSE_DIR}/azure-sql-detect.nse',\n3212                     '--script-timeout', '30s',\n3213                     *(['--source-port', source_port] if source_port else []),\n3214                     ip, '-oX', nse_out_file\n3215                 ])\n3216                 proc.wait()\n",
+      "code": "3515             try:\n3516                 proc = subprocess.Popen([\n3517                     'nmap', '-T4', '-sS', '-Pn', '-p', port,\n3518                     '--script', f'{_NSE_DIR}/azure-sql-detect.nse',\n3519                     '--script-timeout', '30s',\n3520                     *(['--source-port', source_port] if source_port else []),\n3521                     ip, '-oX', nse_out_file\n3522                 ])\n3523                 proc.wait()\n",
       "col_offset": 23,
       "end_col_offset": 18,
       "filename": "./spoonmap.py",
@@ -518,22 +558,22 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 3209,
+      "line_number": 3516,
       "line_range": [
-        3209,
-        3210,
-        3211,
-        3212,
-        3213,
-        3214,
-        3215
+        3516,
+        3517,
+        3518,
+        3519,
+        3520,
+        3521,
+        3522
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "3230         try:\n3231             tree = etree.parse(xml_file)\n3232         except Exception:\n",
+      "code": "3537         try:\n3538             tree = etree.parse(xml_file)\n3539         except Exception:\n",
       "col_offset": 19,
       "end_col_offset": 40,
       "filename": "./spoonmap.py",
@@ -544,16 +584,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 3231,
+      "line_number": 3538,
       "line_range": [
-        3231
+        3538
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "3231             tree = etree.parse(xml_file)\n3232         except Exception:\n3233             continue\n3234         for host_elem in tree.findall('.//host'):\n",
+      "code": "3538             tree = etree.parse(xml_file)\n3539         except Exception:\n3540             continue\n3541         for host_elem in tree.findall('.//host'):\n",
       "col_offset": 8,
       "end_col_offset": 20,
       "filename": "./spoonmap.py",
@@ -564,17 +604,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Try, Except, Continue detected.",
-      "line_number": 3232,
+      "line_number": 3539,
       "line_range": [
-        3232,
-        3233
+        3539,
+        3540
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b112_try_except_continue.html",
       "test_id": "B112",
       "test_name": "try_except_continue"
     },
     {
-      "code": "3266                     ]\n3267                     result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)\n3268                     if 'Valid credentials' in result.stdout:\n",
+      "code": "3573                     ]\n3574                     result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)\n3575                     if 'Valid credentials' in result.stdout:\n",
       "col_offset": 29,
       "end_col_offset": 92,
       "filename": "./spoonmap.py",
@@ -585,16 +625,16 @@
       },
       "issue_severity": "LOW",
       "issue_text": "subprocess call - check for execution of untrusted input.",
-      "line_number": 3267,
+      "line_number": 3574,
       "line_range": [
-        3267
+        3574
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html",
       "test_id": "B603",
       "test_name": "subprocess_without_shell_equals_true"
     },
     {
-      "code": "3438         try:\n3439             root = etree.parse(f'{nmap_dir}/{fname}')\n3440         except etree.ParseError:\n",
+      "code": "3743         try:\n3744             root = etree.parse(f'{nmap_dir}/{fname}')\n3745         except etree.ParseError:\n",
       "col_offset": 19,
       "end_col_offset": 53,
       "filename": "./spoonmap.py",
@@ -605,16 +645,36 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 3439,
+      "line_number": 3744,
+      "line_range": [
+        3744
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
+      "test_id": "B314",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "3855         try:\n3856             root = etree.parse(f'{nse_dir}/{fname}')\n3857         except etree.ParseError:\n",
+      "col_offset": 19,
+      "end_col_offset": 52,
+      "filename": "./spoonmap.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 20,
+        "link": "https://cwe.mitre.org/data/definitions/20.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
+      "line_number": 3856,
       "line_range": [
-        3439
+        3856
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "3588         try:\n3589             root = etree.parse(fpath)\n3590         except Exception:\n",
+      "code": "4002         try:\n4003             root = etree.parse(fpath)\n4004         except Exception:\n",
       "col_offset": 19,
       "end_col_offset": 37,
       "filename": "./spoonmap.py",
@@ -625,16 +685,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 3589,
+      "line_number": 4003,
       "line_range": [
-        3589
+        4003
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "3589             root = etree.parse(fpath)\n3590         except Exception:\n3591             continue\n3592 \n",
+      "code": "4003             root = etree.parse(fpath)\n4004         except Exception:\n4005             continue\n4006 \n",
       "col_offset": 8,
       "end_col_offset": 20,
       "filename": "./spoonmap.py",
@@ -645,17 +705,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Try, Except, Continue detected.",
-      "line_number": 3590,
+      "line_number": 4004,
       "line_range": [
-        3590,
-        3591
+        4004,
+        4005
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b112_try_except_continue.html",
       "test_id": "B112",
       "test_name": "try_except_continue"
     },
     {
-      "code": "4933     try:\n4934         return etree.parse(path)\n4935     except etree.ParseError as e:\n",
+      "code": "5347     try:\n5348         return etree.parse(path)\n5349     except etree.ParseError as e:\n",
       "col_offset": 15,
       "end_col_offset": 32,
       "filename": "./spoonmap.py",
@@ -666,16 +726,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 4934,
+      "line_number": 5348,
       "line_range": [
-        4934
+        5348
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "5238             readline.set_completer(None)  # type: ignore[name-defined]\n5239         except Exception:\n5240             pass\n5241 \n",
+      "code": "5656             readline.set_completer(None)  # type: ignore[name-defined]\n5657         except Exception:\n5658             pass\n5659 \n",
       "col_offset": 8,
       "end_col_offset": 16,
       "filename": "./spoonmap.py",
@@ -686,17 +746,17 @@
       },
       "issue_severity": "LOW",
       "issue_text": "Try, Except, Pass detected.",
-      "line_number": 5239,
+      "line_number": 5657,
       "line_range": [
-        5239,
-        5240
+        5657,
+        5658
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/plugins/b110_try_except_pass.html",
       "test_id": "B110",
       "test_name": "try_except_pass"
     },
     {
-      "code": "5276         try:\n5277             tree = etree.parse(nmap_xml)\n5278             root_elem = tree.getroot()\n",
+      "code": "5694         try:\n5695             tree = etree.parse(nmap_xml)\n5696             root_elem = tree.getroot()\n",
       "col_offset": 19,
       "end_col_offset": 40,
       "filename": "./spoonmap.py",
@@ -707,16 +767,16 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called",
-      "line_number": 5277,
+      "line_number": 5695,
       "line_range": [
-        5277
+        5695
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree",
       "test_id": "B314",
       "test_name": "blacklist"
     },
     {
-      "code": "5898     try:\n5899         with urllib.request.urlopen(_RELEASE_API_URL, timeout=timeout) as resp:\n5900             payload = json.loads(resp.read().decode('utf-8', 'replace'))\n",
+      "code": "6353     try:\n6354         with urllib.request.urlopen(_RELEASE_API_URL, timeout=timeout) as resp:\n6355             payload = json.loads(resp.read().decode('utf-8', 'replace'))\n",
       "col_offset": 13,
       "end_col_offset": 70,
       "filename": "./spoonmap.py",
@@ -727,9 +787,9 @@
       },
       "issue_severity": "MEDIUM",
       "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
-      "line_number": 5899,
+      "line_number": 6354,
       "line_range": [
-        5899
+        6354
       ],
       "more_info": "https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b310-urllib-urlopen",
       "test_id": "B310",
diff --git a/CLAUDE.md b/CLAUDE.md
index 17c64da..ebc4727 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -79,9 +79,11 @@ is exact-pinned in the `dev` group too (same reasoning as ruff — a bare `uvx
 --from` pin on bandit itself let its transitive dependencies float). `ruff
 format` is deliberately **not** adopted — reformatting the module and the
 11k-line test file would bury every future diff, and `E501` alone flags 288
-existing lines. The bandit baseline holds 32 reviewed findings (list-form
+existing lines. The bandit baseline holds 36 reviewed findings (list-form
 `subprocess` calls, `xml.etree` parsing of masscan/nmap output we invoked
-ourselves), so only a *new* finding fails; regenerate it deliberately and
+ourselves, and one deterministic-but-non-cryptographic `random.Random` seed
+for honeypot probe-port selection), so only a *new* finding fails; regenerate
+it deliberately and
 justify additions in the commit message rather than adding inline `# nosec`
 suppressions. `workflow-lint` runs `actionlint` (YAML/expression errors) and
 `zizmor` (Actions-specific security auditing — unpinned actions, script
@@ -440,4 +442,101 @@ Internal discovery runs a single masscan sweep (no source-port override) followe
 - **IPv4-only, enforced at the edges**: the tool scans IPv4 exclusively (masscan/nmap invocations, target expansion, and address sorting all assume it). IPv6 is rejected rather than half-supported, in two places. (1) `_build_discovery_target_file()`'s `_parse_ranges()` skips any entry `ipaddress.ip_network()` resolves to a non-v4 network and prints the offending file, line number, and content — previously the v6 bounds were stored silently and only surfaced hundreds of lines later as `AddressValueError: ... (>= 2**32)` from `summarize_address_range()`, and only when an exclusions file happened to be configured. (2) The masscan/discovery XML parsers (`_parse_masscan_ping_xml()`, `_parse_nmap_sn_xml()`, `_run_masscan_batch()`) select `address[@addrtype='ipv4']` instead of the first `<address>` child, matching what the nmap-side parsers already did, so a dual-stacked host's IPv6 or MAC string can't enter `live_ips`/`port_ips` and become a masscan `-iL` target. Address sorting goes through `_ip_sort_key()`, which orders valid IPv4 numerically and sorts anything unparseable last instead of raising — the three former inline `tuple(int(o) for o in x.split('.'))` keys ran *after* a completed sweep, so one odd entry discarded the whole thing.
 - **XML result parsing is per-element defensive**: every `etree.parse()` site guards the *walk* as well as the parse. Attributes are read with `.attrib.get(...)` and the element is skipped when the identifier is missing — never a bare `attrib['addr']` or `findall('address')[0]`, both of which raise `KeyError`/`IndexError` that `except etree.ParseError` does not catch. Those exceptions escaped the guard and discarded the results for *every other host* in the file (or, in `_host_elem_to_dict()`, lost `spoonmap_output.xml`/`.json` for the whole run) over one truncated element. `<script>` elements with no `id=` are filtered out of the comprehensions for the same reason. Where a fallback to the first `<address>` child is wanted after `address[@addrtype='ipv4']` misses (`generate_findings()`, `_scan_extra_sql_ports()`), it is a `None`-checked `find('address')`.
 - **Firewall state table safety**: internal discovery caps masscan at `INTERNAL_DISCOVERY_MAX_RATE = 1000 pps`; at that rate with a 60 s half-open timeout, concurrent state entries peak at ~60 K regardless of target range size; for ranges above `INTERNAL_DISCOVERY_STATE_CEILING = 262_144` hosts the port list is trimmed from 10 to 5 to keep total packet volume bounded. Separately and for the same reason, `mass_scan()` clamps a **Full** scan to `full_scan_rate` — 10000 pps External, 1000 pps Internal — since a single 1-65535 invocation fans out every port across every target at once. This cap applies *only* to `scan_type == 'Full'`; category and custom batched scans scan a handful of ports per invocation and always use the operator's full `max_rate`. The clamp prints a notice when it actually lowers the rate, because `main()`'s run summary echoes the *requested* `max_rate`: clamping silently made the summary contradict what masscan was told to do, and read as the operator's `--max-rate` having been ignored outright.
-- **Honeypot/tarpit detection**: `mass_scan()` flags hosts open on ≥`HONEYPOT_OPEN_PORT_FRACTION` (90%) of scanned TCP ports (min sample `HONEYPOT_MIN_PORTS_SCANNED = 10`) as likely tarpits (LaBrea, portspoof) via `_flag_suspected_tarpits()`/`_report_suspected_tarpits()`, writing `discovery/suspected_tarpits.txt`. Separately, `_count_unmatched_service_ports()` reads `nmap_results/*.xml` and counts open ports whose `-sV` probe captured a `servicefp` (no signature match); `≥HONEYPOT_MIN_UNMATCHED_PORTS = 3` such ports on one host is consistent with decoys (e.g. Artillery) that return random data on full connect. Both signals surface as a single "Likely Honeypot / Decoy Host" MEDIUM finding in `generate_findings()`. `_flag_suspected_tarpits()` counts TCP ports only, skipping any `port_key` that starts with `U:`, so every loop that reconstructs a port key from a `live_hosts/portNN.txt` filename must run the stem through `_fname_port()` (`'U_53'` → `'U:53'`) — the raw stem was counted as TCP, skewing the open-port fraction, and printed as `Hosts Found on Port U_53`.
+- **Honeypot/tarpit detection**: `mass_scan()` flags hosts open on ≥`HONEYPOT_OPEN_PORT_FRACTION` (90%) of scanned TCP ports (min sample `HONEYPOT_MIN_PORTS_SCANNED = 10`) as likely tarpits (LaBrea, portspoof) via `_flag_suspected_tarpits()`/`_report_suspected_tarpits()`, writing `discovery/suspected_tarpits.txt`. Separately, `_count_unmatched_service_ports()` reads `nmap_results/*.xml` and counts open ports whose `-sV` probe captured a `servicefp` (no signature match); `≥HONEYPOT_MIN_UNMATCHED_PORTS = 3` such ports on one host is consistent with decoys (e.g. Artillery) that return random data on full connect. Both signals surface as a single "Likely Honeypot / Decoy Host" finding in `generate_findings()`, severity-tiered as described below. `_flag_suspected_tarpits()` counts TCP ports only, skipping any `port_key` that starts with `U:`, so every loop that reconstructs a port key from a `live_hosts/portNN.txt` filename must run the stem through `_fname_port()` (`'U_53'` → `'U:53'`) — the raw stem was counted as TCP, skewing the open-port fraction, and printed as `Hosts Found on Port U_53`.
+ Four more signals feed the same finding, each combined and tiered by
+`_honeypot_severity()` rather than emitted as separate findings: TTL
+inconsistency across a host's open ports (`_ttl_spread_by_host()`, read back
+from `masscan_results/*.xml` at Stage 1, since one TCP/IP stack always
+reports one TTL — several differing values means several emulated listeners
+behind one address, though NAT/load-balancing can produce the same pattern,
+which is why this signal alone is capped at LOW and can never alone reach
+HIGH); known port-profile matching against `HONEYPOT_PORT_PROFILES`
+(Thinkst Canary, Artillery — placeholders pending verification against
+current upstream defaults — the finding's own reason text carries that
+caveat verbatim, since it lands in an engagement deliverable); generic
+named-product signature matching against `HONEYPOT_SIGNATURES` via the -sV
+service data already captured, **which ships EMPTY in this release** — the
+two development-era entries (Cowrie/Kippo, Dionaea) were both verified
+incorrect against nmap's real output in final review and removed rather than
+patched, so there are no active generic signatures and the mechanism
+(`_honeypot_signature_match()`, `_named_honeypot_matches()`) is retained
+purely as an extensibility point for future entries verified against real
+`-sV` output rather than a synthetic fixture (the reasons are recorded at
+the tuple itself; the short version is that the Cowrie needle's hyphen can
+never match nmap's space-rendered template, and "fixing" it would
+false-positive HIGH on every ordinary Debian OpenSSH host, while the Dionaea
+needle only ever appears in `servicefp`, a field the matcher never reads); a
+source-verified Heralding VNC honeypot tell (`_vnc_heralding_match()`,
+Task 3 Step 7 — vnc-info reporting RFB protocol 3.7 with no security-type
+list, since Heralding's VNC capability hardcodes that exact version and
+drops the connection on any client mismatch, unlike a real RFB server)
+read from `nse_results/*.xml` rather than `nmap_results/*.xml`; and
+silent-open-port counting (`_count_silent_open_ports()`), which complements
+the existing unmatched-fingerprint count by catching a tarpit that holds a
+connection open and sends nothing back — `servicefp` is only set when *some*
+data came back and failed to match, so a LaBrea-style silent host previously
+scored zero on that check alone. `_iter_open_tcp_ports()` is the shared,
+per-element-defensive XML walk both nmap-side counters and the signature
+matcher use, factored out of what was originally
+`_count_unmatched_service_ports()`'s own walk. With `HONEYPOT_SIGNATURES`
+empty, the Heralding VNC tell is the only named-product match this release
+can produce. Severity is HIGH for a named
+signature match or an active-probe confirmation, MEDIUM for two or more
+heuristic signals together, LOW for exactly one — a behavior change from the
+single flat MEDIUM this finding used to emit unconditionally. An optional
+active confirmation probe (`_active_confirm_probe()`) attempts a raw TCP
+connect against a handful of high, never-scanned ports
+(`_select_confirm_probe_ports()`, deterministic per-IP via a seeded
+`random.Random(ip)` rather than global randomness, so it is reproducible and
+testable) on any host flagged by the TTL-spread or port-profile signals —
+**not** on a host flagged only by the older tarpit-ratio heuristic, which
+feeds the finding but never the probe; a real host has no reason to answer on
+an ephemeral port outside the scan, so an answer is treated as confirmation.
+This is the one signal that sends new traffic, so it is gated behind
+`honeypot_active_confirm` in config.json — default false, absent means
+false, no interactive prompt of its own — mirroring `check_for_updates`'s
+existing precedent exactly and for the same reason: SpooNMAP runs from
+client-network jumpboxes, and an unrequested probe against a possible
+client-deployed decoy must never fire without the operator explicitly
+turning it on. (An earlier design considered a live per-host prompt after
+the Stage 1 warning instead; every `input()` call in this codebase happens
+in `main()` before any scan starts, and `mass_scan()` never prompts
+mid-run, so the config-only gate was used instead to stay consistent with
+that pattern.) `discovery/suspected_honeypots.txt` (Stage 1: TTL spread and
+port-profile hits, one line per `(ip, signal)` pair) and
+`discovery/confirmed_honeypots.txt` (Stage 2: active-probe confirmations)
+are new sibling files to the existing `discovery/suspected_tarpits.txt`,
+read back the same defensively-parsed way in `generate_findings()`. Unlike
+`suspected_tarpits.txt`, both of those are written **unconditionally** — an
+empty result truncates the file rather than leaving the previous run's
+content in place. That divergence is deliberate: severity is now computed by
+*counting* signals, so a stale line from an earlier, broader run silently
+inflates a later, narrower run's severity, and a stale
+`confirmed_honeypots.txt` line additionally makes the deliverable assert
+"host answered on a port never scanned open" for a probe that did not run
+this time at all (exactly what happens when the operator turns
+`honeypot_active_confirm` back off). The `enabled` check happens in
+`_confirm_flagged_honeypots()` itself, ahead of the per-host loop, so the
+common disabled case skips `_select_confirm_probe_ports()`'s candidate-set
+work entirely — but that path still truncates the file rather than returning
+outright, for the reason just given. Every host handed to the probe is first
+run through `_scope_filtered_flags()` against the current `target_file`,
+since the probe is the only honeypot signal that *sends packets* and the
+flag dict is built from cached `live_hosts/` and `masscan_results/` data
+that a narrowed `ranges.txt` deliberately never prunes; an empty/unparseable
+scope is permissive, matching `_report_out_of_scope_retained()`.
+
+**Three limitations an operator enabling `honeypot_active_confirm` needs to
+know.** (1) On a **Full** scan (`dest_ports == ['1-65535']`) essentially every
+ephemeral port has already been scanned, so `_select_confirm_probe_ports()`
+finds few or zero unscanned candidates and the probe effectively does
+nothing — silently, with no message either way. (2) **All** honeypot
+detection, Stage 1 signals and the active probe alike, lives inside
+`mass_scan()`; the alternate direct-nmap port-discovery path (taken for
+small/medium scans below the configured `nmap_threshold` work-unit ceiling)
+performs none of it. (3) Every signal in this feature only ever becomes a
+*finding* when `script_scan: true`, because `generate_findings()` returns
+immediately when `nse_results/` does not exist and the default is off — the
+Stage 1 stdout warnings and the `discovery/*.txt` files are still written
+either way, since those come from `mass_scan()`, not `generate_findings()`.
+None of the three is fixed in code; they are documented as-is.
diff --git a/README.md b/README.md
index 7c2f06a..b78297e 100644
--- a/README.md
+++ b/README.md
@@ -308,6 +308,7 @@ git update-index --no-skip-worktree ranges.txt
 | `resume` | `"True"` / `"False"` | Skip completed port discovery on restart (default: False) |
 | `check_for_updates` | `"True"` / `"False"` | Contact api.github.com at startup to check for a newer release. Off unless set; see `--check-update` for a one-off check (default: False) |
 | `scanner_profile` | `false`, `"random"`, or an object | Substitutes strings that identify nmap/SpooNMAP in probe traffic (e.g. the RDP probe's `mstshash=nmap` cookie). Off unless set — see below |
+| `honeypot_active_confirm` | `"True"` / `"False"` | Actively confirm suspected decoy hosts with a few raw TCP connects to unscanned high ports. Off unless set; only probes in-scope hosts flagged by the TTL-spread or port-profile signals, and only on the masscan scan path (default: False) |
 | `__generated_by_prompts__` | String | Present only in a config the prompts wrote. While it is present, **[d]elete**/**[a]ppend** re-ask the options using this file's values as defaults; remove it to keep them fixed |
 
