// Security scanners
The painted mark for Censys
Placeholder: mark still to be painted

Censys

CensysInspect

Censys, from Michigan in the US, keeps checking every address online and catalogues what it finds (devices, websites, security certificates) for security teams and researchers. It grew out of ZMap, free scanning tools built at the University of Michigan from 2013.

Worth knowing: ZMap can scan every public address on the internet (the whole of IPv4) in under 45 minutes from a single computer. Censys co-founder J. Alex Halderman compares it to Google Street View: “we just take a picture from the sidewalk. We don't peek in the door, we don't jiggle the locks.”

Why? A few are security companies mapping what is exposed on the internet and selling that picture. Most are automatic attempts to find a site with a door left open: a leaked password file, a WordPress login, an admin page. A site that is broken into can be resold, used to send spam, or added to a network of hijacked machines. New sites are found within seconds, because every new site’s security certificate is written into a public log (SANS).