← Back to Intelligence
Scanner Intelligence
Security scanning organizations detected by our honeypot sensor network. These are legitimate research and CTI operations — not threats.
Scanning Organizations
15
Scanner IPs Detected
259
1.8% of all actors
Total Scanner Events
3343
Status
Excluded from threat campaigns
Detected Organizations
| Organization | Domain | IPs | Events | Events/IP | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| VisionHeight (CTI scanning) | visionheight.com | 9 | 1929 | 214.3 | 2026-02-23 | 2026-04-19 |
| Shadowserver Foundation | shadowserver.org | 68 | 496 | 7.3 | 2026-02-17 | 2026-04-19 |
| Censys | censys-scanner.com | 53 | 211 | 4.0 | 2026-02-16 | 2026-04-16 |
| BufferOver | bufferover.run | 7 | 130 | 18.6 | 2026-02-23 | 2026-04-16 |
| ONYPHE | onyphe.net | 38 | 119 | 3.1 | 2026-02-18 | 2026-04-15 |
| Stretchoid | stretchoid.com | 15 | 97 | 6.5 | 2026-02-16 | 2026-04-18 |
| Modat (CTI scanning) | modat.io | 15 | 70 | 4.7 | 2026-02-16 | 2026-04-14 |
| Nokia Deepfield (network analytics) | deepfield.net | 16 | 63 | 3.9 | 2026-02-20 | 2026-04-12 |
| Internet Measurement | internet-measurement.com | 15 | 57 | 3.8 | 2026-02-19 | 2026-04-14 |
| CriminalIP | criminalip.com | 3 | 54 | 18.0 | 2026-02-26 | 2026-04-16 |
| Shodan | shodan.io | 4 | 34 | 8.5 | 2026-02-20 | 2026-04-12 |
| Group-IB | group-ib.com | 1 | 30 | 30.0 | 2026-02-23 | 2026-04-10 |
| Internet Census | internet-census.org | 11 | 29 | 2.6 | 2026-02-19 | 2026-04-19 |
| Cyber Resilience | cyberresilience.io | 3 | 15 | 5.0 | 2026-02-24 | 2026-04-14 |
| Intrinsec | intrinsec.com | 1 | 9 | 9.0 | 2026-02-26 | 2026-04-09 |