 Keys beginning and ending with `__` are documentation and are ignored by the loader, so you can annotate the file freely — a re-prompted run preserves them.
@@ -554,6 +555,7 @@ After scanning, `generate_findings()` parses all nmap XML results and produces s
 | HIGH | IKE Aggressive Mode with Pre-Shared Key (U:500, confirmed by `ike-version`) |
 | HIGH | RealVNC Authentication Bypass (CVE-2006-2369) (5900/5901, confirmed by `realvnc-auth-bypass`) |
 | HIGH | Service Exposed Externally (databases, RDP, SMB, SNMP, WebLogic, VNC, WSUS 8530/8531, etc. — external scan only) |
+| HIGH | Likely Honeypot / Decoy Host — named product match (Heralding VNC) or an active confirmation-probe answer |
 | MEDIUM | SMBv1 protocol enabled |
 | MEDIUM | Weak SSH algorithms (deprecated ciphers/MACs/KEX) |
 | MEDIUM | Java RMI registry exposed |
@@ -563,6 +565,8 @@ After scanning, `generate_findings()` parses all nmap XML results and produces s
 | MEDIUM | OpenAI-Compatible LLM API Unauthenticated (1234/1337/3000/8000, custom NSE — internal scan) |
 | MEDIUM | Gradio LLM Web UI Accessible (7860, custom NSE — internal scan) |
 | MEDIUM | KoboldCpp LLM API Unauthenticated (5001, custom NSE — internal scan) |
+| MEDIUM | Likely Honeypot / Decoy Host — two or more heuristic signals on one host |
+| LOW | Likely Honeypot / Decoy Host — exactly one heuristic signal (tarpit open-port ratio, TTL spread, port profile, unmatched fingerprints, or silent open ports) |
 | LOW | Anonymous FTP login (default LOW — review the share; escalate if it exposes sensitive data or is writable) |
 | LOW | FTP exposed externally (plaintext protocol — credentials/data in cleartext; use FTPS/SFTP) |
 | LOW | Telnet exposed externally (plaintext protocol — credentials/data in cleartext; use SSH) |
diff --git a/config.json.sample b/config.json.sample
index d1ee924..8ca978e 100644
--- a/config.json.sample
+++ b/config.json.sample
@@ -18,6 +18,8 @@
     "resume" : false,
     "__check_for_updates_note__": "Optional. When true, SpooNMAP contacts api.github.com at startup to see whether a newer release exists. Default false, and absent means false: the tool makes no network connection other than the scan itself unless you turn this on. Use --check-update for a one-off check without enabling it here.",
     "check_for_updates": false,
+    "__honeypot_active_confirm_note__": "Optional. When true, SpooNMAP attempts a small number of raw TCP connects against unscanned high ports on any host flagged by the TTL-spread or port-profile signals, to confirm it. Hosts flagged only by the tarpit open-port-ratio heuristic are not probed. Default false, and absent means false: the tool sends no traffic beyond the scan itself unless you turn this on. A confirmed host answered a port that was never part of this scan, which is a strong tell that it accepts every connection rather than running a real service. Limitations: hosts outside target_file are never probed; on a Full (1-65535) scan there are almost no unscanned ports left to probe, so it does little or nothing; and honeypot detection as a whole only runs on the masscan path, not the direct-nmap path used for scans below nmap_threshold.",
+    "honeypot_active_confirm": false,
     "__target_scan_choices__" : "External, Internal (case-insensitive; any other value stops the run rather than scanning with the Internal-only checks silently skipped)",
     "target_scan" : "Internal",
     "__max_rate_external_recommendation__" : "Default = 20000 (full port scan capped at 10000)",
diff --git a/spoonmap.py b/spoonmap.py
index dda8bd8..5c61106 100755
--- a/spoonmap.py
+++ b/spoonmap.py
@@ -28,6 +28,7 @@
 import time
 import queue
 from queue import Queue
+import random
 import urllib.error
 import urllib.request
 import xml.etree.ElementTree as etree
@@ -2014,7 +2015,320 @@ def _report_suspected_tarpits(suspected, disc):
     _atomic_write(tarpit_file, ''.join(lines))
 
 
-def mass_scan(scan_type, dest_ports, source_port, max_rate, target_file, exclusions_file, batch_size=1, resume=False, discovery_file=None, target_scan='Internal'):
+def _ttl_spread_by_host(masscan_dir):
+    """Return {ip: sorted distinct reason_ttl values} for hosts whose open
+    TCP ports report more than one distinct TTL in masscan's own XML output.
+
+    One host has one TCP/IP stack; every open port on a real host reports the
+    same TTL. More than one value across a host's ports is characteristic of
+    several emulated listeners behind one address (honeyd, T-Pot's per-service
+    containers) rather than a single machine. NAT/load-balancing can also
+    produce this pattern, so this signal alone is deliberately never enough to
+    reach HIGH severity -- see _honeypot_severity().
+    """
+    ttls_by_ip = {}
+    if not os.path.exists(masscan_dir):
+        return {}
+    for fname in sorted(os.listdir(masscan_dir)):
+        if not fname.endswith('.xml'):
+            continue
+        try:
+            root = etree.parse(os.path.join(masscan_dir, fname))
+        except etree.ParseError:
+            continue
+        for host in root.findall('host'):
+            addr_elem = host.find("address[@addrtype='ipv4']")
+            ip = addr_elem.attrib.get('addr') if addr_elem is not None else None
+            if not ip:
+                continue
+            ports_elem = host.find('ports')
+            if ports_elem is None:
+                continue
+            for port_elem in ports_elem.findall('port'):
+                if port_elem.attrib.get('protocol') == 'udp':
+                    continue
+                state_elem = port_elem.find('state')
+                if state_elem is None:
+                    continue
+                ttl_text = state_elem.attrib.get('reason_ttl')
+                if ttl_text is None:
+                    continue
+                try:
+                    ttl = int(ttl_text)
+                except ValueError:
+                    continue
+                ttls_by_ip.setdefault(ip, set()).add(ttl)
+    return {ip: sorted(ttls) for ip, ttls in ttls_by_ip.items() if len(ttls) > 1}
+
+
+def _port_profile_match(open_ports):
+    """Return the matching product name when open_ports is a superset of a
+    known honeypot deployment's default port profile, else None."""
+    port_set = set(open_ports)
+    for name, profile in HONEYPOT_PORT_PROFILES.items():
+        if profile <= port_set:
+            return name
+    return None
+
+
+def _flag_honeypot_signals(port_ips, masscan_dir):
+    """Return {ip: {'ttl_spread': [...], 'port_profile': name}} for hosts
+    matching either the TTL-inconsistency or known-port-profile heuristic.
+
+    TTL spread is read back from masscan_dir's XML files (reason_ttl is not
+    threaded through port_ips's in-memory {port_key: {ips}} shape); port
+    profile matching reuses port_ips directly since it already has the
+    per-host open-port set this needs, at zero extra I/O.
+    """
+    flagged = {}
+
+    # masscan_results/ can be unreadable for reasons that have nothing to do
+    # with this signal -- most commonly a directory left root-owned by an
+    # earlier sudo run and read back by a later non-root --resume. This runs
+    # near the end of mass_scan(), after every batch has completed, so an
+    # OSError escaping here would unwind mass_scan() and main() and discard a
+    # finished scan's entire aggregation over an advisory heuristic. Degrade to
+    # no TTL-spread signal instead; the port-profile half below reads only
+    # in-memory data and is unaffected.
+    try:
+        ttl_spread = _ttl_spread_by_host(masscan_dir)
+    except OSError:
+        ttl_spread = {}
+    for ip, ttls in ttl_spread.items():
+        flagged.setdefault(ip, {})['ttl_spread'] = ttls
+
+    hosts_ports = {}
+    for port_key, ips in port_ips.items():
+        if port_key.startswith('U:'):
+            continue
+        for ip in ips:
+            hosts_ports.setdefault(ip, set()).add(port_key)
+    for ip, ports in hosts_ports.items():
+        match = _port_profile_match(ports)
+        if match:
+            flagged.setdefault(ip, {})['port_profile'] = match
+
+    return flagged
+
+
+def _scope_filtered_flags(flagged, scope_ranges):
+    """Return *flagged* with every out-of-scope host removed.
+
+    _flag_honeypot_signals() draws on data that can outlive the current
+    authorisation: port_ips/full_results are unioned with cached
+    ``live_hosts/portN.txt`` files that a narrowed ``ranges.txt`` deliberately
+    never prunes, and _ttl_spread_by_host() walks every XML file still sitting
+    in ``masscan_results/`` from an even wider set of earlier runs.  That is
+    harmless for the Stage 1 signals, which only read and disclose -- but the
+    Stage 2 active confirmation probe *sends packets*, so it must never be
+    handed a host this engagement is not authorised to touch.  Filter here, at
+    the call site, ahead of _confirm_flagged_honeypots().
+
+    An empty *scope_ranges* is permissive and returns *flagged* unchanged,
+    matching _report_out_of_scope_retained(): an absent or unparseable
+    target_file means there is no authorisation record to compare against, so
+    nothing is claimed either way rather than silently disabling a feature the
+    operator turned on.
+    """
+    if not scope_ranges:
+        return flagged
+    return {ip: signals for ip, signals in flagged.items()
+            if _ip_in_ranges(ip, scope_ranges)}
+
+
+def _report_suspected_honeypots(flagged, disc):
+    """Persist TTL-spread/port-profile flagged hosts to
+    disc/suspected_honeypots.txt and warn on stdout.
+
+    One line per (ip, signal) pair -- a host can carry both signals -- so the
+    format mirrors _report_suspected_tarpits() but is not a straight port:
+    'ip,ttl_spread,64|128' or 'ip,port_profile,Thinkst Canary'.
+
+    The file is written unconditionally, so an empty result truncates it.  This
+    diverges from _report_suspected_tarpits(), which still returns early and
+    leaves a stale file in place -- deliberately, because generate_findings()
+    now *counts* signals to pick HIGH/MEDIUM/LOW.  A leftover line from an
+    earlier, broader run used to be a merely redundant reason string; it now
+    inflates a later, narrower run's severity, and nothing else on disk would
+    show why.  Truncating is the only way a signal that stopped firing stops
+    being scored.
+    """
+    honeypot_file = os.path.join(disc, 'suspected_honeypots.txt')
+    lines = []
+    for ip in sorted(flagged, key=_ip_sort_key):
+        signals = flagged[ip]
+        if 'ttl_spread' in signals:
+            ttl_str = '|'.join(str(t) for t in signals['ttl_spread'])
+            lines.append(f'{ip},ttl_spread,{ttl_str}\n')
+            print(_COLOR_ERROR
+                  + f'Warning: {ip} returned inconsistent TTLs ({ttl_str}) across '
+                  + 'scanned ports — possible multiple emulated services behind one '
+                  + 'address.'
+                  + _COLOR_RESET)
+        if 'port_profile' in signals:
+            product = signals['port_profile']
+            lines.append(f'{ip},port_profile,{product}\n')
+            print(_COLOR_ERROR
+                  + f'Warning: {ip}\'s open ports match a candidate port profile for '
+                  + f'{product} (unverified against current upstream defaults) — '
+                  + 'possible decoy host.'
+                  + _COLOR_RESET)
+    _atomic_write(honeypot_file, ''.join(lines))
+
+
+_EXPAND_SCANNED_PORTS_MAX_SPAN = 100_000
+
+
+def _expand_scanned_ports(scanned_ports):
+    """Expand a dest_ports-style list (individual port strings and/or
+    'N-M' range strings) into the set of integer ports it covers.
+
+    dest_ports can hold range specs like '1-65535' (Full scan) or
+    '49152-65535' (a custom scan covering the ephemeral range) alongside
+    plain port numbers. Comparing those range strings against candidate
+    ports as strings (e.g. '64835' not in {'1-65535'}) is always True since
+    the range is never expanded — this expands it into real integers so
+    membership tests are correct.
+
+    dest_ports is unvalidated operator input — a hand-typed Custom port
+    list or a raw config.json value — so a malformed token ('80-', 'http',
+    '8O80', '80/tcp') is skipped rather than raising: this function runs
+    ahead of _maybe_confirm_honeypot()'s enabled-flag check, so an
+    unhandled ValueError here would abort mass_scan()/main() and discard a
+    completed scan's aggregation even when the active-probe feature is
+    off. Skipping a bad token only shrinks the "confirmed scanned" set,
+    which can only narrow the probe candidate pool, never widen it or
+    reintroduce the range-string false-positive this function fixes.
+
+    A range whose span exceeds _EXPAND_SCANNED_PORTS_MAX_SPAN (100,000 —
+    far more than any real scan needs, since the full port space is only
+    65535) is skipped rather than expanded, so a token like
+    '1-4294967295' can't materialize a multi-billion-element set.
+    """
+    expanded = set()
+    for p in scanned_ports:
+        if '-' in p:
+            start, end = p.split('-', 1)
+            try:
+                start_i, end_i = int(start), int(end)
+            except ValueError:
+                continue
+            if end_i < start_i or (end_i - start_i + 1) > _EXPAND_SCANNED_PORTS_MAX_SPAN:
+                continue
+            expanded.update(range(start_i, end_i + 1))
+        else:
+            try:
+                expanded.add(int(p))
+            except ValueError:
+                continue
+    return expanded
+
+
+def _select_confirm_probe_ports(ip, scanned_ports, count=3):
+    """Return `count` deterministic high ports, seeded from ip, that were
+    never part of this run's scanned port set.
+
+    Deterministic (seeded from the target IP, not global randomness) so the
+    probe is reproducible and testable without mocking random state. Ports
+    are drawn from the ephemeral range (49152-65535) specifically because a
+    legitimate host is unlikely to run a fixed service there, so an answer
+    is a strong tell rather than a false positive from a real service the
+    scan happened not to cover.
+
+    random.Random(ip) is deliberate, not a bandit B311 concern despite the
+    rule flagging it: this seeds decorrelated-but-reproducible probe port
+    selection per target IP, not a security or cryptographic use of
+    randomness — see .bandit-baseline.json.
+    """
+    scanned = _expand_scanned_ports(p for p in scanned_ports if not p.startswith('U:'))
+    rng = random.Random(ip)
+    candidates = [p for p in range(49152, 65536) if p not in scanned]
+    return [str(p) for p in rng.sample(candidates, min(count, len(candidates)))]
+
+
+def _active_confirm_probe(ip, probe_ports, timeout=2, connector=None):
+    """Return True if a raw TCP connect succeeds on any of probe_ports.
+
+    A real host has no reason to answer on an unscanned, unrelated ephemeral
+    port; a decoy that accepts every connection will. connector defaults to
+    socket.create_connection and is injectable for testing.
+    """
+    connect = connector or socket.create_connection
+    for port in probe_ports:
+        try:
+            with connect((ip, int(port)), timeout=timeout):
+                return True
+        except OSError:
+            continue
+    return False
+
+
+def _maybe_confirm_honeypot(enabled, ip, probe_ports, connector=None):
+    """Run the active confirmation probe only if the operator opted in.
+
+    Mirrors _maybe_check_for_updates(): a thin, directly-testable gate so
+    "does a default run ever send an unrequested probe" is a real test, not
+    something buried inside mass_scan().
+    """
+    if not enabled:
+        return False
+    return _active_confirm_probe(ip, probe_ports, connector=connector)
+
+
+def _report_confirmed_honeypots(confirmed_ips, disc):
+    """Persist actively-confirmed decoy hosts to disc/confirmed_honeypots.txt
+    and warn on stdout.
+
+    Written unconditionally, so an empty result truncates it -- same reasoning
+    as _report_suspected_honeypots(), and more acute here: a stale line pins
+    generate_findings() at HIGH *and* makes the deliverable assert "active
+    confirmation probe: host answered ..." for a probe that did not run this
+    time at all, which is exactly what happens when an operator turns
+    honeypot_active_confirm back off.
+    """
+    confirmed_file = os.path.join(disc, 'confirmed_honeypots.txt')
+    lines = []
+    for ip in sorted(confirmed_ips, key=_ip_sort_key):
+        lines.append(f'{ip}\n')
+        print(_COLOR_ERROR
+              + f'Warning: {ip} answered a connection on a port never scanned open '
+              + 'during this run — confirmed decoy/honeypot host.'
+              + _COLOR_RESET)
+    _atomic_write(confirmed_file, ''.join(lines))
+
+
+def _confirm_flagged_honeypots(flagged, enabled, dest_ports, disc, connector=None):
+    """Run the active probe (if enabled) against every host
+    _flag_honeypot_signals() flagged, and persist whichever ones answer.
+
+    connector is threaded through to _maybe_confirm_honeypot() /
+    _active_confirm_probe() and is injectable for testing, so the
+    enabled=True path can be exercised with a fake connector instead of a
+    real socket connection or internals-patching.
+
+    The enabled check happens *here*, not only inside _maybe_confirm_honeypot():
+    _select_confirm_probe_ports() builds and samples a ~16k-element candidate
+    set per host, and enabled=False is the default and overwhelmingly common
+    case, so doing that work only to discard it was pure waste on every scan
+    that flagged anything.  _report_confirmed_honeypots() is still called on
+    that path -- with an empty set, which truncates any stale
+    confirmed_honeypots.txt.  Skipping it would leave a previous run's
+    confirmations feeding generate_findings()'s severity math after the
+    operator turned the probe back off, which is the precise scenario that file
+    truncation exists to prevent.
+    """
+    if not flagged or not enabled:
+        _report_confirmed_honeypots(set(), disc)
+        return
+    confirmed = set()
+    for ip in flagged:
+        probe_ports = _select_confirm_probe_ports(ip, dest_ports)
+        if _maybe_confirm_honeypot(enabled, ip, probe_ports, connector=connector):
+            confirmed.add(ip)
+    _report_confirmed_honeypots(confirmed, disc)
+
+
+def mass_scan(scan_type, dest_ports, source_port, max_rate, target_file, exclusions_file, batch_size=1, resume=False, discovery_file=None, target_scan='Internal', honeypot_active_confirm=False):
     status_summary = '\nSummary'
 
