From Evasion to Evidence: Exploiting the Funneling Behavior of Injects
Discover how SmartApe threat intelligence exposes malware delivery chains. Learn to leverage TDS chokepoints, redirect analysis & Censys data to detect evasive URL-based attacks.
Author
Jean Pierre Ruiz Ocampo
25 posts
2025 State of the Internet: Digging into Residential Proxy Infrastructure
Censys ARC Team updates PolarEdge research with key clarifications on Mbed TLS certificates and residential proxy infrastructure. Read our corrected 2025 State of the Internet findings.
Speeding up Threat Hunting with Censys
Reduce defender dwell time with Censys Threat Module. Hunt adversary infrastructure faster, enrich threat intel with MITRE & Malpedia, and act before threats mature.
The End of Stale Indicators
Discover how Censys delivers timely, context-rich threat intelligence on adversary infrastructure. Move beyond stale IPs with actionable IOCs, Actor Profiles & more.
Hunting Botnets With CursorAI, GreyNoise, Censys, and Censeye
Discover how Censys uses CursorAI and GreyNoise data to hunt adversary infrastructure like ORB networks. Learn to identify malicious SOCKS proxies in residential networks.
JunOS and RedPenguin
**Censys ARC Research Team uncovers RedPenguin malware targeting Juniper MX routers with advanced C2 techniques, UDP backdoors & Tiny SHell. Learn how attackers evade detection.**
Hey, that's not my server!
Learn why legitimate TLS certificates appear on suspicious hosts. Discover how CDN providers like Cloudflare and Akamai handle null SNI requests, enabling proxy-based deception.
On the Internet, Everything Old is Exploitable Again
New data reveals attackers are massively exploiting old, known vulnerabilities—many 5+ years old. Learn why legacy CVEs remain top targets and how to defend against them.
Investigating the Vast World of ICS Coverage: Part 2
**Discover how Censys ARC's "port tweaking" method uncovered 200+ hidden ICS protocols on non-standard ports, plus insights from full 65K port scans for Modbus, Fox & more.**
How Realistic Is Netflix's Zero Day?
The Censys ARC team breaks down Netflix's Zero Day—its wild tech inaccuracies, absurd hacking scenes & why it joins the ranks of hilariously unrealistic cyber thrillers.
Investigating the Vast World of ICS Coverage: Part 1
Discover how Censys scans non-standard ports to uncover hidden ICS protocols like Modbus, ATG & more. Learn how targeted research boosted protocol coverage by up to 2.8x.
The Lurking Threat of Edge Security Products
Discover why edge security devices are now top targets for attackers. Learn about critical vulnerabilities in VPNs, firewalls & how attack surface management can protect your network.
Weakening Encryption Does Not Strengthen Security
What It Means for Global Privacy** `Apple faces a secret UK order to weaken Advanced Data Protection encryption for iCloud backups. Learn how this impacts global privacy and sets a dangerous precedent.`
The Long Tail of BeyondTrust [CVE-2024-12356]
Critical BeyondTrust vulnerability CVE-2024-12356 exposes 778+ on-prem hosts. Censys research reveals exposed PRA & RS instances, state-actor exploitation & risk analysis.
Baicells: A Retrospective
Censys ARC team reveals analysis of internet-exposed Baicells telecom devices, CVE-2023-24508 & CVE-2023-0776 vulnerabilities, and findings supporting the Reuters FBI investigation.
Pivoting for Nosviak
Censys uncovers a Nosviak botnet network powering DDoS-as-a-Service operations across 150+ hosts. Explore our threat intelligence research into this C2 ecosystem.
How the New White House Executive Order Can Up-Level the U.S. Cyber Game
Biden's cybersecurity executive order strengthens federal software supply chain security. Learn how new government policies address critical infrastructure cyber risks and threats.
Will the Real Volt Typhoon Please Stand Up?
Track how Volt Typhoon's KV Botnet infrastructure evolved after FBI disruption. Censys research reveals JDY cluster C2 servers, hosting changes, and 2024 activity insights.
How Censys Search Helps Prevent Phishing Attacks by Monitoring SSL/TLS Certificates
# SEO-Optimized Meta Description **Discover how attackers exploit SSL/TLS certificates in phishing attacks and why certificate management is critical to phishing prevention. Learn key defense strategies with Censys Search.** *Characters: 158* --- **Why this works:** - **Under 160 characters** ✅ - **Primary keywords included:** "phishing attacks," "SSL/TLS certificates," "certificate management," "Censys Search" - **Action-oriented opener** ("Discover") encourages clicks - **Addresses a pain point** (exploitation of certificates) to attract security professionals - **Includes the brand tag** (Censys Search) for branded search relevance - **Implies actionable value** ("Learn key defense strategies") to boost click-through rate
Censeye: Gadgets!
Discover Censeye Gadgets – a new plugin system for extending threat intelligence research. Learn how query generator and data labeling gadgets help uncover adversary infrastructure.
Automated Hunting
Discover how to uncover hidden patterns in Censys data with our free Censeye tool. Learn expert pivot techniques to identify suspicious infrastructure and track threats effectively.
Understanding the CUPS Vulnerability: What’s important to know
# SEO-Optimized Meta Description **CUPS Linux Vulnerabilities (CVE-2024-47176): What you need to know about the critical RCE flaws, real-world risk, scope of vulnerable systems, and how to protect your network.** **Character count:** 158 --- ### Why This Meta Description Works: | Element | Details | |---|---| | **Keywords** | CUPS, Linux, CVE-2024-47176, RCE, vulnerabilities, vulnerable systems | | **Compelling hook** | "What you need to know" creates urgency and promises clarity | | **Addresses search intent** | Targets users searching for information about the CUPS vulnerability disclosure | | **Action-oriented** | Implies the reader will get actionable guidance ("how to protect") | | **Under 160 characters** | ✅ Fits within Google
Simplify Threat Investigations: Identify Suspicious Open Directories with Censys Search
Discover suspicious open directories faster with Censys Search's new "suspicious-open-dir" label. Hunt threat actor infrastructure, malware, and C2 servers efficiently.
Enhance Your Infrastructure Monitoring with Censys Attack Surface Management
Discover how infrastructure monitoring and Attack Surface Management (ASM) work together to secure your digital ecosystem.
The Global Impact of CVE-2024-24919 in CheckPoint VPN Gateways
Discover Censys research on CVE-2024-24919: 13,754 exposed Check Point VPN gateways globally. Get stats on vulnerable devices, patching rates, and risk analysis.