censys.io Open in urlscan Pro
2606:4700:20::681a:af5  Public Scan

Form analysis
2 forms found in the DOM

<form id="mktoForm_1156" __bizdiag="196352707" __biza="WJ__" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutAbove" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 300px;">
          <div class="mktoAsterix">*</div>Email Address
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email" class="mktoField mktoEmailField mktoHasWidth mktoRequired"
          aria-required="true" style="width: 300px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Last_UTM_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="email" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Last_UTM_Source__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="censys" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Last_UTM_Campaign__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="nurture-general" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset mktoHasWidth" style="width: 5px;"></div>
      <div class="mktoFieldWrap">
        <div class="mktoHtmlText mktoHasWidth" style="width: 332px;"><em>Censys uses the contact information you provide to contact you about our products and services. You may unsubscribe from these communications at any time. For information on how
            to unsubscribe, as well as our commitment to protecting your privacy, please review our <a href="https://censys.io/privacy-policy/" target="_blank" id="">Privacy Policy</a>.</em></div>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoPlaceholder mktoPlaceholderGDPR_Consent__c"></div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoPlaceholder mktoPlaceholderExplicit_Opt_In__c"></div>
    <div class="mktoClear"></div>
  </div>
  <script src="https://www.google.com/recaptcha/api.js?onload=captchaCallback" type="text/javascript" async="async" defer="defer"></script>
  <div>
    <script type="text/javascript">
      var formId = 1156;
      var captchaCallback = function(a) {
        var b = document.getElementsByClassName("grecaptcha-badge");
        if (b.length > 0)
          for (var c = 0; c < b.length; c++) b[c].style.visibility = "hidden";
        if (a) {
          var d = this.MktoForms2.getForm(formId);
          d && d.setCaptchaValue(a)
        }
      };
    </script>
  </div>
  <div id="captcha" class="g-recaptcha" data-callback="captchaCallback" data-expired-callback="captchaExpired" data-sitekey="6LcDkEEkAAAAAK_VYq9SXSJ-wPFCrnYcZ1aPGLHt" data-size="invisible">
    <div class="grecaptcha-badge" data-style="bottomright"
      style="width: 256px; height: 60px; display: block; transition: right 0.3s ease 0s; position: fixed; bottom: 14px; right: -186px; box-shadow: gray 0px 0px 5px; border-radius: 2px; overflow: hidden; visibility: hidden;">
      <div class="grecaptcha-logo"><iframe title="reCAPTCHA"
          src="https://www.google.com/recaptcha/api2/anchor?ar=1&amp;k=6LcDkEEkAAAAAK_VYq9SXSJ-wPFCrnYcZ1aPGLHt&amp;co=aHR0cHM6Ly9jZW5zeXMuaW86NDQz&amp;hl=it&amp;v=khH7Ei3klcvfRI74FvDcfuOo&amp;size=invisible&amp;cb=jvu472ver55c" width="256"
          height="60" role="presentation" name="a-eaax91sv5vhg" frameborder="0" scrolling="no" sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox"></iframe></div>
      <div class="grecaptcha-error"></div><textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response"
        style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"></textarea>
    </div><iframe style="display: none;"></iframe>
  </div>
  <div class="mktoCaptchaDisclaimer">This site is protected by reCAPTCHA and the Google <a href="https://policies.google.com/privacy" target="_blank">Privacy Policy</a> and
    <a href="https://policies.google.com/terms" target="_blank">Terms of Service</a> apply.</div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">SUBSCRIBE</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="1156"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="120-HWT-117">
</form>

<form __bizdiag="159141718" __biza="WJ__" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutAbove"
  style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

This website stores cookies on your computer. These cookies are used to improve
your website experience and provide more personalized services to you, both on
this website and through other media. To find out more about the cookies we use,
see our Privacy Policy.

Accept Decline
Skip to content
Upcoming Webinar: The 2023 State of Security Leadership - July 19th @ 2:00PM ET
| Register Today
Dismiss message

Toggle Menu
 * Products
   < Back
   
   
   PRODUCTS
   
   Explore the leading Internet Intelligence Platform for Threat Hunting and
   Exposure Management.
   
    * Censys Search
    * Exposure Management
    * The Censys Internet Map
    * Integrations
   
   
 * Solutions
   < Back
   
   
   SOLUTIONS
   
   Discover how to empower your security teams to defend attack surfaces and
   hunt for threats.
   
    * External Attack Surface Management
    * Cloud Asset Discovery
    * Exposure and Risk Management
    * Rapid Response
    * Subsidiaries, Mergers, and Acquisitions
    * Security Framework & Compliance
    * Threat Hunting

    * Federal

 * Resources
   < Back
   
   
   RESOURCES
   
   Explore Censys thought leadership on threat hunting, exposure management, and
   industry trends.
   
    * Resource Hub
    * Blog
    * Glossary
    * ASM 101

 * Company
   < Back
   
   
   COMPANY
   
   Learn more about the Censys mission and the talented team behind it.
   