     if not os.path.exists(f'{_disc(output_path)}/masscan_results'):
@@ -2092,6 +2406,13 @@ def mass_scan(scan_type, dest_ports, source_port, max_rate, target_file, exclusi
                         status_summary += status_update
                         print(_COLOR_PROGRESS + status_update + _COLOR_RESET)
             _report_suspected_tarpits(_flag_suspected_tarpits(full_results, 65535), disc)
+            honeypot_flags = _flag_honeypot_signals(full_results, f'{disc}/masscan_results')
+            _report_suspected_honeypots(honeypot_flags, disc)
+            # Scope-filter before the probe: this is the only honeypot signal
+            # that sends packets, and honeypot_flags can carry hosts from a
+            # prior, wider engagement (see _scope_filtered_flags).
+            _confirm_flagged_honeypots(_scope_filtered_flags(honeypot_flags, scope_ranges),
+                                       honeypot_active_confirm, dest_ports, disc)
             # This path's results are read straight back off disk, so it is the
             # most exposed to a live_hosts/ directory left over from a wider scope.
             _report_out_of_scope_retained(full_results, scope_ranges, target_file)
@@ -2144,6 +2465,11 @@ def mass_scan(scan_type, dest_ports, source_port, max_rate, target_file, exclusi
             status_summary += status_update
             print(_COLOR_PROGRESS + status_update + _COLOR_RESET)
         _report_suspected_tarpits(_flag_suspected_tarpits(full_results, 65535), disc)
+        honeypot_flags = _flag_honeypot_signals(full_results, f'{disc}/masscan_results')
+        _report_suspected_honeypots(honeypot_flags, disc)
+        # Scope-filter before the probe -- see _scope_filtered_flags().
+        _confirm_flagged_honeypots(_scope_filtered_flags(honeypot_flags, scope_ranges),
+                                   honeypot_active_confirm, dest_ports, disc)
         # Retaining cached hosts means this path can now carry a host from a
         # previous, wider engagement scope, exactly as the resume path can, so it
         # owes the operator the same disclosure.
@@ -2418,6 +2744,11 @@ def mass_scan(scan_type, dest_ports, source_port, max_rate, target_file, exclusi
             _print_completion_status('Masscan', batch_idx + 1, total_batches, scan_start_time)
 
     _report_suspected_tarpits(_flag_suspected_tarpits(port_ips, len(tcp_ports)), disc)
+    honeypot_flags = _flag_honeypot_signals(port_ips, f'{disc}/masscan_results')
+    _report_suspected_honeypots(honeypot_flags, disc)
+    # Scope-filter before the probe -- see _scope_filtered_flags().
+    _confirm_flagged_honeypots(_scope_filtered_flags(honeypot_flags, scope_ranges),
+                               honeypot_active_confirm, dest_ports, disc)
 
     # ── SMB port coupling ─────────────────────────────────────────────────────
     smb_in_scope = [p for p in _SMB_COUPLED_PORTS if p in set(dest_ports)]
@@ -3089,6 +3420,39 @@ def _resolve_nse_dir(base_dir):
 HONEYPOT_OPEN_PORT_FRACTION = 0.9    # fraction of scanned TCP ports found open on one host
 HONEYPOT_MIN_UNMATCHED_PORTS = 3     # open ports with an unidentified (servicefp) response
 
+def _honeypot_severity(signals, named_match=False, confirmed=False):
+    """Return 'HIGH'/'MEDIUM'/'LOW', or None when nothing is flagged.
+
+    HIGH requires near-certainty: a named-product signature match or an
+    active probe confirmation. Two or more independent heuristic signals
+    ('ratio', 'unmatched_fp', 'silent', 'ttl_spread', 'port_profile')
+    together are MEDIUM; any single heuristic signal alone is LOW. This
+    structurally keeps TTL spread -- which NAT/load-balancing can also
+    produce -- from ever reaching HIGH on its own: it can only ever be one
+    signal among the set, never named_match or confirmed.
+    """
+    if named_match or confirmed:
+        return 'HIGH'
+    if len(signals) >= 2:
+        return 'MEDIUM'
+    if len(signals) == 1:
+        return 'LOW'
+    return None
+
+# Port sets characteristic of known deception/decoy tooling default
+# deployments. Superset match, not exact: an operator-customised deployment
+# (an extra port, or unrelated services sharing the box) should still match
+# on its known baseline.
+#
+# NOTE: these are placeholders pending verification against current upstream
+# defaults before shipping -- both projects' default port lists can change
+# between releases and installs are commonly customised. Verify against each
+# project's current documentation/config before relying on this in a report.
+HONEYPOT_PORT_PROFILES = {
+    'Thinkst Canary': frozenset(['21', '22', '23', '80', '443', '445', '3389']),
+    'Artillery':       frozenset(['21', '22', '23', '25', '80', '443', '3306', '3389', '8080']),
+}
+
 # Scripts run on EXTERNAL scans only
 EXTERNAL_PORT_SCRIPTS = {
     '21':    'ftp-anon',
@@ -3617,19 +3981,17 @@ def _classify_sql(hostname, ms_sql_output='', azure_output=''):
     return False, None, year
 
 
-def _count_unmatched_service_ports(output_path):
-    """Return {ip: count} of open TCP ports whose nmap -sV probe captured data
-    that matched none of nmap's service signatures.
+def _iter_open_tcp_ports(output_path):
+    """Yield (ip, service_elem) for every open TCP port in nmap_results/*.xml.
 
-    nmap only sets the service element's servicefp attribute when it connected,
-    read data back, and failed to identify it against any known protocol —
-    a strong tell for decoy tools (e.g. Artillery) that hand back a random
-    string on every full connect instead of speaking a real protocol.
+    service_elem is None when nmap recorded no <service> element at all.
+    Shared by _count_unmatched_service_ports() and _count_silent_open_ports()
+    so the XML-walk defensiveness (skip a host with no addr, skip malformed
+    XML, skip UDP files) lives in one place instead of being duplicated.
     """
     nmap_dir = f'{output_path}/nmap_results'
-    counts = {}
     if not os.path.exists(nmap_dir):
-        return counts
+        return
     for fname in sorted(os.listdir(nmap_dir)):
         if not fname.endswith('.xml') or fname.startswith('portU_'):
             continue
@@ -3650,12 +4012,140 @@ def _count_unmatched_service_ports(output_path):
                 state_elem = port_elem.find('state')
                 if state_elem is not None and state_elem.attrib.get('state') != 'open':
                     continue
-                service_elem = port_elem.find('service')
-                if service_elem is not None and service_elem.attrib.get('servicefp'):
-                    counts[ip] = counts.get(ip, 0) + 1
+                yield ip, port_elem.find('service')
+
+
+def _count_unmatched_service_ports(output_path):
+    """Return {ip: count} of open TCP ports whose nmap -sV probe captured data
+    that matched none of nmap's service signatures.
+
+    nmap only sets the service element's servicefp attribute when it connected,
+    read data back, and failed to identify it against any known protocol —
+    a strong tell for decoy tools (e.g. Artillery) that hand back a random
+    string on every full connect instead of speaking a real protocol.
+    """
+    counts = {}
+    for ip, service_elem in _iter_open_tcp_ports(output_path):
+        if service_elem is not None and service_elem.attrib.get('servicefp'):
+            counts[ip] = counts.get(ip, 0) + 1
     return counts
 
 
+def _count_silent_open_ports(output_path):
+    """Return {ip: count} of open TCP ports where nmap's -sV probe got
+    nothing at all back — no service name, no product, no servicefp.
+
+    Complements _count_unmatched_service_ports(), which only counts ports
+    where nmap connected and read *some* data that failed to match a
+    signature (servicefp set). A tarpit that holds the connection open and
+    sends nothing back scores zero on that check but is exactly what this
+    one is for.
+    """
+    counts = {}
+    for ip, service_elem in _iter_open_tcp_ports(output_path):
+        if service_elem is None:
+            counts[ip] = counts.get(ip, 0) + 1
+            continue
+        attrib = service_elem.attrib
+        if not attrib.get('name') and not attrib.get('product') and not attrib.get('servicefp'):
+            counts[ip] = counts.get(ip, 0) + 1
+    return counts
+
+
+# Well-known *default, unconfigured* banners of common honeypot/decoy
+# products, matched against the concatenated product/version/extrainfo text
+# nmap's -sV already captures.
+#
+# DELIBERATELY EMPTY. This ships with no generic banner signatures. Two
+# candidates (Cowrie/Kippo and Dionaea) were carried here during development
+# and both were verified *incorrect* against nmap's actual output in final
+# review, so they were removed rather than patched in place:
+#
+#   - Cowrie/Kippo: the needle used a hyphen ('OpenSSH 6.0p1 Debian-4+deb7u2'),
+#     but nmap's own nmap-service-probes match template for that banner renders
+#     it with a space ('... Debian 4+deb7u2'), so it could never fire. The
+#     superficial fix -- swap the hyphen for a space -- is strictly worse:
+#     nmap applies that same space-insertion to *every* genuine Debian OpenSSH
+#     host, so the "fixed" signature would report HIGH-severity honeypot on one
+#     of the most common SSH banners on the internet.
+#   - Dionaea: the needle ('Welcome to the ftp service') is an unrecognised
+#     banner, which nmap records in the service element's `servicefp`
+#     attribute. _named_honeypot_matches() reads only product/version/extrainfo,
+#     so no such string can ever reach the matcher.
+#
+# The mechanism below (this tuple, _honeypot_signature_match(),
+# _named_honeypot_matches()) is kept as the extensibility point so a future
+# verified signature is a one-line addition rather than a re-thread of the
+# whole path. Add an entry here ONLY after confirming it against real `-sV`
+# output from the product in question -- not against a synthetic test fixture,
+# which is exactly what let both removed entries look correct for so long.
+# The one named-product match this release does ship is the independently
+# source-verified Heralding VNC tell in _vnc_heralding_match(), which does not
+# use this table at all.
+HONEYPOT_SIGNATURES = ()
+
+
+def _honeypot_signature_match(text):
+    """Return the matching product name when text contains a known
+    default/unconfigured honeypot banner, else None."""
+    for needle, product in HONEYPOT_SIGNATURES:
+        if needle in text:
+            return product
+    return None
+
+
+def _named_honeypot_matches(output_path):
+    """Return {ip: product_name} for hosts whose -sV service banner matches
+    a known default honeypot signature. First match wins per host."""
+    matches = {}
+    for ip, service_elem in _iter_open_tcp_ports(output_path):
+        if ip in matches or service_elem is None:
+            continue
+        attrib = service_elem.attrib
+        text = ' '.join(filter(None, (
+            attrib.get('product'), attrib.get('version'), attrib.get('extrainfo'))))
+        if not text:
+            continue
+        product = _honeypot_signature_match(text)
+        if product:
+            matches[ip] = product
+    return matches
+
+
+def _vnc_heralding_match(output_path):
+    """Return {ip: 'Heralding VNC Honeypot'} for hosts whose vnc-info output
+    matches Heralding's VNC capability: it hardcodes RFB protocol version 3.7
+    and closes the connection before ever sending a security-type list,
+    unlike any real RFB implementation (which always completes that
+    exchange, even on legacy 3.7 servers). Verified against upstream source
+    (johnnykv/heralding, heralding/capabilities/vnc.py)."""
+    matches = {}
+    nse_dir = f'{output_path}/nse_results'
+    if not os.path.exists(nse_dir):
+        return matches
+    for fname in sorted(os.listdir(nse_dir)):
+        if not fname.endswith('.xml') or fname.startswith('portU_'):
+            continue
+        try:
+            root = etree.parse(f'{nse_dir}/{fname}')
+        except etree.ParseError:
+            continue
+        for host in root.findall('host'):
+            addr_elem = host.find("address[@addrtype='ipv4']")
+            ip = addr_elem.attrib.get('addr') if addr_elem is not None else None
+            if not ip or ip in matches:
+                continue
+            for port_elem in host.findall('.//port'):
+                script_elem = port_elem.find("script[@id='vnc-info']")
+                if script_elem is None:
+                    continue
+                out = script_elem.attrib.get('output', '')
+                if '3.7' in out and 'Security types' not in out:
+                    matches[ip] = 'Heralding VNC Honeypot'
+                break
+    return matches
+
+
 def generate_findings(output_path, target_scan, snmp_any_validated=None):
     """Parse nmap script output and write findings.txt and findings.md."""
     nmap_dir = f'{output_path}/nse_results'
@@ -3733,9 +4223,16 @@ def port_str_from_fname(fname):
                 if ip:
                     printer_ips.add(ip)
 
