Checking It Twice: Profiling Benign Internet Scanners — 2024 Edition | Grey Noise Blog

Summary: GreyNoise deployed 24 new sensors between November 19 and 26, 2024, across five autonomous systems and eight geographies to profile benign internet scanners, narrowing the analysis to the top ten actors by tag count in November, including Shodan, Censys, BinaryEdge, CriminalIP and Alpha Strike Labs. Over a 7-day window, Censys probed the most ports at 36,056, followed by ShadowServer at 19,166 and Alpha Strike Labs at 14,876, while all scanners except ONYPHE (about 9 minutes) and CriminalIP (about 17 minutes) hit at least one new sensor within five minutes of it coming online.
Bottom line: Censys alone probed 36,056 ports in a week, and every scanner except CriminalIP probes outside traditional port ranges, so a service hidden on a nonstandard port is still inventoried by someone within days of appearing.

Read the original at GreyNoise Blog ↗