Security teams need to quickly identify new online services to help inform their defensive strategies. Identifying a suspicious server within hours rather than weeks can significantly impact incident response. A recent study by the Censys Research Team evaluated Censys’s IPv4 scanning capability against other engines like Shodan, ZoomEye, Netlas, and BinaryEdge and found that while these alternatives sometimes self-report higher numbers of results, their data is often stale and inaccurate.
The importance of data accuracy
During our research, we found that a significant portion of services reported by alternative engines were either stale or duplicated. Approximately one-third of services reported by Fofa and Netlas were non-unique. Censys reported the largest percentage and number of accurate services, responding to follow-up scans on the same day as the query. The graph below shows that 100% of services in Censys reports were scanned again within two days, while only 0.7% (Zoomeye) to 25% (Shodan) of services in other scanning engines show scans within two days.
- Censys: 730M Accurate Services (92% Accuracy)
- Shodan: 550M Accurate Services (68% Accuracy)
- Fofa: 403M Accurate Services (20% Accuracy)
Censys dominates in port/protocol coverage
Censys provides the most coverage across all 65,535 ports. Censys had 82% coverage across all 65k ports, compared to Shodan at 10%. Censys also identifies 90%-98% of services on other platforms, while the alternatives only see 39%-57% of what Censys reports.
Censys delivers the freshest data
On average, Censys updates services nearly 10 times faster than other platforms. Fully 100% of services in Censys were scanned multiple times within two days, while other engines showed much older scan times. It’s difficult to overstate the importance of having the most up-to-date information on which services are running on which hosts. Security and threat hunting teams rely on this data to inform their decision-making processes and help them prioritize threats. Stale data can lead to poor, uninformed decisions with continuing ripple effects.
Censys’s new Internet services discovery is unparalleled
In an experiment using 100 honeypots in Google Cloud across multiple regions, Censys discovered new services up to 34 times faster than Shodan across popular ports. For unexpected services, only Censys discovered them during the experiment. Providing the most accurate and freshest data are at the heart of what we do here at Censys and we’re always looking for new ways to deliver it to customers.