-    # ── suspected honeypot / tarpit hosts ─────────────────────────────────────
-    tarpit_hosts = {}   # {ip: (open_count, total_scanned)}
-    tarpit_file = f'{_disc(output_path)}/suspected_tarpits.txt'
+    # ── suspected honeypot / decoy hosts ──────────────────────────────────────
+    disc = _disc(output_path)
+    signals_by_ip = {}   # {ip: {signal_name, ...}}
+    reasons_by_ip = {}   # {ip: [human-readable reason, ...]}
+
+    def _add_signal(ip, name, reason):
+        signals_by_ip.setdefault(ip, set()).add(name)
+        reasons_by_ip.setdefault(ip, []).append(reason)
+
+    tarpit_file = f'{disc}/suspected_tarpits.txt'
     if os.path.exists(tarpit_file):
         # _report_suspected_tarpits() writes this file line by line, not
         # atomically, so an interrupt or a full disk can leave a partial final
@@ -3751,29 +4248,102 @@ def port_str_from_fname(fname):
                     if len(parts) == 3:
                         ip, open_count, total = parts
                         try:
-                            tarpit_hosts[ip] = (int(open_count), int(total))
+                            oc, total_i = int(open_count), int(total)
                         except ValueError:
                             continue
+                        _add_signal(ip, 'ratio',
+                                    f'{oc}/{total_i} scanned TCP ports responded open')
         except OSError:
-            tarpit_hosts = {}
-
-    unmatched_counts = _count_unmatched_service_ports(output_path)  # {ip: count}
-    unmatched_flagged = {ip for ip, count in unmatched_counts.items()
-                         if count >= HONEYPOT_MIN_UNMATCHED_PORTS}
-
-    for ip in sorted(set(tarpit_hosts) | unmatched_flagged):
-        reasons = []
-        if ip in tarpit_hosts:
-            open_count, total = tarpit_hosts[ip]
-            reasons.append(f'{open_count}/{total} scanned TCP ports responded open')
-        if ip in unmatched_flagged:
-            reasons.append(f'{unmatched_counts[ip]} open ports returned data matching '
-                            'no known service signature')
-        add('MEDIUM', ip, 'multiple', 'Likely Honeypot / Decoy Host',
+            pass
+
+    # A directory-walk failure here (e.g. nmap_results/ left root-owned by an
+    # earlier sudo run, then read by a later non-root --resume) must degrade
+    # this one signal source to "no data", never take down the findings phase
+    # -- same guarantee the file readers above already have.
+    try:
+        unmatched_counts = _count_unmatched_service_ports(output_path)
+    except OSError:
+        unmatched_counts = {}
+    for ip, count in unmatched_counts.items():
+        if count >= HONEYPOT_MIN_UNMATCHED_PORTS:
+            _add_signal(ip, 'unmatched_fp',
+                        f'{count} open ports returned data matching no known service signature')
+
+    try:
+        silent_counts = _count_silent_open_ports(output_path)
+    except OSError:
+        silent_counts = {}
+    for ip, count in silent_counts.items():
+        if count >= HONEYPOT_MIN_UNMATCHED_PORTS:
+            _add_signal(ip, 'silent',
+                        f'{count} open ports accepted a connection and returned no data at all')
+
+    honeypot_file = f'{disc}/suspected_honeypots.txt'
+    if os.path.exists(honeypot_file):
+        try:
+            with open(honeypot_file) as fh:
+                for line in fh:
+                    parts = line.strip().split(',', 2)
+                    if len(parts) == 3:
+                        ip, sig_type, value = parts
+                        if sig_type == 'ttl_spread':
+                            _add_signal(ip, 'ttl_spread',
+                                        f'TCP responses observed with inconsistent TTLs '
+                                        f'({value}) across scanned ports on one host')
+                        elif sig_type == 'port_profile':
+                            # The caveat is load-bearing: HONEYPOT_PORT_PROFILES
+                            # is still an unverified placeholder table, and this
+                            # string lands verbatim in an engagement deliverable.
+                            _add_signal(ip, 'port_profile',
+                                        f'open port set matches a candidate port '
+                                        f'profile for {value} (unverified against '
+                                        f'current upstream defaults)')
+        except OSError:
+            pass
+
+    try:
+        named_matches = _named_honeypot_matches(output_path)  # {ip: product_name}
+    except OSError:
+        named_matches = {}
+    try:
+        vnc_matches = _vnc_heralding_match(output_path)
+    except OSError:
+        vnc_matches = {}
+    named_matches.update(vnc_matches)  # merge in the vnc-info-based signal
+
+    confirmed_ips = set()
+    confirmed_file = f'{disc}/confirmed_honeypots.txt'
+    if os.path.exists(confirmed_file):
+        try:
+            with open(confirmed_file) as fh:
+                confirmed_ips = {line.strip() for line in fh if line.strip()}
+        except OSError:
+            pass
+
+    all_flagged_ips = set(signals_by_ip) | set(named_matches) | confirmed_ips
+    for ip in sorted(all_flagged_ips, key=_ip_sort_key):
+        signals = signals_by_ip.get(ip, set())
+        named_present = ip in named_matches
+        named = named_matches.get(ip)
+        confirmed = ip in confirmed_ips
+        severity = _honeypot_severity(signals, named_match=named_present, confirmed=confirmed)
+        if severity is None:
+            # Unreachable: every ip in all_flagged_ips is a member of
+            # signals_by_ip, named_matches, or confirmed_ips, and
+            # _honeypot_severity() returns non-None for any non-empty
+            # combination of those three inputs.
+            continue  # pragma: no cover
+        reasons = list(reasons_by_ip.get(ip, []))
+        if named_present:
+            reasons.insert(0, f'service fingerprint matches known honeypot product {named}')
+        if confirmed:
+            reasons.append('active confirmation probe: host answered on a port never '
+                            'scanned open, consistent with a decoy accepting all connections')
+        add(severity, ip, 'multiple', 'Likely Honeypot / Decoy Host',
             '; '.join(reasons) + '. Consistent with tarpit/decoy tooling (e.g. LaBrea, '
-            'portspoof, Artillery) rather than a genuine service host. Recommend '
-            'deprioritizing further enumeration of this host and manually validating '
-            'before trusting other findings collected from it.')
+            'portspoof, Cowrie, Dionaea, Artillery, Thinkst Canary) rather than a genuine '
+            'service host. Recommend deprioritizing further enumeration of this host and '
+            'manually validating before trusting other findings collected from it.')
 
     # ── parse every nmap XML result file ─────────────────────────────────────
     open_ports_by_host = {}  # {ip: [port_key, ...]} — for external exposure check
@@ -5622,6 +6192,21 @@ def _filter_udp_live_hosts(output_path):
          'tool makes no network connection other than the scan itself unless you turn '
          'this on. Use --check-update for a one-off check without enabling it here.'),
     ],
+    'honeypot_active_confirm': [
+        ('__honeypot_active_confirm_note__',
+         'Optional. When true, SpooNMAP attempts a small number of raw TCP connects '
+         'against unscanned high ports on any host flagged by the TTL-spread or '
+         'port-profile signals, to confirm it. Hosts flagged only by the tarpit '
+         'open-port-ratio heuristic are not probed. Default false, and absent means '
+         'false: the tool sends no traffic beyond the scan itself unless you turn '
+         'this on. A confirmed host answered a port that was never part of this '
+         'scan, which is a strong tell that it accepts every connection rather than '
+         'running a real service. Limitations: hosts outside target_file are never '
+         'probed; on a Full (1-65535) scan there are almost no unscanned ports left '
+         'to probe, so it does little or nothing; and honeypot detection as a whole '
+         'only runs on the masscan path, not the direct-nmap path used for scans '
+         'below nmap_threshold.'),
+    ],
     'target_scan': [
         ('__target_scan_choices__',
          'External, Internal (case-insensitive; any other value stops the run '
@@ -5662,7 +6247,8 @@ def _filter_udp_live_hosts(output_path):
 # Canonical key order for a written config.json, matching config.json.sample.
 _CONFIG_FIELD_ORDER = (
     'scan_categories', 'dest_ports', 'masscan_batch_size', 'banner_scan',
-    'script_scan', 'host_discovery', 'resume', 'check_for_updates', 'target_scan', 'max_rate',
+    'script_scan', 'host_discovery', 'resume', 'check_for_updates',
+    'honeypot_active_confirm', 'target_scan', 'max_rate',
     'nmap_threads', 'nmap_threshold', 'target_file', 'output_path',
     'exclusions_file', 'scanner_profile',
 )
@@ -5672,7 +6258,8 @@ def _build_interactive_config(scan_categories, dest_ports, scan_type, banner_sca
                               script_scan, target_scan, max_rate, target_file,
                               output_path, exclusions_file, nmap_threads,
                               masscan_batch_size, nmap_threshold, host_discovery,
-                              check_for_updates=False, scanner_profile=None):
+                              check_for_updates=False, scanner_profile=None,
+                              honeypot_active_confirm=False):
     """Build a config.json-compatible dict from interactively collected options.
 
     The result round-trips through main()'s config loader: reloading it
@@ -5717,6 +6304,7 @@ def _build_interactive_config(scan_categories, dest_ports, scan_type, banner_sca
         'host_discovery': bool(host_discovery),
         'resume': False,
         'check_for_updates': bool(check_for_updates),
+        'honeypot_active_confirm': bool(honeypot_active_confirm),
         'target_scan': target_scan,
         'max_rate': str(max_rate),
         'nmap_threads': int(nmap_threads),
@@ -6674,6 +7262,10 @@ def _load_config(config_parser, dir_path, resume=False):
     # Token generation itself happens in main(), not here, so this stays
     # deterministic for testing.
     scanner_profile = _config_scanner_profile(config_parser.get('scanner_profile'))
+    # Same posture as check_for_updates: absent means off, and this is the
+    # only way to enable the active probe. See _maybe_confirm_honeypot().
+    honeypot_active_confirm = _config_bool(
+        'honeypot_active_confirm', config_parser.get('honeypot_active_confirm', False), False)
     config_generated = bool(config_parser.get(_CONFIG_GENERATED_KEY))
 
     # Resolve relative paths in config relative to the operator directory
@@ -6703,6 +7295,7 @@ def _load_config(config_parser, dir_path, resume=False):
         'resume': resume,
         'check_for_updates': check_for_updates,
         'scanner_profile': scanner_profile,
+        'honeypot_active_confirm': honeypot_active_confirm,
         'config_generated': config_generated,
     }
 
@@ -6925,6 +7518,7 @@ def main():  # pragma: no cover -- interactive CLI entry point; orchestrates
         host_discovery = None   # None = prompt user; True/False = set from config
         check_for_updates = False  # no interactive prompt; only set via config.json
         scanner_profile = None  # no interactive prompt; only set via config.json
+        honeypot_active_confirm = False  # no interactive prompt; only set via config.json
 
 
         # Get options from configuration file if it exists
@@ -6963,6 +7557,7 @@ def main():  # pragma: no cover -- interactive CLI entry point; orchestrates
             config_generated   = cfg['config_generated']
             check_for_updates  = cfg['check_for_updates']
             scanner_profile    = cfg['scanner_profile']
+            honeypot_active_confirm = cfg['honeypot_active_confirm']
 
             _maybe_check_for_updates(check_for_updates)
 
@@ -7273,7 +7868,7 @@ def main():  # pragma: no cover -- interactive CLI entry point; orchestrates
                 scan_categories, dest_ports, scan_type, banner_scan, script_scan,
                 target_scan, max_rate, target_file, output_path, exclusions_file,
                 nmap_threads, masscan_batch_size, nmap_threshold, host_discovery,
-                check_for_updates, scanner_profile,
+                check_for_updates, scanner_profile, honeypot_active_confirm,
             )
             config_json_path = f'{dir_path}/config.json'
             if _write_interactive_config(config_json_path, interactive_config):
@@ -7440,6 +8035,7 @@ def main():  # pragma: no cover -- interactive CLI entry point; orchestrates
                 exclusions_file, masscan_batch_size,
                 resume=resume, discovery_file=discovery_file,
                 target_scan=target_scan,
+                honeypot_active_confirm=honeypot_active_confirm,
             )
 
         # If service banners requested, send to nmap
diff --git a/tests/test_spoonmap.py b/tests/test_spoonmap.py
index a89f2ac..fd750ec 100644
--- a/tests/test_spoonmap.py
+++ b/tests/test_spoonmap.py
@@ -1,5 +1,6 @@
 """Tests for spoonmap.py"""
 import ast
+import contextlib
 import datetime
 import inspect
 import io
@@ -28,6 +29,8 @@
     EXTERNAL_SENSITIVE_PORTS,
     HONEYPOT_MIN_PORTS_SCANNED,
     HONEYPOT_OPEN_PORT_FRACTION,
+    HONEYPOT_PORT_PROFILES,
+    HONEYPOT_SIGNATURES,
     HOST_DISCOVERY_NMAP_THRESHOLD,
     INTERNAL_DISCOVERY_MAX_RATE,
     INTERNAL_DISCOVERY_STATE_CEILING,
@@ -40,6 +43,7 @@
     _classify_sql,
     _config_int,
     _count_hosts_in_file,
+    _count_silent_open_ports,
     _count_unmatched_service_ports,
     _external_exposure_scripts,
     _extract_ssl_cert_hostnames,
@@ -48,9 +52,12 @@
     _raise_fd_limit,
     _sql_version_year,
     _summarize_vulns,
+    _ttl_spread_by_host,
     _handle_previous_results,
     _prior_default,
     _prompt_int,
+    _report_confirmed_honeypots,
+    _scope_filtered_flags,
     _prompt_yes_no,
     _CONFIG_DOCS,
     _CONFIG_FIELD_ORDER,
@@ -79,10 +86,22 @@
     _discover_external_masscan,
     _discover_internal_masscan,
     _external_host_discovery,
+    _active_confirm_probe,
+    _confirm_flagged_honeypots,
+    _expand_scanned_ports,
+    _flag_honeypot_signals,
     _flag_suspected_tarpits,
+    _honeypot_severity,
+    _honeypot_signature_match,
+    _maybe_confirm_honeypot,
+    _named_honeypot_matches,
     _nmap_host_discovery,
+    _port_profile_match,
+    _report_suspected_honeypots,
     _report_suspected_tarpits,
+    _select_confirm_probe_ports,
     _stream_masscan_progress,
+    _vnc_heralding_match,
     preprocess_targets,
     _discovery_wait,
     _internal_host_discovery,
@@ -2140,6 +2159,419 @@ def test_address_without_addr_attribute_skipped_others_kept(self, tmp_path):
         assert _count_unmatched_service_ports(str(tmp_path)) == {'10.0.0.8': 1}
 
