← Back to Intelligence
Scanner Intelligence
Security scanning organizations detected by our honeypot sensor network. These are legitimate research and CTI operations — not threats.
Scanning Organizations
15
Scanner IPs Detected
259
0.8% of all actors
Total Scanner Events
7224
Status
Excluded from threat campaigns
Detected Organizations
| Organization | Domain | IPs | Events | Events/IP | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| VisionHeight (CTI scanning) | visionheight.com | 9 | 3731 | 414.6 | 2026-02-23 | 2026-07-21 |
| Shadowserver Foundation | shadowserver.org | 68 | 1407 | 20.7 | 2026-02-17 | 2026-07-21 |
| BufferOver | bufferover.run | 7 | 619 | 88.4 | 2026-02-23 | 2026-07-07 |
| Censys | censys-scanner.com | 53 | 310 | 5.8 | 2026-02-16 | 2026-07-16 |
| CriminalIP | criminalip.com | 3 | 307 | 102.3 | 2026-02-26 | 2026-07-18 |
| Modat (CTI scanning) | modat.io | 15 | 161 | 10.7 | 2026-02-16 | 2026-07-18 |
| ONYPHE | onyphe.net | 38 | 152 | 4.0 | 2026-02-18 | 2026-07-19 |
| Stretchoid | stretchoid.com | 15 | 104 | 6.9 | 2026-02-16 | 2026-05-23 |
| Shodan | shodan.io | 4 | 101 | 25.2 | 2026-02-27 | 2026-07-17 |
| Nokia Deepfield (network analytics) | deepfield.net | 16 | 77 | 4.8 | 2026-02-20 | 2026-06-23 |
| Internet Measurement | internet-measurement.com | 15 | 76 | 5.1 | 2026-02-19 | 2026-07-13 |
| Internet Census | internet-census.org | 11 | 64 | 5.8 | 2026-02-25 | 2026-07-18 |
| Group-IB | group-ib.com | 1 | 48 | 48.0 | 2026-02-23 | 2026-05-15 |
| Intrinsec | intrinsec.com | 1 | 40 | 40.0 | 2026-02-26 | 2026-07-18 |
| Cyber Resilience | cyberresilience.io | 3 | 27 | 9.0 | 2026-02-24 | 2026-05-22 |