    * About
    * Leadership
    * Board of Directors
    * Customers
    * Careers
    * Culture
    * Partners

    * Censys Search

    * Request a Demo


Blog


GREYNOISE RESEARCH FINDS CENSYS SCAN DATA IS FASTEST, MOST COMPREHENSIVE


SHARE

 * 
 * 
 * 
 * 

October 14, 2022
Tags: Scan Data

 

Cybersecurity firm GreyNoise Intelligence recently published “A Week In the Life
of a GreyNoise Censor: A Benign View.” I’m incredibly excited about this blog
because anytime an organization outside of yours conducts research that
reinforces statements you make on a daily basis, it’s a wonderful thing. There’s
even still some additional nuance to be explored, but from their research and
amazing visual graphics, there are some key observations to be made. Let’s work
our way top to bottom through each visual with some observations:


HOW LONG DOES IT TAKE BENIGN SCANNERS TO FIND NEW NODES?

Image source: GreyNoise

Lots of organizations clocking in at the ~1hr discovery mark. However, there’s a
lot of nuance to this. If you’re just scanning the internet for common ports
like 80/443 that are open, it’s not that hard – discovery of assets in other
tests and IR events I’ve heard of are as little as 7 minutes. You have to look
more closely at the work being done to really grasp the context.


HOW MANY BENIGN SCANNER UNIQUE IPS CONNECTED?

 

Image source: GreyNoise

The analysis here is the Y-axis of sensors coming online and scanning over an 8
day period. Here we start to see a little more distribution from the previous
visual in terms of concentration, but the picture begins to emerge that Censys
scanners are doing substantially more work with far fewer resources. For
example, BitSight & Internet Census are leveraging right at 3x more hardware
(IPs), and 100% of Censys’s hardware scans are concentrated up front. There are
some factors that can add more context to this, but it’s an interesting detail
nonetheless. Again, taken in context with the horsepower shown later…


HOW MANY DAILY ALERTS DID BENIGN SCANNERS GENERATE?

 

Image source: GreyNoise

Who likes alerts in the security world? No one. Practitioners are truly
suffering from constant alert fatigue – enter GreyNoise. This particular heat
map is geared towards their direct use case of reducing said alert fatigue, but
for our sake serves to illustrate very clearly just how much harder, faster, and
with greater consistency the Censys scan is probing the depths of the IPv4 sea.


WHICH BENIGN SCANNERS HAVE THE MOST DIVERSE VOLUME?

Image source: GreyNoise

This is where it all coalesces to showcase the sheer scale of the work the
Censys scanner is doing. This visual is where we start to see the distribution
of the specific ports each service is scanning and draw some fairly obvious
conclusions. It’s difficult to tell from the Y-axis scale, but it appears to be
around 15k ports where the ‘tail’ of the Censys scan data begins to taper off in
terms of its density. Left of this, we see that the density of scanning is still
much thicker for Censys than the others in the top five, with some variation in
terms of scanning density at different levels. We see the profiles for Shodan,
BitSight, and Internet Census are basically identical, with ReCyber
concentrating their scan efforts around the top ~1,200 ports instead. But – that
Censys tail, though, really brings home our conclusions.


CONCLUSIONS

Based on the above logic thread, we see a few key trends emerge:

Censys scan data is vastly more comprehensive than anything or one out there on
the internet, covering 100% of all 65k ports across the eight day test span,
with far greater consistency, i.e. thickness of the tail in the final figure.

Censys does far more with less. This speaks directly to the power of our
underlying technology the team has been working so hard on the past few years
that is truly second to none.

The final graphic in the GreyNoise article is super interesting to me. It
effectively represents the number of scans/attempted connections taking place
that are not associated with any known benign scanners out there. Translation:
Approximately every 3 minutes unknown and possibly malicious entities on the
internet are performing their own scans probing for at best information, at
worst opportunities to carry out exploits.





INTERESTED IN LEARNING MORE?


FIND MORE INFORMATION ABOUT CENSYS DATA AND SEARCH. 



About the Author
Kevin Garrett
Senior Solutions Engineer
Kevin supports new business in Enterprise Sales in the Mountain & West regions,
with a focus on Fortune 500 customers. With an extensive background in
Privileged Access Management prior to Censys, he is passionate about providing
visibility into the critical needs of enterprise organizations and empowering
network defenders with the information and tools they need.


GIVE US A CALL:

US: 1-888-985-5547
Intl: +1-877-438-9159


 * Home
 * Censys Search
 * Exposure Management
 * The Censys Internet Map
 * Integrations
 * Partners

 * Censys for Federal
 * Resource Hub
   * Blog
   * Glossary
 * About Censys
   * Culture
   * Careers
 * Contact Us


 * 
 * 


SUBSCRIBE TO OUR BLOG

*
Email Address







Censys uses the contact information you provide to contact you about our
products and services. You may unsubscribe from these communications at any
time. For information on how to unsubscribe, as well as our commitment to
protecting your privacy, please review our Privacy Policy.







This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of
Service apply.
SUBSCRIBE
© 2023 Censys
 * Data Retention Policy
 * Privacy Policy
 * Terms of Service

Show CTA
Attack Surface Management Solutions
Learn more