 
+class TestCountSilentOpenPorts:
+    """Unit tests for _count_silent_open_ports()."""
+
+    def _xml(self, ip, port, protocol='tcp', state='open', service_attrs=None):
+        service_elem = ''
+        if service_attrs is not None:
+            attrs = ' '.join(f'{k}="{v}"' for k, v in service_attrs.items())
+            service_elem = f'<service {attrs}/>'
+        return (
+            '<?xml version="1.0"?><nmaprun>'
+            f'<host><address addr="{ip}" addrtype="ipv4"/>'
+            f'<ports><port protocol="{protocol}" portid="{port}">'
+            f'<state state="{state}"/>{service_elem}'
+            '</port></ports></host></nmaprun>'
+        )
+
+    def test_missing_dir_returns_empty(self, tmp_path):
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_no_service_element_at_all_is_silent(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port9999.xml').write_text(self._xml('10.0.0.1', '9999', service_attrs=None))
+        assert _count_silent_open_ports(str(tmp_path)) == {'10.0.0.1': 1}
+
+    def test_service_with_no_name_product_or_fp_is_silent(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.2', '9999', service_attrs={})
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {'10.0.0.2': 1}
+
+    def test_matched_service_not_silent(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.3', '22', service_attrs={'name': 'ssh', 'product': 'OpenSSH'})
+        (nmap_results / 'port22.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_unmatched_fingerprint_not_silent(self, tmp_path):
+        # servicefp means *something* came back -- this is
+        # _count_unmatched_service_ports()'s signal, not this one's.
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.4', '9999', service_attrs={
+            'name': 'unknown', 'servicefp': 'SF-Port9999-TCP:...',
+        })
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_name_only_not_silent(self, tmp_path):
+        # Exactly one of the three attributes present alone must clear the
+        # "silent" bar on its own -- otherwise a single clause in the
+        # `not name and not product and not servicefp` check is never the
+        # deciding factor.
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.7', '9999', service_attrs={'name': 'ssh'})
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_product_only_not_silent(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.8', '9999', service_attrs={'product': 'OpenSSH'})
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_servicefp_only_not_silent(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.9', '9999', service_attrs={'servicefp': 'SF-Port9999-TCP:...'})
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_closed_port_not_counted(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.5', '9999', state='closed', service_attrs=None)
+        (nmap_results / 'port9999.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_udp_files_skipped(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.6', '53', protocol='udp', service_attrs=None)
+        (nmap_results / 'portU_53.xml').write_text(xml)
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_malformed_xml_skipped(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port80.xml').write_text('<nmaprun><host>')
+        assert _count_silent_open_ports(str(tmp_path)) == {}
+
+    def test_multiple_silent_ports_same_host_aggregate(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        for port in ('2222', '3333', '4444'):
+            (nmap_results / f'port{port}.xml').write_text(
+                self._xml('10.0.0.7', port, service_attrs=None))
+        assert _count_silent_open_ports(str(tmp_path)) == {'10.0.0.7': 3}
+
+
+# A stand-in signature table for exercising the generic matching machinery.
+# HONEYPOT_SIGNATURES itself ships EMPTY (see the module comment on it: both
+# development-era entries were verified incorrect against nmap's real output
+# and removed rather than patched), so every test that needs an actual match
+# patches this in. That keeps the extensibility point tested without
+# reintroducing an unverified needle into the shipped table.
+_FAKE_HONEYPOT_SIGNATURES = (
+    ('SpoonmapTestPot 1.0', 'Spoonmap Test Honeypot'),
+    ('SecondTestPot banner', 'Second Test Honeypot'),
+)
+
+
+class TestHoneypotSignatureMatch:
+    """Unit tests for _honeypot_signature_match().
+
+    HONEYPOT_SIGNATURES ships empty, so the shipped behaviour under test is
+    "never matches anything"; the loop body is exercised against
+    _FAKE_HONEYPOT_SIGNATURES instead.
+    """
+
+    def test_shipped_table_is_empty(self):
+        # Pinned deliberately: a future contributor must add a signature only
+        # after verifying it against real -sV output, and re-adding either of
+        # the two removed entries should fail here first.
+        assert HONEYPOT_SIGNATURES == ()
+
+    def test_empty_table_never_matches_anything(self):
+        for text in ('OpenSSH 6.0p1 Debian-4+deb7u2',
+                     '220 Welcome to the ftp service',
+                     'anything at all'):
+            assert _honeypot_signature_match(text) is None
+
+    def test_removed_cowrie_needle_does_not_match_in_either_spelling(self):
+        """Regression: the removed Cowrie/Kippo needle used a hyphen
+        ('Debian-4+deb7u2'); nmap's own nmap-service-probes template renders
+        that banner with a space ('Debian 4+deb7u2'), so the needle could
+        never fire. Neither spelling may match now."""
+        assert _honeypot_signature_match('OpenSSH 6.0p1 Debian-4+deb7u2') is None
+        assert _honeypot_signature_match('OpenSSH 6.0p1 Debian 4+deb7u2') is None
+
+    def test_legitimate_debian_openssh_banner_does_not_match(self):
+        """The worse bug the removal avoids: nmap applies the same
+        space-insertion to every genuine Debian OpenSSH host, so a
+        hyphen-to-space "fix" would have reported HIGH-severity honeypot on
+        one of the most common SSH banners on the internet."""
+        assert _honeypot_signature_match('OpenSSH 9.2p1 Debian 2+deb12u3') is None
+
+    def test_removed_dionaea_needle_does_not_match(self):
+        """Regression: the removed Dionaea needle was an *unrecognised*
+        banner, which nmap records in `servicefp` -- a field
+        _named_honeypot_matches() never reads -- so it could never fire."""
+        assert _honeypot_signature_match('220 Welcome to the ftp service') is None
+
+    def test_unrelated_text_no_match(self):
+        assert _honeypot_signature_match('OpenSSH 9.6p1 Ubuntu') is None
+
+    def test_empty_text_no_match(self):
+        assert _honeypot_signature_match('') is None
+
+    def test_populated_table_matches_and_returns_product(self):
+        """The mechanism is kept as an extensibility point, so it must still
+        work for a future verified entry."""
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert (_honeypot_signature_match('prefix SpoonmapTestPot 1.0 suffix')
+                    == 'Spoonmap Test Honeypot')
+
+    def test_populated_table_second_entry_matches(self):
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert (_honeypot_signature_match('220 SecondTestPot banner ready')
+                    == 'Second Test Honeypot')
+
+    def test_populated_table_still_returns_none_for_unrelated_text(self):
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert _honeypot_signature_match('OpenSSH 9.6p1 Ubuntu') is None
+
+
+class TestNamedHoneypotMatches:
+    """Unit tests for _named_honeypot_matches()."""
+
+    def _xml(self, ip, port, product=None, version=None, extrainfo=None):
+        attrs = []
+        if product is not None:
+            attrs.append(f'product="{product}"')
+        if version is not None:
+            attrs.append(f'version="{version}"')
+        if extrainfo is not None:
+            attrs.append(f'extrainfo="{extrainfo}"')
+        service_elem = f'<service {" ".join(attrs)}/>' if attrs else ''
+        return (
+            '<?xml version="1.0"?><nmaprun>'
+            f'<host><address addr="{ip}" addrtype="ipv4"/>'
+            f'<ports><port protocol="tcp" portid="{port}">'
+            f'<state state="open"/>{service_elem}'
+            '</port></ports></host></nmaprun>'
+        )
+
+    def test_missing_dir_returns_empty(self, tmp_path):
+        assert _named_honeypot_matches(str(tmp_path)) == {}
+
+    def test_shipped_empty_table_matches_nothing(self, tmp_path):
+        """Regression guard for the whole point of the removal: XML that WOULD
+        have matched either removed needle must now produce no match at all,
+        so neither can silently reappear via the finding output."""
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port22.xml').write_text(
+            self._xml('10.0.0.1', '22', product='OpenSSH',
+                      version='6.0p1', extrainfo='Debian 4+deb7u2'))
+        (nmap_results / 'port21.xml').write_text(
+            self._xml('10.0.0.2', '21', product='Welcome to the ftp service'))
+        assert _named_honeypot_matches(str(tmp_path)) == {}
+
+    def test_signature_match_across_product_version_extrainfo(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.1', '22', product='SpoonmapTestPot', version='1.0')
+        (nmap_results / 'port22.xml').write_text(xml)
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert (_named_honeypot_matches(str(tmp_path))
+                    == {'10.0.0.1': 'Spoonmap Test Honeypot'})
+
+    def test_signature_match_only_in_extrainfo(self, tmp_path):
+        """product/version alone don't contain the signature substring — only
+        extrainfo does. Confirms extrainfo is actually consulted, not just
+        accepted as a parameter that's never populated with the needle."""
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.9', '22', product='OpenSSH', version='9.6p1',
+                        extrainfo='SpoonmapTestPot 1.0')
+        (nmap_results / 'port22.xml').write_text(xml)
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert (_named_honeypot_matches(str(tmp_path))
+                    == {'10.0.0.9': 'Spoonmap Test Honeypot'})
+
+    def test_no_service_element_no_match(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port22.xml').write_text(self._xml('10.0.0.2', '22'))
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert _named_honeypot_matches(str(tmp_path)) == {}
+
+    def test_service_element_with_no_attributes_no_match(self, tmp_path):
+        """A <service/> element with none of product/version/extrainfo set
+        joins to an empty string; must be skipped, not passed to the
+        signature matcher."""
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.10" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="22">'
+            '<state state="open"/><service/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (nmap_results / 'port22.xml').write_text(xml)
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert _named_honeypot_matches(str(tmp_path)) == {}
+
+    def test_unrelated_service_no_match(self, tmp_path):
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        xml = self._xml('10.0.0.3', '22', product='OpenSSH', version='9.6p1')
+        (nmap_results / 'port22.xml').write_text(xml)
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert _named_honeypot_matches(str(tmp_path)) == {}
+
+    def test_first_match_wins_per_host(self, tmp_path):
+        """Same host has two ports that would EACH independently match a
+        different signature. _iter_open_tcp_ports() walks nmap_results/*.xml
+        in sorted filename order, so 'port21.xml' is encountered before
+        'port22.xml' and must be the one that wins."""
+        nmap_results = tmp_path / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port21.xml').write_text(
+            self._xml('10.0.0.4', '21', product='SecondTestPot banner'))
+        (nmap_results / 'port22.xml').write_text(
+            self._xml('10.0.0.4', '22', product='SpoonmapTestPot', version='1.0'))
+        with patch('spoonmap.HONEYPOT_SIGNATURES', _FAKE_HONEYPOT_SIGNATURES):
+            assert (_named_honeypot_matches(str(tmp_path))
+                    == {'10.0.0.4': 'Second Test Honeypot'})
+
+
+class TestVncHeraldingMatch:
+    """Unit tests for _vnc_heralding_match()."""
+
+    def _xml(self, ip, port, vnc_info_output):
+        return (
+            '<?xml version="1.0"?><nmaprun>'
+            f'<host><address addr="{ip}" addrtype="ipv4"/>'
+            f'<ports><port protocol="tcp" portid="{port}">'
+            '<state state="open"/>'
+            f'<script id="vnc-info" output="{vnc_info_output}"/>'
+            '</port></ports></host></nmaprun>'
+        )
+
+    def test_missing_dir_returns_empty(self, tmp_path):
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_heralding_shape_matches(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = self._xml('10.0.0.1', '5900', 'Protocol version: 3.7')
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {'10.0.0.1': 'Heralding VNC Honeypot'}
+
+    def test_real_37_server_with_security_types_no_match(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = self._xml('10.0.0.2', '5900',
+                         'Protocol version: 3.7&#10;Security types: &#10;  VNC Authentication (2)')
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_38_server_no_match(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = self._xml('10.0.0.3', '5900', 'Protocol version: 3.8')
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_no_vnc_info_script_no_match(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.4" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="5900">'
+            '<state state="open"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_udp_named_result_file_skipped(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = self._xml('10.0.0.5', '5900', 'Protocol version: 3.7')
+        (nse_results / 'portU_5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_malformed_xml_in_one_file_does_not_block_other_files(self, tmp_path):
+        """A truncated/killed-scan XML file must not raise past the guard and
+        abort the walk for every other result file."""
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        (nse_results / 'port5900.xml').write_text('<nmaprun><host>')
+        xml = self._xml('10.0.0.6', '5901', 'Protocol version: 3.7')
+        (nse_results / 'port5901.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {'10.0.0.6': 'Heralding VNC Honeypot'}
+
+    def test_address_without_addr_attribute_skipped(self, tmp_path):
+        """A bare attrib['addr'] would raise KeyError, which `except
+        etree.ParseError` does not catch."""
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="5900">'
+            '<state state="open"/>'
+            '<script id="vnc-info" output="Protocol version: 3.7"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+    def test_mac_only_address_skipped(self, tmp_path):
+        nse_results = tmp_path / 'nse_results'
+        nse_results.mkdir()
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="AA:BB:CC:DD:EE:FF" addrtype="mac"/>'
+            '<ports><port protocol="tcp" portid="5900">'
+            '<state state="open"/>'
+            '<script id="vnc-info" output="Protocol version: 3.7"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (nse_results / 'port5900.xml').write_text(xml)
+        assert _vnc_heralding_match(str(tmp_path)) == {}
+
+
+class TestHoneypotSeverity:
+    """Unit tests for _honeypot_severity()."""
+
+    def test_no_signals_no_match_no_confirm_returns_none(self):
+        assert _honeypot_severity(set()) is None
+
+    def test_single_heuristic_signal_is_low(self):
+        assert _honeypot_severity({'ratio'}) == 'LOW'
+
+    def test_two_heuristic_signals_is_medium(self):
+        assert _honeypot_severity({'ratio', 'unmatched_fp'}) == 'MEDIUM'
+
+    def test_ttl_spread_alone_is_low_never_high(self):
+        assert _honeypot_severity({'ttl_spread'}) == 'LOW'
+
+    def test_ttl_spread_plus_one_other_is_medium_not_high(self):
+        assert _honeypot_severity({'ttl_spread', 'port_profile'}) == 'MEDIUM'
+
+    def test_named_match_alone_is_high(self):
+        assert _honeypot_severity(set(), named_match=True) == 'HIGH'
+
+    def test_confirmed_alone_is_high(self):
+        assert _honeypot_severity(set(), confirmed=True) == 'HIGH'
+
+    def test_named_match_overrides_signal_count(self):
+        assert _honeypot_severity({'ratio', 'unmatched_fp'}, named_match=True) == 'HIGH'
+
+
 class TestGenerateFindingsHoneypot:
     """generate_findings() 'Likely Honeypot / Decoy Host' finding."""
 
