Most organizations don’t have a complete picture of what’s reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. However, attackers scan for these services systematically, every day.
Censys continuously maps the entire Internet. Each new scanner adds one more type of service to that map, so when it shows up on your attack surface, or a supplier’s, you know before an attacker does.
This is the first installment of New on the Map, a blog series covering new and updated protocol and endpoint scanners.
14 New Protocol and Endpoint Scanners Added in August
Four scanners are spotlighted below. See the full list in our Release Notes.
KNX/IP: the system that decides whether your doors lock
Category: Building Automation
KNX controls lighting, climate, and door access in modern commercial and industrial buildings. When a KNX gateway is reachable from the Internet, anyone can find the system that decides whether your building’s doors lock.
CISA added a KNX vulnerability (CVE-2023-4346) to its Known Exploited Vulnerabilities catalog in July 2026. Researchers count more than 16,000 exposed KNX systems online (Inside Lighting), and the KNXlock campaign has already locked building owners out of their own automation systems (Limes Security). Schneider Electric reissued hardening guidance in response (SecurityWeek).
This is an active KEV entry with a documented lockout campaign. If you manage building systems, check whether your gateways are reachable.
Censys Platform Query: host.services.protocol:"KNXIP"
Redshift: 1,173 data warehouses in plain sight
Category: Database
Amazon Redshift is where organizations store years of sales records, customer information, and operational history for internal analytics teams.
AWS disabled public accessibility by default on new Redshift clusters in 2025 (AWS Security Blog). Security researchers still flag publicly accessible clusters as an open door to SQL injection and denial-of-service (Trend Micro).
The 2025 default change only applies to new clusters. Censys sees 1,173 Redshift endpoints exposed to the Internet worldwide, nearly two-thirds of them inside US networks. If your org runs self-managed Redshift, confirm public access is actually off.
Censys Platform Query: host.services.protocol:"REDSHIFT"
Tailscale DERP: exposing your private mesh network’s existence
Category: Networking
Tailscale DERP relays are the fallback path that keeps private WireGuard mesh networks running when direct peer connections fail. They can’t decrypt the traffic passing through them, but an exposed relay still confirms a private mesh network exists, and roughly where.
Tailscale patched a timing side channel in DERP mesh authentication in May 2025 that could have let an attacker recover the shared mesh secret (Tailscale Security Bulletins).
An exposed relay is like a moving van parked outside a house — it doesn’t show what’s inside, but it confirms something worth watching just moved in. If you self-host DERP, check whether your relay is reachable from the open Internet.
Censys Platform Query: host.services.endpoints.endpoint_type:"TAILSCALE_DERP"
TVT camera control: dozens of camera brands, one exposed channel
Category: IoT / Surveillance
TVT’s remote management protocol runs on DVRs, NVRs, and IP cameras sold under dozens of brand names across the physical security industry. When that control channel reaches the Internet, authenticated access to login and live camera feeds is one step away from anyone who finds the service.
Since April 2025, a Mirai-based botnet has been exploiting a cleartext credential-disclosure flaw in TVT NVMS9000 DVRs (BleepingComputer). Vulnerable TVT DVR devices in the US, UK, and Germany drew intrusion attempts from 6,600 unique IPs in a single month (SC Media). Meanwhile, Juniper Threat Labs tracked a botnet exploiting hardcoded credentials in the TVT NVMS-9000 web API, active in the wild since 2019 (Juniper Networks).
The botnet activity is ongoing. If TVT_CONTROL shows up in your footprint, treat it as a current exposure and prioritize it.
Censys Platform Query: host.services.protocol:"TVT_CONTROL"
Check your attack surface
The full list of all 14 scanners is in our Release Notes. Run any of the queries above in the Censys Platform to see global exposure.
