Other security topics

Hi all, I am using Censys Search as part of my research. If I happen to discover an undisclosed vulnerability while using Censys, what are the expected disclosure procedures for both identifiable and non-identifiable hosts? For example, how can I disclose vulnerabilities to hosts with only IP:port  metadata and no domain names? For those with domains/contacts, I should reach out to them directly right? Thank you for your support,

We’ve partnered with Google Cloud Security to bring Censys ASM and the Censys Platform directly into Google SecOps SIEM and SOAR to deliver real-time internet intelligence and comprehensive external exposure context where it matters most.With this integration, teams can:Triage suspicious infrastructure faster with built-in enrichment Validate remediation with real-time rescans and historical context Reduce manual pivots across monitoring and response workflows Learn more: https://bit.ly/4u4fxk0

Dear Censys Support,Thank you for your response.I am fully aware of what Censys does. That is precisely the issue.Your opt-out model is not compliant with GDPR. Under Article 6 of Regulation (EU) 2016/679, any processing of data — including the active probing of private infrastructure — requires a valid legal basis. "Legitimate interest" (Article 6.1.f) is explicitly conditional: it cannot override the rights and interests of the data subject when those are clearly asserted. I am asserting them now, in writing, for the second time.To be unambiguous:- I did not opt in to your scanning program.- I am not required to opt out of something I never consented to.- The burden of compliance is yours, not mine.I also note that my server logs show repeated connection attempts from multiple Censys-operated IP ranges over an extended period (July–August 2025, and again April 2026). This is documented and timestamped.I expect the following within 5 business days:1. Permanent cessation of all scannin

Dear Censys IO Legal & Security Team,This notice is addressed to your organization following the identification of repeated, unsolicited scanning activities targeting my production SMTP server infrastructure, originating from IP ranges attributable to Censys IO.While I am aware that Censys operates as an internet intelligence platform, I wish to make the following unambiguously clear:1. UNAUTHORIZED ACCESS ATTEMPTSThe scanning activities directed at my server constitute unauthorized probing of a private, production-grade system. Under applicable law — including but not limited to the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030), the EU Directive on Attacks Against Information Systems (2013/40/EU), and French law n°88-19 on computer fraud — such activities may expose your organization to civil and criminal liability, regardless of intent.2. ABSENCE OF PRIOR CONSENT OR NOTIFICATIONNo prior communication, opt-in mechanism, or notification was received from your organization b

The Vertex Project and Censys recently hosted a joint webinar highlighting the Synapse-Censys Power-Up and how analysts can use it to query Censys’ data and represent their findings within Synapse. For our use case, we focused on how an analyst might use the Synapse-Censys Power-Up to research infrastructure associated with a group called NoName057(16) and its use of a custom Distributed Denial of Service toolkit known as DDoSia. This blog will walk through several of the webinar’s key points.

HelloI’m currently trying to integrate Censys with an external tool, which requires the legacy API credentials, specifically the API UID and Secret Key.I was able to generate a Personal Access Token successfully from my account, but I could not find any option to obtain the API UID or Secret Key (API ID and API Secret) anywhere in the dashboard.Is there still a way to obtain legacy API credentials? If not, is there a recommended way to make tools like recon-ng work with the new authentication system?Thank you for your help!

I am having trouble topping up my credits, I kept getting the error message "Verify your account information and payment method, then try again.". Can I get your team's help on this urgently?

Hello! I want add 100$ to my balance, but I can't pay with my CreditCard in United States, I see error "Transaction FailedVerify your account information and payment method, then try again."Please fix this or help me with top up! 

Hello, I need to do a historical search of the open ports of one of our public IPs, I wanted to know if by buying Censys credits I can do this historical search and how far back I can go.Thanks

Last week, the Censys research team set out to test the existence of ICS protocols on port tweaks. Instead of picking one ICS protocol as a proof-of-concept analysis, we set out to investigate all of them. 🕵️ Read part 2 here.

At Censys, our goal is to capture an accurate representation of the Internet at any given time. However, not only is the Internet large, but our investigations and prior research show that many of the services on the Internet do not respond on their standard port. While you would expect Modbus to be found only on port 502, the reality is that there is a plethora of Modbus on other, non-standard ports.Our research team put together a new blog about how we use independent measurement and research to verify where to scan in a more focused manner, concentrating on ICS protocols as a case study. You can check it out here. 

Good morning, We have been seeing intermittent failures with the Censys Search API all weekend, with a further stream of 500 failures this morning. A number of searches via the GUI are also returning 0 results.  We have checked the Censys status board, which does not suggest that there are availability issues with the API. Please can you investigate. 

Hi folks, We just published a report examining the most commonly exposed types of assets belonging to the Internet of Healthcare Things (IoHT) 🏥 in Censys data.Ransomware and data breaches in healthcare continue to rise, and effective exposure management in this sector is more critical than ever. Healthcare organizations often have sprawling, decentralized infrastructure and under-resourced IT departments, which create significant challenges.We examined the global external attack surface of publicly accessible medical devices and IoHT applications and found legacy protocols, unauthenticated medical image databases, and data platforms with histories of exploited vulnerabilities.You can read the full report here: https://censys.com/state-of-internet-of-healthcare-things/ 

Hi there! Censys recently published a blog about the prevalence of ransomware attacks on manufacturing firms, based on new research from GRF. Within the blog, our team included some manufacturing use case queries you can run in Censys Search and Censys ASM to identify and monitor relevant protocols, like those for building automation, PLC communication, HMI/SCADA, and more. Examples: Building Automation ProtocolsBACnetSearch Query: services.service_name:BACNET ASM Query: host.services.service_name:BACNETHMI/SCADARed Lion CrimsonSearch Query: services.service_name:REDLION_CRIMSON or services.software:(vendor=”Red Lion” and product=”Crimson”) ASM Query: host.services.service_name:REDLION_CRIMSON or host.services.software:(vendor=”Red Lion” and product=”Crimson”) You can check out the full article here: https://censys.com/top-targets-the-impact-of-ransomware-on-manufacturing/

The recently disclosed CVE-2024-4577 PHP vulnerability has been rapidly weaponized by the TellYouThePass ransomware gang to breach servers and encrypt files since around June 7, 2024. Censys published a live dashboard tracking publicly exposed infected hosts, observing around 1,000 as of June 13, primarily geolocated in China. The Censys Research Team first wrote about this issue in an advisory published on June 10, 2024: https://censys.com/cve-2024-4577/. This latest blog expands upon the evolving exploitation of the vulnerability, the TellYouThePass campaign, and the team’s observations regarding compromised hosts. Read it here.