@@ -2154,12 +2586,15 @@ def _unmatched_xml(self, ip, port):
         )
 
     def test_tarpit_file_flags_host(self, nmap_dir):
+        # A single heuristic signal is now LOW, not MEDIUM -- see
+        # _honeypot_severity() and TestHoneypotSeverity. Two-plus signals
+        # (test_both_signals_combine_in_one_finding, below) still reach MEDIUM.
         (nmap_dir / 'discovery').mkdir(exist_ok=True)
         (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.1,19,20\n')
         generate_findings(str(nmap_dir), 'Internal')
         records = json.loads((nmap_dir / 'findings.json').read_text())
         hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
-        assert hp and hp[0]['severity'] == 'MEDIUM'
+        assert hp and hp[0]['severity'] == 'LOW'
         assert hp[0]['host'] == '10.0.0.1'
         assert '19/20' in hp[0]['detail']
 
@@ -2195,6 +2630,7 @@ def test_both_signals_combine_in_one_finding(self, nmap_dir):
         records = json.loads((nmap_dir / 'findings.json').read_text())
         hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
         assert len(hp) == 1
+        assert hp[0]['severity'] == 'MEDIUM'
         assert '20/20' in hp[0]['detail']
         assert 'no known service signature' in hp[0]['detail']
 
@@ -2224,6 +2660,237 @@ def test_absent_tarpit_file_no_crash(self, nmap_dir):
         records = json.loads((nmap_dir / 'findings.json').read_text())
         assert not [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
 
+    def test_silent_open_ports_flag_host(self, nmap_dir):
+        nmap_results = nmap_dir / 'nmap_results'
+        nmap_results.mkdir()
+        for port in ('2222', '3333', '4444'):
+            xml = (
+                '<?xml version="1.0"?><nmaprun>'
+                f'<host><address addr="10.0.0.20" addrtype="ipv4"/>'
+                f'<ports><port protocol="tcp" portid="{port}">'
+                '<state state="open"/>'
+                '</port></ports></host></nmaprun>'
+            )
+            (nmap_results / f'port{port}.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['host'] == '10.0.0.20'
+        assert 'returned no data at all' in hp[0]['detail']
+        assert hp[0]['severity'] == 'LOW'
+
+    def test_suspected_honeypots_file_ttl_spread_flags_host(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').write_text(
+            '10.0.0.21,ttl_spread,64|128\n')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['host'] == '10.0.0.21'
+        assert hp[0]['severity'] == 'LOW'
+        assert 'inconsistent TTLs' in hp[0]['detail']
+
+    def test_suspected_honeypots_file_port_profile_flags_host(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').write_text(
+            '10.0.0.22,port_profile,Thinkst Canary\n')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['host'] == '10.0.0.22'
+        assert 'Thinkst Canary' in hp[0]['detail']
+
+    def test_named_signature_match_is_high_severity(self, nmap_dir):
+        """The named-match-is-HIGH path, exercised through the only named
+        signature this release ships: the source-verified Heralding VNC tell
+        (vnc-info reporting RFB 3.7 with no security-type list). This test used
+        to drive the same path via a HONEYPOT_SIGNATURES entry; that table now
+        ships empty, so Heralding is the real-world route into this branch."""
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.23" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="5900">'
+            '<state state="open"/>'
+            '<script id="vnc-info" output="Protocol version: 3.7"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (nmap_dir / 'nse_results' / 'port5900.xml').write_text(xml)
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['severity'] == 'HIGH'
+        assert 'Heralding VNC Honeypot' in hp[0]['detail']
+
+    def test_removed_signatures_produce_no_named_match_finding(self, nmap_dir):
+        """End-to-end regression for the dropped placeholders: -sV output that
+        would have matched the removed Cowrie/Kippo or Dionaea needles must
+        produce no named match, and in particular must not reach HIGH.
+
+        The Cowrie case doubles as the false-positive guard -- this is exactly
+        what a legitimate, unmodified Debian OpenSSH host looks like after
+        nmap's own space-insertion, and a hyphen-to-space "fix" of that needle
+        would have flagged every one of them HIGH."""
+        nmap_results = nmap_dir / 'nmap_results'
+        nmap_results.mkdir()
+        (nmap_results / 'port22.xml').write_text(
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.23" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="22">'
+            '<state state="open"/>'
+            '<service product="OpenSSH" version="6.0p1" extrainfo="Debian 4+deb7u2"/>'
+            '</port></ports></host></nmaprun>')
+        (nmap_results / 'port21.xml').write_text(
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.26" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="21">'
+            '<state state="open"/>'
+            '<service product="Welcome to the ftp service"/>'
+            '</port></ports></host></nmaprun>')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp == []
+
+    def test_confirmed_honeypot_is_high_severity(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'confirmed_honeypots.txt').write_text('10.0.0.24\n')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['severity'] == 'HIGH'
+        assert 'active confirmation probe' in hp[0]['detail']
+
+    def test_all_signals_combine_into_one_finding(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.25,20,20\n')
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').write_text(
+            '10.0.0.25,ttl_spread,64|128\n')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert len(hp) == 1
+        assert hp[0]['severity'] == 'MEDIUM'
+        assert '20/20' in hp[0]['detail']
+        assert 'inconsistent TTLs' in hp[0]['detail']
+
+    def test_unreadable_suspected_honeypots_file_degrades_to_no_data(self, nmap_dir):
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').mkdir(parents=True)
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        assert not [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+
+    def test_unreadable_confirmed_honeypots_file_degrades_to_no_data(self, nmap_dir):
+        (nmap_dir / 'discovery' / 'confirmed_honeypots.txt').mkdir(parents=True)
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        assert not [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+
+    # ── directory-walk helper failures must degrade one signal, not the whole
+    #    findings phase (nmap_results/ or nse_results/ left root-owned by an
+    #    earlier sudo run, then read by a later non-root --resume) ────────────
+
+    def test_unmatched_service_ports_helper_oserror_degrades(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.30,19,20\n')
+        with patch('spoonmap._count_unmatched_service_ports', side_effect=OSError('perm')):
+            generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert [r['host'] for r in hp] == ['10.0.0.30']
+        assert hp[0]['severity'] == 'LOW'
+
+    def test_silent_open_ports_helper_oserror_degrades(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.31,19,20\n')
+        with patch('spoonmap._count_silent_open_ports', side_effect=OSError('perm')):
+            generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert [r['host'] for r in hp] == ['10.0.0.31']
+        assert hp[0]['severity'] == 'LOW'
+
+    def test_named_honeypot_matches_helper_oserror_degrades(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.32,19,20\n')
+        with patch('spoonmap._named_honeypot_matches', side_effect=OSError('perm')):
+            generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert [r['host'] for r in hp] == ['10.0.0.32']
+        assert hp[0]['severity'] == 'LOW'
+
+    def test_vnc_heralding_match_helper_oserror_degrades(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.33,19,20\n')
+        with patch('spoonmap._vnc_heralding_match', side_effect=OSError('perm')):
+            generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert [r['host'] for r in hp] == ['10.0.0.33']
+        assert hp[0]['severity'] == 'LOW'
+
+    def test_named_match_with_empty_product_still_flags_host(self, nmap_dir):
+        # A future HONEYPOT_SIGNATURES edit could resolve to an empty/falsy
+        # product string; presence in named_matches, not truthiness, must
+        # decide whether the host is flagged.
+        with patch('spoonmap._named_honeypot_matches', return_value={'10.0.0.77': ''}):
+            generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert hp and hp[0]['host'] == '10.0.0.77'
+        assert hp[0]['severity'] == 'HIGH'
+
+    def test_all_eight_signal_sources_combine_into_one_high_finding(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.99,20,20\n')
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').write_text(
+            '10.0.0.99,ttl_spread,64|128\n')
+        (nmap_dir / 'discovery' / 'confirmed_honeypots.txt').write_text('10.0.0.99\n')
+        nmap_results = nmap_dir / 'nmap_results'
+        nmap_results.mkdir()
+        # The named-match signal now comes from the Heralding VNC tell, the
+        # only named signature this release ships (HONEYPOT_SIGNATURES is
+        # empty); it reads nse_results/, not nmap_results/.
+        product = 'Heralding VNC Honeypot'
+        (nmap_dir / 'nse_results' / 'port5900.xml').write_text(
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.99" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="5900">'
+            '<state state="open"/>'
+            '<script id="vnc-info" output="Protocol version: 3.7"/>'
+            '</port></ports></host></nmaprun>')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = [r for r in records if r['title'] == 'Likely Honeypot / Decoy Host']
+        assert len(hp) == 1
+        assert hp[0]['host'] == '10.0.0.99'
+        assert hp[0]['severity'] == 'HIGH'
+        detail = hp[0]['detail']
+        assert product in detail
+        assert '20/20' in detail
+        assert 'inconsistent TTLs' in detail
+        assert 'active confirmation probe' in detail
+        # Named-signature reason is inserted first, confirmed-probe reason is
+        # appended last -- heuristic reasons (ratio, ttl_spread) land in between
+        # in the order their signal sources were checked.
+        assert (detail.index(product) < detail.index('20/20')
+                < detail.index('inconsistent TTLs')
+                < detail.index('active confirmation probe'))
+
+    def test_two_hosts_each_flagged_by_different_single_signal_independently(self, nmap_dir):
+        (nmap_dir / 'discovery').mkdir(exist_ok=True)
+        (nmap_dir / 'discovery' / 'suspected_tarpits.txt').write_text('10.0.0.40,19,20\n')
+        (nmap_dir / 'discovery' / 'suspected_honeypots.txt').write_text(
+            '10.0.0.41,ttl_spread,64|128\n')
+        generate_findings(str(nmap_dir), 'Internal')
+        records = json.loads((nmap_dir / 'findings.json').read_text())
+        hp = {r['host']: r for r in records if r['title'] == 'Likely Honeypot / Decoy Host'}
+        assert set(hp) == {'10.0.0.40', '10.0.0.41'}
+        assert hp['10.0.0.40']['severity'] == 'LOW'
+        assert '19/20' in hp['10.0.0.40']['detail']
+        assert hp['10.0.0.41']['severity'] == 'LOW'
+        assert 'inconsistent TTLs' in hp['10.0.0.41']['detail']
+
 
 # ── _previous_results_exist / _delete_previous_results ───────────────────────
 
@@ -2622,6 +3289,70 @@ def test_full_scan_resume_normalises_udp_port_key(self, tmp_path):
         assert 'Hosts Found on Port U_53' not in result
         assert not (disc / 'suspected_tarpits.txt').exists()
 
+    def test_full_scan_flags_suspected_honeypot_port_profile(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        canary_ports = list(HONEYPOT_PORT_PROFILES['Thinkst Canary'])
+        fake_results = {p: {'10.0.0.9'} for p in canary_ports}
+        # Also seed a two-TTL-value XML in discovery/masscan_results/ so this
+        # test exercises the masscan_dir path passed to _flag_honeypot_signals
+        # at this call site, not just the in-memory port_profile signal.
+        disc = tmp_path / 'discovery'
+        (disc / 'masscan_results').mkdir(parents=True)
+        ttl_xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.9"/>'
+            '<ports>'
+            '<port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="64"/></port>'
+            '<port protocol="tcp" portid="80">'
+            '<state state="open" reason="syn-ack" reason_ttl="128"/></port>'
+            '</ports></host></nmaprun>'
+        )
+        (disc / 'masscan_results' / 'port_probe.xml').write_text(ttl_xml)
+        with patch('spoonmap._run_masscan_batch', return_value=fake_results):
+            mass_scan('Full', ['1-65535'], '53', '10000', '/fake/targets.txt', '')
+        honeypot_file = tmp_path / 'discovery' / 'suspected_honeypots.txt'
+        assert honeypot_file.exists()
+        contents = honeypot_file.read_text()
+        assert '10.0.0.9,port_profile,Thinkst Canary' in contents
+        assert '10.0.0.9,ttl_spread,64|128' in contents
+
+    def test_full_scan_resume_flags_suspected_honeypot_ttl_spread(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        disc = tmp_path / 'discovery'
+        (disc / 'masscan_results').mkdir(parents=True)
+        live_dir = disc / 'live_hosts'
+        live_dir.mkdir(parents=True)
+        targets = disc / 'resolved_targets.txt'
+        targets.write_text('10.0.0.0/24\n')
+        cached = disc / 'masscan_results' / 'portFull.xml'
+        cached.write_text('<nmaprun/>')
+        _write_target_stamp(cached, targets)
+        (live_dir / 'port22.txt').write_text('10.0.0.9\n')
+        (live_dir / 'port80.txt').write_text('10.0.0.9\n')
+        # The resume path reads TTL spread back from masscan_results' own XML,
+        # not from live_hosts/ — seed a probe-style file alongside the cache.
+        ttl_xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.9"/>'
+            '<ports>'
+            '<port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="64"/></port>'
+            '<port protocol="tcp" portid="80">'
+            '<state state="open" reason="syn-ack" reason_ttl="128"/></port>'
+            '</ports></host></nmaprun>'
+        )
+        (disc / 'masscan_results' / 'port_probe.xml').write_text(ttl_xml)
+
+        with patch('spoonmap._run_masscan_batch') as mock_batch:
+            mass_scan('Full', ['1-65535'], '53', '10000',
+                      str(targets), '', resume=True)
+
+        assert not mock_batch.called
+        honeypot_file = disc / 'suspected_honeypots.txt'
+        assert honeypot_file.exists()
+        assert '10.0.0.9,ttl_spread,64|128' in honeypot_file.read_text()
+
     def _setup_full_resume_cache(self, tmp_path, xml_text):
         spoonmap.output_path = str(tmp_path)
         disc = tmp_path / 'discovery'
@@ -2716,6 +3447,119 @@ def test_batch_scan_no_tarpit_flag_for_realistic_open_count(self, tmp_path):
         assert not (tmp_path / 'discovery' / 'suspected_tarpits.txt').exists()
 
 
+class TestMassScanHoneypotFlag:
+    """mass_scan() batch-path wiring of the suspected-honeypot check (non-Full scans)."""
+
+    def test_batch_scan_flags_suspected_honeypot_port_profile(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        canary_ports = list(HONEYPOT_PORT_PROFILES['Thinkst Canary'])
+        fast_response = {p: {'10.0.0.9'} for p in canary_ports}
+        # Also seed a two-TTL-value XML in discovery/masscan_results/ so this
+        # test exercises the masscan_dir path passed to _flag_honeypot_signals
+        # at this call site, not just the in-memory port_profile signal.
+        disc = tmp_path / 'discovery'
+        (disc / 'masscan_results').mkdir(parents=True)
+        ttl_xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.9"/>'
+            '<ports>'
+            '<port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="64"/></port>'
+            '<port protocol="tcp" portid="80">'
+            '<state state="open" reason="syn-ack" reason_ttl="128"/></port>'
+            '</ports></host></nmaprun>'
+        )
+        (disc / 'masscan_results' / 'port_probe.xml').write_text(ttl_xml)
+        # 445 is a member of the Canary profile and is in SLOW_PORTS (always
+        # solo-scanned), which adds calls beyond a fixed fast/slow probe pair
+        # — return_value covers every call regardless of count.
+        with patch('spoonmap._run_masscan_batch', return_value=fast_response):
+            mass_scan('All', canary_ports, '88', '1000',
+                      '/fake/targets.txt', '', batch_size=len(canary_ports))
+        honeypot_file = tmp_path / 'discovery' / 'suspected_honeypots.txt'
+        assert honeypot_file.exists()
+        contents = honeypot_file.read_text()
+        assert '10.0.0.9,port_profile,Thinkst Canary' in contents
+        assert '10.0.0.9,ttl_spread,64|128' in contents
+
+    def test_batch_scan_no_honeypot_flag_for_unrelated_ports(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        tcp_ports = ['9001', '9002', '9003']
+        fast_response = {p: {'10.0.0.9'} for p in tcp_ports}
+        with patch('spoonmap._run_masscan_batch', side_effect=[fast_response, {}]):
+            mass_scan('All', tcp_ports, '88', '1000',
+                      '/fake/targets.txt', '', batch_size=len(tcp_ports))
+        # The file is now written unconditionally so a stale run's lines cannot
+        # keep inflating severity -- "no flag" means empty, not absent.
+        assert (tmp_path / 'discovery' / 'suspected_honeypots.txt').read_text() == ''
+
+
+class TestConfirmFlaggedHoneypotsWiring:
+    """mass_scan()'s three call sites must actually invoke
+    _confirm_flagged_honeypots() with honeypot_active_confirm threaded
+    through, for both True and False. Deleting any of the three calls, or
+    hardcoding False in place of the parameter, previously left the full
+    suite passing — nothing referenced _confirm_flagged_honeypots or
+    honeypot_active_confirm by name."""
+
+    def test_full_scan_batched_path_calls_confirm_with_flag(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        fake_results = {'22': {'10.0.0.1'}}
+        with patch('spoonmap._run_masscan_batch', return_value=fake_results), \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('Full', ['1-65535'], '88', '2000', '/fake/targets.txt', '',
+                      honeypot_active_confirm=True)
+        mock_confirm.assert_called_once()
+        args = mock_confirm.call_args[0]
+        assert args[1] is True  # honeypot_active_confirm threaded through
+        assert args[2] == ['1-65535']  # dest_ports
+
+    def test_full_scan_batched_path_passes_false_by_default(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        fake_results = {'22': {'10.0.0.1'}}
+        with patch('spoonmap._run_masscan_batch', return_value=fake_results), \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('Full', ['1-65535'], '88', '2000', '/fake/targets.txt', '')
+        mock_confirm.assert_called_once()
+        assert mock_confirm.call_args[0][1] is False
+
+    def test_full_scan_resume_path_calls_confirm_with_flag(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        disc = tmp_path / 'discovery'
+        (disc / 'masscan_results').mkdir(parents=True)
+        (disc / 'live_hosts').mkdir(parents=True)
+        targets = disc / 'resolved_targets.txt'
+        targets.write_text('10.0.0.0/24\n')
+        cached = disc / 'masscan_results' / 'portFull.xml'
+        cached.write_text('<nmaprun/>')
+        _write_target_stamp(cached, targets)
+        (disc / 'live_hosts' / 'port22.txt').write_text('10.0.0.1\n')
+
+        with patch('spoonmap._run_masscan_batch') as mock_batch, \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('Full', ['1-65535'], '53', '10000', str(targets), '',
+                      resume=True, honeypot_active_confirm=True)
+
+        assert not mock_batch.called
+        mock_confirm.assert_called_once()
+        args = mock_confirm.call_args[0]
+        assert args[1] is True
+        assert args[2] == ['1-65535']
+
+    def test_batch_loop_path_calls_confirm_with_flag(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        tcp_ports = ['9001', '9002', '9003']
+        fast_response = {p: {'10.0.0.9'} for p in tcp_ports}
+        with patch('spoonmap._run_masscan_batch', side_effect=[fast_response, {}]), \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('All', tcp_ports, '88', '1000', '/fake/targets.txt', '',
+                      batch_size=len(tcp_ports), honeypot_active_confirm=True)
+        mock_confirm.assert_called_once()
+        args = mock_confirm.call_args[0]
+        assert args[1] is True
+        assert args[2] == tcp_ports
+
+
 # ── _load_config ──────────────────────────────────────────────────────────────
 
 def _config_dict(**overrides):
@@ -9315,6 +10159,654 @@ def test_failed_write_keeps_previous_file_intact(self, tmp_path):
         assert [p.name for p in tmp_path.iterdir()] == ['suspected_tarpits.txt']
 
