← Back to Intelligence
Scanner Intelligence
Security scanning organizations detected by our honeypot sensor network. These are legitimate research and CTI operations — not threats.
Scanning Organizations
15
Scanner IPs Detected
259
0.5% of all actors
Total Scanner Events
9604
Status
Excluded from threat campaigns
Detected Organizations
| Organization | Domain | IPs | Events | Events/IP | First Seen | Last Seen |
|---|---|---|---|---|---|---|
| VisionHeight (CTI scanning) | visionheight.com | 9 | 4968 | 552.0 | 2026-02-23 | 2026-09-15 |
| Shadowserver Foundation | shadowserver.org | 68 | 1969 | 29.0 | 2026-02-17 | 2026-09-15 |
| BufferOver | bufferover.run | 7 | 690 | 98.6 | 2026-02-23 | 2026-09-08 |
| CriminalIP | criminalip.com | 3 | 539 | 179.7 | 2026-02-26 | 2026-09-15 |
| Censys | censys-scanner.com | 53 | 361 | 6.8 | 2026-02-16 | 2026-09-15 |
| Modat (CTI scanning) | modat.io | 15 | 276 | 18.4 | 2026-02-16 | 2026-09-13 |
| ONYPHE | onyphe.net | 38 | 169 | 4.4 | 2026-02-18 | 2026-09-11 |
| Shodan | shodan.io | 4 | 128 | 32.0 | 2026-02-27 | 2026-09-07 |
| Stretchoid | stretchoid.com | 15 | 118 | 7.9 | 2026-02-16 | 2026-08-22 |
| Nokia Deepfield (network analytics) | deepfield.net | 16 | 96 | 6.0 | 2026-02-20 | 2026-08-28 |
| Internet Measurement | internet-measurement.com | 15 | 84 | 5.6 | 2026-02-20 | 2026-09-05 |
| Internet Census | internet-census.org | 11 | 77 | 7.0 | 2026-02-25 | 2026-09-15 |
| Intrinsec | intrinsec.com | 1 | 54 | 54.0 | 2026-02-26 | 2026-09-15 |
| Group-IB | group-ib.com | 1 | 48 | 48.0 | 2026-02-23 | 2026-05-15 |
| Cyber Resilience | cyberresilience.io | 3 | 27 | 9.0 | 2026-02-24 | 2026-05-22 |