Censys.

Censys grew out of academic research at the University of Michigan. It builds on ZMap, the modular scanner introduced by Zakir Durumeric and colleagues at USENIX Security 2013 that can sweep the entire public IPv4 space in under 45 minutes from a single machine. Censys itself was presented in the 2015 ACM CCS paper "A Search Engine Backed by Internet-Wide Scanning" (Durumeric, Adrian, Mirian, Bailey, Halderman). It runs continuous scans across IPv4, IPv6, and Certificate Transparency logs, exposing hosts and certificates as deeply parsed JSON indexed by service, software, JARM/JA3 fingerprints, ASN, and historical state.

From raw scan to defender query

flowchart LR
  A[ZMap probes IPv4/IPv6] --> B[Banner + TLS grab]
  B --> C[Protocol parsers]
  C --> D[Structured JSON host docs]
  E[Certificate Transparency logs] --> D
  D --> F[Search index]
  F --> G[ASM: my exposed assets]
  F --> H[Threat hunt: C2 fingerprints]
  F --> I[IR: pivot on shared infra]

Defenders use Censys to discover exposed assets, watch for newly opened services, and hunt adversary infrastructure — for example clustering Cobalt Strike or malware C2 servers on shared TLS certificates, default HTTP bodies, or JARM hashes, then pivoting to related IPs. Because every observation is timestamped, incident responders can reconstruct when a service or certificate first appeared. Compared with Shodan, Censys emphasizes deep, schema-driven service parsing and certificate provenance, making it strong for external attack-surface management and infrastructure attribution. Attackers use the same data for reconnaissance, so reducing needless exposure is the core defence.