 
+class TestTtlSpreadByHost:
+    """Unit tests for _ttl_spread_by_host()."""
+
+    def _masscan_xml(self, ip, port, reason_ttl, protocol='tcp'):
+        return (
+            '<?xml version="1.0"?><nmaprun>'
+            f'<host><address addr="{ip}" addrtype="ipv4"/>'
+            f'<ports><port protocol="{protocol}" portid="{port}">'
+            f'<state state="open" reason="syn-ack" reason_ttl="{reason_ttl}"/>'
+            '</port></ports></host></nmaprun>'
+        )
+
+    def test_missing_dir_returns_empty(self, tmp_path):
+        assert _ttl_spread_by_host(str(tmp_path / 'nope')) == {}
+
+    def test_consistent_ttl_not_flagged(self, tmp_path):
+        (tmp_path / 'port22.xml').write_text(self._masscan_xml('10.0.0.1', '22', 64))
+        (tmp_path / 'port80.xml').write_text(self._masscan_xml('10.0.0.1', '80', 64))
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_inconsistent_ttl_flagged_sorted(self, tmp_path):
+        (tmp_path / 'port22.xml').write_text(self._masscan_xml('10.0.0.2', '22', 128))
+        (tmp_path / 'port80.xml').write_text(self._masscan_xml('10.0.0.2', '80', 64))
+        assert _ttl_spread_by_host(str(tmp_path)) == {'10.0.0.2': [64, 128]}
+
+    def test_single_port_never_flagged(self, tmp_path):
+        (tmp_path / 'port22.xml').write_text(self._masscan_xml('10.0.0.3', '22', 64))
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_udp_ports_ignored(self, tmp_path):
+        (tmp_path / 'port22.xml').write_text(self._masscan_xml('10.0.0.4', '22', 64))
+        (tmp_path / 'portU_53.xml').write_text(
+            self._masscan_xml('10.0.0.4', '53', 200, protocol='udp'))
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_malformed_xml_skipped(self, tmp_path):
+        (tmp_path / 'port80.xml').write_text('<nmaprun><host>')
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_host_without_ipv4_address_skipped(self, tmp_path):
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="00:11:22:33:44:55" addrtype="mac"/>'
+            '<ports><port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="64"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (tmp_path / 'port22.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_non_numeric_ttl_skipped(self, tmp_path):
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addr="10.0.0.5" addrtype="ipv4"/>'
+            '<ports><port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="not-a-number"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (tmp_path / 'port22.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_host_without_ports_element_skipped(self, tmp_path):
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.6"/></host>'
+            '</nmaprun>'
+        )
+        (tmp_path / 'port22.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_port_without_state_element_skipped(self, tmp_path):
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.7"/>'
+            '<ports><port protocol="tcp" portid="22"/></ports></host>'
+            '</nmaprun>'
+        )
+        (tmp_path / 'port22.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_state_without_reason_ttl_skipped(self, tmp_path):
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.8"/>'
+            '<ports><port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack"/>'
+            '</port></ports></host></nmaprun>'
+        )
+        (tmp_path / 'port22.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {}
+
+    def test_multi_port_single_host_ignores_only_udp_port(self, tmp_path):
+        """nmap-style XML: one <host> holding every port in one <ports> block.
+
+        Masscan's own XML gives one <host> per open port, so the pre-fix code
+        (which only ever read the first <port> child) happened to work there.
+        _nmap_port_discovery() writes masscan_results/portDirect.xml in this
+        multi-port-per-host shape instead, and a UDP-first port there used to
+        make the function bail before looking at any of the host's other,
+        TCP, ports.
+        """
+        xml = (
+            '<?xml version="1.0"?><nmaprun>'
+            '<host><address addrtype="ipv4" addr="10.0.0.9"/>'
+            '<ports>'
+            '<port protocol="udp" portid="53">'
+            '<state state="open" reason="udp-response" reason_ttl="200"/></port>'
+            '<port protocol="tcp" portid="22">'
+            '<state state="open" reason="syn-ack" reason_ttl="64"/></port>'
+            '<port protocol="tcp" portid="80">'
+            '<state state="open" reason="syn-ack" reason_ttl="128"/></port>'
+            '</ports></host></nmaprun>'
+        )
+        (tmp_path / 'portDirect.xml').write_text(xml)
+        assert _ttl_spread_by_host(str(tmp_path)) == {'10.0.0.9': [64, 128]}
+
+
+class TestPortProfileMatch:
+    """Unit tests for _port_profile_match()."""
+
+    def test_exact_profile_match(self):
+        profile = next(iter(HONEYPOT_PORT_PROFILES.values()))
+        assert _port_profile_match(profile) is not None
+
+    def test_superset_still_matches(self):
+        profile = next(iter(HONEYPOT_PORT_PROFILES.values()))
+        assert _port_profile_match(profile | {'54321'}) is not None
+
+    def test_subset_does_not_match(self):
+        profile = next(iter(HONEYPOT_PORT_PROFILES.values()))
+        partial = set(list(profile)[:-1]) if len(profile) > 1 else set()
+        assert _port_profile_match(partial) is None
+
+    def test_unrelated_ports_no_match(self):
+        assert _port_profile_match({'12345'}) is None
+
+    def test_empty_ports_no_match(self):
+        assert _port_profile_match(set()) is None
+
+
+class TestFlagHoneypotSignals:
+    """Unit tests for _flag_honeypot_signals()."""
+
+    def _masscan_xml(self, ip, port, reason_ttl):
+        return (
+            '<?xml version="1.0"?><nmaprun>'
+            f'<host><address addr="{ip}" addrtype="ipv4"/>'
+            f'<ports><port protocol="tcp" portid="{port}">'
+            f'<state state="open" reason="syn-ack" reason_ttl="{reason_ttl}"/>'
+            '</port></ports></host></nmaprun>'
+        )
+
+    def test_ttl_spread_flagged(self, tmp_path):
+        (tmp_path / 'port22.xml').write_text(self._masscan_xml('10.0.0.1', '22', 64))
+        (tmp_path / 'port80.xml').write_text(self._masscan_xml('10.0.0.1', '80', 128))
+        port_ips = {'22': {'10.0.0.1'}, '80': {'10.0.0.1'}}
+        result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert result['10.0.0.1']['ttl_spread'] == [64, 128]
+
+    def test_port_profile_flagged(self, tmp_path):
+        profile = next(iter(HONEYPOT_PORT_PROFILES.items()))
+        name, ports = profile
+        port_ips = {p: {'10.0.0.2'} for p in ports}
+        result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert result['10.0.0.2']['port_profile'] == name
+
+    def test_udp_ports_excluded_from_profile_match(self, tmp_path):
+        port_ips = {'U:22': {'10.0.0.3'}, 'U:80': {'10.0.0.3'}}
+        result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert '10.0.0.3' not in result
+
+    def test_no_signals_no_entry(self, tmp_path):
+        port_ips = {'22': {'10.0.0.4'}}
+        result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert result == {}
+
+    def test_ttl_spread_oserror_degrades_to_no_ttl_signal(self, tmp_path):
+        """masscan_results/ left root-owned by an earlier sudo run and read
+        back by a later non-root --resume. This runs near the END of
+        mass_scan(), after every batch has completed, so an escaping OSError
+        would unwind mass_scan() and main() and discard a finished scan's whole
+        aggregation over an advisory heuristic."""
+        with patch('spoonmap._ttl_spread_by_host', side_effect=OSError('perm')):
+            result = _flag_honeypot_signals({'22': {'10.0.0.1'}}, str(tmp_path))
+        assert result == {}
+
+    def test_ttl_spread_oserror_keeps_port_profile_signal(self, tmp_path):
+        """Only the TTL half degrades: the port-profile half reads in-memory
+        data and must still be reported."""
+        name, ports = next(iter(HONEYPOT_PORT_PROFILES.items()))
+        port_ips = {p: {'10.0.0.2'} for p in ports}
+        with patch('spoonmap._ttl_spread_by_host', side_effect=OSError('perm')):
+            result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert result['10.0.0.2'] == {'port_profile': name}
+
+    def test_unreadable_masscan_dir_does_not_raise(self, tmp_path):
+        """End-to-end version of the above with a real unreadable directory
+        rather than a patched helper (skipped as root, which ignores mode)."""
+        if os.geteuid() == 0:
+            pytest.skip('root bypasses directory permissions')
+        locked = tmp_path / 'masscan_results'
+        locked.mkdir()
+        locked.chmod(0o000)
+        try:
+            assert _flag_honeypot_signals({'22': {'10.0.0.1'}}, str(locked)) == {}
+        finally:
+            locked.chmod(0o755)
+
+    def test_both_signals_combine_for_same_host(self, tmp_path):
+        name, ports = next(iter(HONEYPOT_PORT_PROFILES.items()))
+        ports = list(ports)
+        (tmp_path / f'port{ports[0]}.xml').write_text(
+            self._masscan_xml('10.0.0.5', ports[0], 64))
+        (tmp_path / f'port{ports[1]}.xml').write_text(
+            self._masscan_xml('10.0.0.5', ports[1], 128))
+        port_ips = {p: {'10.0.0.5'} for p in ports}
+        result = _flag_honeypot_signals(port_ips, str(tmp_path))
+        assert result['10.0.0.5']['ttl_spread'] == [64, 128]
+        assert result['10.0.0.5']['port_profile'] == name
+
+
+class TestReportSuspectedHoneypots:
+    """Unit tests for _report_suspected_honeypots()."""
+
+    def test_writes_ttl_spread_line_and_warns(self, tmp_path, capsys):
+        flagged = {'10.0.0.1': {'ttl_spread': [64, 128]}}
+        _report_suspected_honeypots(flagged, str(tmp_path))
+        content = (tmp_path / 'suspected_honeypots.txt').read_text()
+        assert '10.0.0.1,ttl_spread,64|128' in content
+        out = capsys.readouterr().out
+        assert '10.0.0.1' in out
+
+    def test_writes_port_profile_line(self, tmp_path):
+        flagged = {'10.0.0.2': {'port_profile': 'Thinkst Canary'}}
+        _report_suspected_honeypots(flagged, str(tmp_path))
+        content = (tmp_path / 'suspected_honeypots.txt').read_text()
+        assert '10.0.0.2,port_profile,Thinkst Canary' in content
+
+    def test_both_signals_write_two_lines(self, tmp_path):
+        flagged = {'10.0.0.3': {'ttl_spread': [64, 128], 'port_profile': 'Artillery'}}
+        _report_suspected_honeypots(flagged, str(tmp_path))
+        content = (tmp_path / 'suspected_honeypots.txt').read_text()
+        assert content.count('10.0.0.3,') == 2
+
+    def test_empty_flagged_truncates_the_file(self, tmp_path):
+        """Deliberate divergence from _report_suspected_tarpits(), which still
+        early-returns on empty input. generate_findings() now COUNTS signals to
+        pick HIGH/MEDIUM/LOW, so a stale line from an earlier, broader run
+        inflates a later, narrower run's severity. Writing unconditionally is
+        the only thing that makes a signal which stopped firing stop scoring."""
+        stale = tmp_path / 'suspected_honeypots.txt'
+        stale.write_text('10.9.9.9,ttl_spread,64|128\n')
+        _report_suspected_honeypots({}, str(tmp_path))
+        assert stale.exists()
+        assert stale.read_text() == ''
+
+    def test_empty_flagged_prints_no_warning(self, tmp_path, capsys):
+        """Only the file write became unconditional; stdout stays quiet."""
+        _report_suspected_honeypots({}, str(tmp_path))
+        assert capsys.readouterr().out == ''
+
+
+class TestExpandScannedPorts:
+    """Unit tests for _expand_scanned_ports()."""
+
+    def test_individual_ports_become_ints(self):
+        assert _expand_scanned_ports(['80', '443']) == {80, 443}
+
+    def test_range_expands_to_every_covered_int(self):
+        assert _expand_scanned_ports(['49152-49155']) == {49152, 49153, 49154, 49155}
+
+    def test_full_scan_range_covers_entire_ephemeral_range(self):
+        expanded = _expand_scanned_ports(['1-65535'])
+        assert set(range(49152, 65536)) <= expanded
+
+    def test_mixed_individual_and_range_entries(self):
+        expanded = _expand_scanned_ports(['80', '49152-49153'])
+        assert expanded == {80, 49152, 49153}
+
+    @pytest.mark.parametrize('token', ['80-', 'http', '8O80', '80/tcp'])
+    def test_malformed_token_is_skipped_not_raised(self, token):
+        # dest_ports is unvalidated operator input (interactive Custom list
+        # or a raw config.json value) — a malformed token must be skipped,
+        # not raise, since this runs ahead of the honeypot-probe enabled
+        # check and an unhandled ValueError here would discard a completed
+        # scan's aggregation even when the probe feature is off.
+        assert _expand_scanned_ports([token]) == set()
+
+    def test_malformed_token_alongside_valid_entries_keeps_valid_ones(self):
+        expanded = _expand_scanned_ports(['80', 'http', '443'])
+        assert expanded == {80, 443}
+
+    def test_huge_range_span_is_skipped_not_materialized(self):
+        # A span above _EXPAND_SCANNED_PORTS_MAX_SPAN must not be expanded
+        # into a giant set — skip it instead of attempting to build one.
+        assert _expand_scanned_ports(['1-4294967295']) == set()
+
+    def test_range_span_at_cap_boundary_is_expanded(self):
+        # A span exactly at the cap is still a legitimate range and must
+        # expand normally.
+        expanded = _expand_scanned_ports(['1-100000'])
+        assert len(expanded) == 100000
+
+    def test_inverted_range_is_skipped(self):
+        assert _expand_scanned_ports(['100-1']) == set()
+
+
+class TestSelectConfirmProbePorts:
+    """Unit tests for _select_confirm_probe_ports()."""
+
+    def test_returns_requested_count(self):
+        ports = _select_confirm_probe_ports('10.0.0.1', [], count=3)
+        assert len(ports) == 3
+
+    def test_ports_are_in_ephemeral_range(self):
+        ports = _select_confirm_probe_ports('10.0.0.1', [], count=5)
+        assert all(49152 <= int(p) <= 65535 for p in ports)
+
+    def test_excludes_scanned_ports(self):
+        scanned = [str(p) for p in range(49152, 49152 + 100)]
+        ports = _select_confirm_probe_ports('10.0.0.1', scanned, count=3)
+        assert not (set(ports) & set(scanned))
+
+    def test_deterministic_for_same_ip(self):
+        a = _select_confirm_probe_ports('10.0.0.1', [], count=3)
+        b = _select_confirm_probe_ports('10.0.0.1', [], count=3)
+        assert a == b
+
+    def test_different_ips_can_differ(self):
+        a = _select_confirm_probe_ports('10.0.0.1', [], count=3)
+        b = _select_confirm_probe_ports('10.0.0.2', [], count=3)
+        assert a != b
+
+    def test_udp_scanned_ports_do_not_shrink_candidate_pool(self):
+        # 'U:49200'-style keys must not be compared against bare int ports.
+        # They're filtered out by _select_confirm_probe_ports() before
+        # reaching _expand_scanned_ports() (which would otherwise just
+        # skip the unparseable 'U:NNNN' token rather than raise).
+        scanned = [f'U:{p}' for p in range(49152, 49200)]
+        ports = _select_confirm_probe_ports('10.0.0.1', scanned, count=3)
+        assert len(ports) == 3
+
+    def test_malformed_token_alongside_valid_entries_still_yields_result(self):
+        # A garbage token mixed in with real dest_ports entries must not
+        # crash _select_confirm_probe_ports(); it's simply skipped as
+        # "not confirmed scanned", which can only shrink the pool.
+        scanned = ['80', '80-', 'http', '443']
+        ports = _select_confirm_probe_ports('10.0.0.1', scanned, count=3)
+        assert len(ports) == 3
+        assert not (set(ports) & {'80', '443'})
+
+    def test_full_scan_range_spec_excludes_entire_ephemeral_range(self):
+        # dest_ports=['1-65535'] (a Full scan) scanned every port, including
+        # all of 49152-65535 — a literal string comparison ('64835' not in
+        # {'1-65535'}) would never exclude any of them, so this must find
+        # zero candidates rather than treating the range as unscanned.
+        ports = _select_confirm_probe_ports('10.0.0.1', ['1-65535'], count=3)
+        assert ports == []
+
+    def test_custom_ephemeral_range_spec_excludes_only_that_range(self):
+        ports = _select_confirm_probe_ports('10.0.0.1', ['49152-65535'], count=3)
+        assert ports == []
+
+    def test_partial_range_spec_still_leaves_candidates(self):
+        # Only part of the ephemeral range was scanned; candidates should
+        # still be found outside it.
+        ports = _select_confirm_probe_ports('10.0.0.1', ['49152-60000'], count=3)
+        assert len(ports) == 3
+        assert all(60000 < int(p) <= 65535 for p in ports)
+
+    def test_individual_port_dest_ports_list_unaffected_by_range_fix(self):
+        # Regression guard: a normal (non-range) dest_ports list must behave
+        # exactly as before the range-expansion fix.
+        scanned = ['80', '443', '8080']
+        ports = _select_confirm_probe_ports('10.0.0.1', scanned, count=3)
+        assert len(ports) == 3
+        assert not (set(ports) & set(scanned))
+
+
+class TestActiveConfirmProbe:
+    """Unit tests for _active_confirm_probe()."""
+
+    def test_returns_true_when_any_port_connects(self):
+        def connector(addr, timeout):
+            if addr[1] == 50000:
+                raise OSError('refused')
+            return contextlib.nullcontext()
+        assert _active_confirm_probe('10.0.0.1', ['50000', '50001'], connector=connector) is True
+
+    def test_returns_false_when_nothing_connects(self):
+        def connector(addr, timeout):
+            raise OSError('refused')
+        assert _active_confirm_probe('10.0.0.1', ['50000', '50001'], connector=connector) is False
+
+    def test_no_candidates_available_is_a_no_probe_no_confirm(self):
+        # What a Full scan actually produces end to end: _select_confirm_probe_ports()
+        # returns [] (nothing to probe), and _active_confirm_probe() on an empty
+        # list returns False without invoking the connector — the natural
+        # behaviour of an empty for-loop, not a guarded early-exit.
+        def connector(addr, timeout):
+            raise AssertionError('must not be called with no candidates')
+        probe_ports = _select_confirm_probe_ports('10.0.0.1', ['1-65535'], count=3)
+        assert probe_ports == []
+        assert _active_confirm_probe('10.0.0.1', probe_ports, connector=connector) is False
+
+
+class TestMaybeConfirmHoneypot:
+    """Unit tests for _maybe_confirm_honeypot()."""
+
+    def test_disabled_never_probes(self):
+        def connector(addr, timeout):
+            raise AssertionError('must not be called when disabled')
+        result = _maybe_confirm_honeypot(False, '10.0.0.1', ['50000'], connector=connector)
+        assert result is False
+
+    def test_enabled_runs_probe(self):
+        def connector(addr, timeout):
+            return contextlib.nullcontext()
+        result = _maybe_confirm_honeypot(True, '10.0.0.1', ['50000'], connector=connector)
+        assert result is True
+
+
+class TestReportConfirmedHoneypots:
+    """Unit tests for _report_confirmed_honeypots()."""
+
+    def test_writes_file_and_warns(self, tmp_path, capsys):
+        _report_confirmed_honeypots({'10.0.0.1'}, str(tmp_path))
+        content = (tmp_path / 'confirmed_honeypots.txt').read_text()
+        assert content.strip() == '10.0.0.1'
+        assert '10.0.0.1' in capsys.readouterr().out
+
+    def test_empty_confirmed_truncates_the_file(self, tmp_path):
+        """A stale confirmation line pins generate_findings() at HIGH forever
+        AND makes the deliverable assert 'host answered on a port never scanned
+        open' for a probe that never ran -- exactly what happens when an
+        operator turns honeypot_active_confirm back off."""
+        stale = tmp_path / 'confirmed_honeypots.txt'
+        stale.write_text('10.9.9.9\n')
+        _report_confirmed_honeypots(set(), str(tmp_path))
+        assert stale.exists()
+        assert stale.read_text() == ''
+
+    def test_empty_confirmed_prints_no_warning(self, tmp_path, capsys):
+        _report_confirmed_honeypots(set(), str(tmp_path))
+        assert capsys.readouterr().out == ''
+
+    def test_multiple_hosts_sorted(self, tmp_path):
+        _report_confirmed_honeypots({'10.0.0.10', '10.0.0.2'}, str(tmp_path))
+        content = (tmp_path / 'confirmed_honeypots.txt').read_text()
+        assert content.splitlines() == ['10.0.0.2', '10.0.0.10']
+
+
+class TestConfirmFlaggedHoneypots:
+    """Unit tests for _confirm_flagged_honeypots()."""
+
+    def test_empty_flagged_confirms_nothing_and_clears_stale_file(self, tmp_path):
+        stale = tmp_path / 'confirmed_honeypots.txt'
+        stale.write_text('10.9.9.9\n')
+        _confirm_flagged_honeypots({}, True, ['80'], str(tmp_path))
+        assert stale.read_text() == ''
+
+    def test_disabled_confirms_nothing_and_clears_stale_file(self, tmp_path):
+        stale = tmp_path / 'confirmed_honeypots.txt'
+        stale.write_text('10.9.9.9\n')
+        _confirm_flagged_honeypots({'10.0.0.9'}, False, ['80'], str(tmp_path))
+        assert stale.read_text() == ''
+
+    def test_disabled_skips_probe_port_selection_entirely(self, tmp_path):
+        """The enabled check must happen before the per-host loop, not only
+        inside _maybe_confirm_honeypot(): _select_confirm_probe_ports() builds
+        and samples a ~16k-element candidate set per host, and enabled=False is
+        the default and overwhelmingly common case."""
+        with patch('spoonmap._select_confirm_probe_ports') as mock_select:
+            _confirm_flagged_honeypots({'10.0.0.9', '10.0.0.10'}, False, ['80'],
+                                       str(tmp_path))
+        assert not mock_select.called
+
+    def test_enabled_does_select_probe_ports(self, tmp_path):
+        """Counterpart to the above: the early return must not swallow the
+        enabled path."""
+        with patch('spoonmap._select_confirm_probe_ports',
+                   return_value=['50000']) as mock_select:
+            _confirm_flagged_honeypots({'10.0.0.9'}, True, ['80'], str(tmp_path),
+                                       connector=lambda addr, timeout: (_ for _ in ()).throw(
+                                           OSError('refused')))
+        assert mock_select.called
+
+    def test_enabled_with_injected_connector_confirms_and_persists(self, tmp_path):
+        # Exercises the enabled=True orchestrator path end to end with a fake
+        # connector instead of a real socket connection: select probe ports,
+        # probe, collect the confirmed IP, and persist it.
+        def connector(addr, timeout):
+            if addr[0] == '10.0.0.9':
+                return contextlib.nullcontext()
+            raise OSError('refused')
+        _confirm_flagged_honeypots({'10.0.0.9', '10.0.0.10'}, True, ['80'],
+                                    str(tmp_path), connector=connector)
+        content = (tmp_path / 'confirmed_honeypots.txt').read_text()
+        assert '10.0.0.9' in content
+        assert '10.0.0.10' not in content
+
+    def test_enabled_with_no_confirming_connector_writes_empty_file(self, tmp_path):
+        def connector(addr, timeout):
+            raise OSError('refused')
+        _confirm_flagged_honeypots({'10.0.0.9'}, True, ['80'],
+                                    str(tmp_path), connector=connector)
+        assert (tmp_path / 'confirmed_honeypots.txt').read_text() == ''
+
+
+class TestScopeFilteredFlags:
+    """Unit tests for _scope_filtered_flags().
+
+    The Stage 2 active probe is the only honeypot signal that SENDS PACKETS,
+    and honeypot_flags is built from data that outlives the current
+    authorisation: full_results/port_ips are unioned with cached
+    live_hosts/portN.txt files a narrowed ranges.txt deliberately never prunes,
+    and _ttl_spread_by_host() walks every XML still sitting in
+    masscan_results/. Scanning outside the current authorisation is worse than
+    under-scanning, so out-of-scope hosts must not reach the probe.
+    """
+
+    def _scope(self, tmp_path, text='10.0.0.0/24\n'):
+        f = tmp_path / 'scope.txt'
+        f.write_text(text)
+        return spoonmap._merge_ranges(_parse_target_ranges(str(f)))
+
+    def test_out_of_scope_host_dropped(self, tmp_path):
+        scope = self._scope(tmp_path)
+        flagged = {'10.0.0.5': {'port_profile': 'X'},
+                   '192.168.1.5': {'port_profile': 'X'}}
+        assert _scope_filtered_flags(flagged, scope) == {
+            '10.0.0.5': {'port_profile': 'X'}}
+
+    def test_all_in_scope_passes_through_unchanged(self, tmp_path):
+        scope = self._scope(tmp_path)
+        flagged = {'10.0.0.5': {'ttl_spread': [64, 128]}}
+        assert _scope_filtered_flags(flagged, scope) == flagged
+
+    def test_empty_scope_is_permissive(self):
+        """Mirrors _report_out_of_scope_retained(): an absent or unparseable
+        target_file leaves no authorisation record to compare against, so
+        nothing is claimed either way rather than silently disabling a feature
+        the operator explicitly turned on."""
+        flagged = {'192.168.1.5': {'port_profile': 'X'}}
+        assert _scope_filtered_flags(flagged, []) == flagged
+
+    def test_unparseable_host_string_is_dropped(self, tmp_path):
+        """_ip_in_ranges() fails closed on anything that is not plain IPv4
+        (a hostname, an IPv6 literal, a truncated resume line)."""
+        scope = self._scope(tmp_path)
+        flagged = {'not-an-ip': {'port_profile': 'X'}}
+        assert _scope_filtered_flags(flagged, scope) == {}
+
+    def test_empty_flagged_stays_empty(self, tmp_path):
+        scope = self._scope(tmp_path)
+        assert _scope_filtered_flags({}, scope) == {}
+
+
+class TestConfirmProbeScopeFiltering:
+    """mass_scan()'s three _confirm_flagged_honeypots() call sites must
+    scope-filter honeypot_flags first. Before this, the probe ran on the raw
+    dict — ahead of _report_out_of_scope_retained(), which runs immediately
+    after at each of the same three sites and had already established these
+    IPs can come from a prior, wider engagement."""
+
+    _CANARY = sorted(HONEYPOT_PORT_PROFILES['Thinkst Canary'])
+
+    def _targets(self, tmp_path, text='10.0.0.0/24\n'):
+        f = tmp_path / 'ranges.txt'
+        f.write_text(text)
+        return str(f)
+
+    def test_batch_loop_path_drops_out_of_scope_host(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        target_file = self._targets(tmp_path)
+        # 10.0.0.9 is in scope; 192.168.50.9 is a leftover from a wider run.
+        response = {p: {'10.0.0.9', '192.168.50.9'} for p in self._CANARY}
+        with patch('spoonmap._run_masscan_batch', return_value=response), \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('All', self._CANARY, '88', '1000', target_file, '',
+                      batch_size=len(self._CANARY), honeypot_active_confirm=True)
+        passed = mock_confirm.call_args[0][0]
+        assert set(passed) == {'10.0.0.9'}
+
+    def test_full_scan_batched_path_drops_out_of_scope_host(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        target_file = self._targets(tmp_path)
+        response = {p: {'10.0.0.9', '192.168.50.9'} for p in self._CANARY}
+        with patch('spoonmap._run_masscan_batch', return_value=response), \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('Full', ['1-65535'], '53', '10000', target_file, '',
+                      honeypot_active_confirm=True)
+        passed = mock_confirm.call_args[0][0]
+        assert set(passed) == {'10.0.0.9'}
+
+    def test_full_scan_resume_path_drops_out_of_scope_host(self, tmp_path):
+        spoonmap.output_path = str(tmp_path)
+        disc = tmp_path / 'discovery'
+        (disc / 'masscan_results').mkdir(parents=True)
+        live_dir = disc / 'live_hosts'
+        live_dir.mkdir(parents=True)
+        targets = disc / 'resolved_targets.txt'
+        targets.write_text('10.0.0.0/24\n')
+        cached = disc / 'masscan_results' / 'portFull.xml'
+        cached.write_text('<nmaprun/>')
+        _write_target_stamp(cached, targets)
+        # This path reads results straight back off disk, so it is the most
+        # exposed to a live_hosts/ directory left over from a wider scope.
+        for port in self._CANARY:
+            (live_dir / f'port{port}.txt').write_text('10.0.0.9\n192.168.50.9\n')
+        with patch('spoonmap._run_masscan_batch') as mock_batch, \
+             patch('spoonmap._confirm_flagged_honeypots') as mock_confirm:
+            mass_scan('Full', ['1-65535'], '53', '10000', str(targets), '',
+                      resume=True, honeypot_active_confirm=True)
+        assert not mock_batch.called
+        passed = mock_confirm.call_args[0][0]
+        assert set(passed) == {'10.0.0.9'}
+
+    def test_out_of_scope_host_never_reaches_confirmed_file(self, tmp_path):
+        """Unpatched end to end: with a connector that would confirm ANY host,
+        the out-of-scope one must still be absent from confirmed_honeypots.txt
+        — i.e. no packet was ever sent to it."""
+        spoonmap.output_path = str(tmp_path)
+        target_file = self._targets(tmp_path)
+        response = {p: {'10.0.0.9', '192.168.50.9'} for p in self._CANARY}
+        probed = []
+
+        def connector(addr, timeout):
+            probed.append(addr[0])
+            return contextlib.nullcontext()
+
+        real_confirm = spoonmap._confirm_flagged_honeypots
+
+        def confirm_with_connector(flagged, enabled, dest_ports, disc, **kw):
+            return real_confirm(flagged, enabled, dest_ports, disc,
+                                connector=connector)
+
+        with patch('spoonmap._run_masscan_batch', return_value=response), \
+             patch('spoonmap._confirm_flagged_honeypots',
+                   side_effect=confirm_with_connector):
+            mass_scan('All', self._CANARY, '88', '1000', target_file, '',
+                      batch_size=len(self._CANARY), honeypot_active_confirm=True)
+        confirmed = (tmp_path / 'discovery' / 'confirmed_honeypots.txt').read_text()
+        assert '10.0.0.9' in confirmed
+        assert '192.168.50.9' not in confirmed
+        assert '192.168.50.9' not in probed
+
+
 # ── TestSMBCoupling ────────────────────────────────────────────────────────────
 
