Adversary Investigation
Censys Adversary Investigation turns first-party scanning into a curated, real-time map of attacker infrastructure.
Pivot from one signal to the full campaign footprint.
Start with a certificate, domain, IP, or other signal and uncover the full campaign of related adversary infrastructure. Cut investigation times from hours to minutes.
Reduced MTTD/MTTR. Faster containment actions.
Leverage on-demand rescanning, historical data exploration, and rapid pivoting. Engineer detections at the top of the “pyramid of pain”, not the bottom.
Higher-fidelity detections. Lower alert fatigue.
Use Censys ARC threat intelligence as a malicious infrastructure feed — or build Collections in Adversary Investigation that become tailored feeds for adversaries you track.
Better alert context. Improved IOC blocklists.
Censys ARC tracks adversaries’ recycled infrastructure signals and reuse patterns. Search and filter by threat types like C2 servers, phishing servers, botnet servers, and webshells — with evidence tied directly to a first-party scan of the service or endpoint.
Build a node-based pivot map to document your investigation trail, visualize relationships, and track adversary infrastructure as campaigns evolve.
Extract rare, high-signal attributes (HTTP headers, SSH banners, TLS values) and instantly see how frequently they appear across the Internet to uncover hidden related infrastructure.
Use the Open Directory Explorer and “Suspicious Directory”-labeled threats to surface web-accessible directories hosting staged payloads, hacktools, webshells, and other risky artifacts.
Use certificate timelines, contextual hashes (JARM, JA3/JA4, TLSH) to connect infrastructure, spot reuse, and build investigative timelines. Run on-demand Censys Live Discovery & Live Rescan to verify behavior in real time.
Operationalize hunting with the Censys Adversary Investigation MCP server and Censys Assistant. Convert saved Collections into continuously updated infrastructure intelligence for your SOC workflows.
Case Study
US: +1-888-985-5547
Intl: +1-877-438-9159
connect@censys.com
