← Back to Intelligence
Scanner Intelligence
Security scanning organizations detected by our honeypot sensor network. These are legitimate research and CTI operations — not threats.
Scanning Organizations
15
Scanner IPs Detected
259
1.1% of all actors
Total Scanner Events
5357
Status
Excluded from threat campaigns
Detected Organizations
| Organization | Domain | IPs | Events | Events/IP | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| VisionHeight (CTI scanning) | visionheight.com | 9 | 2958 | 328.7 | 2026-02-23 | 2026-05-24 |
| Shadowserver Foundation | shadowserver.org | 68 | 926 | 13.6 | 2026-02-17 | 2026-06-05 |
| BufferOver | bufferover.run | 7 | 405 | 57.9 | 2026-02-23 | 2026-06-05 |
| Censys | censys-scanner.com | 53 | 257 | 4.8 | 2026-02-16 | 2026-06-05 |
| CriminalIP | criminalip.com | 3 | 149 | 49.7 | 2026-02-26 | 2026-05-31 |
| ONYPHE | onyphe.net | 38 | 134 | 3.5 | 2026-02-18 | 2026-05-30 |
| Stretchoid | stretchoid.com | 15 | 104 | 6.9 | 2026-02-16 | 2026-05-23 |
| Modat (CTI scanning) | modat.io | 15 | 99 | 6.6 | 2026-02-16 | 2026-05-31 |
| Shodan | shodan.io | 4 | 71 | 17.8 | 2026-02-27 | 2026-05-26 |
| Nokia Deepfield (network analytics) | deepfield.net | 16 | 64 | 4.0 | 2026-02-20 | 2026-05-22 |
| Internet Measurement | internet-measurement.com | 15 | 57 | 3.8 | 2026-02-19 | 2026-04-14 |
| Group-IB | group-ib.com | 1 | 48 | 48.0 | 2026-02-23 | 2026-05-15 |
| Internet Census | internet-census.org | 11 | 38 | 3.5 | 2026-02-25 | 2026-05-31 |
| Cyber Resilience | cyberresilience.io | 3 | 27 | 9.0 | 2026-02-24 | 2026-05-22 |
| Intrinsec | intrinsec.com | 1 | 20 | 20.0 | 2026-02-26 | 2026-05-25 |