 class TestSMBCoupling:
@@ -13114,6 +14606,41 @@ def test_load_config_accepts_the_legacy_quoted_spelling(self):
         assert _load_config(cfg, '/t')['check_for_updates'] is True
 
 
+class TestHoneypotActiveConfirmIsOptIn:
+    """The active honeypot confirmation probe is off unless explicitly enabled.
+
+    Mirrors TestUpdateCheckIsOptIn: an unrequested probe against a suspected
+    client-deployed decoy is exactly the kind of action that must be opt-in.
+    """
+
+    def test_load_config_defaults_the_key_to_false(self):
+        cfg = _config_dict()
+        assert 'honeypot_active_confirm' not in cfg
+        assert _load_config(cfg, '/t')['honeypot_active_confirm'] is False
+
+    def test_load_config_respects_explicit_true(self):
+        cfg = _config_dict(honeypot_active_confirm=True)
+        assert _load_config(cfg, '/t')['honeypot_active_confirm'] is True
+
+    def test_build_interactive_config_defaults_to_false(self):
+        config = _build_interactive_config(
+            'All', [], 'All', True, True, 'Internal', '2000', '/t/targets.txt',
+            '/t/out', None, 5, 5, 5_000_000, True,
+        )
+        assert config['honeypot_active_confirm'] is False
+
+    def test_build_interactive_config_written_explicitly(self):
+        config = _build_interactive_config(
+            'All', [], 'All', True, True, 'Internal', '2000', '/t/targets.txt',
+            '/t/out', None, 5, 5, 5_000_000, True,
+            honeypot_active_confirm=True,
+        )
+        assert config['honeypot_active_confirm'] is True
+
+    def test_field_order_includes_the_key(self):
+        assert 'honeypot_active_confirm' in _CONFIG_FIELD_ORDER
+
+
 class TestCheckForUpdates:
     """The check itself: comparison, output, and total failure tolerance."""