Learn how to pivot from an IOC to a full DFIR history with two real-world examples that draw on recent Censys ARC research.

Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.

New Censys ARC research examines an exposed server containing Moobot botnet source code, active attack records, DoS tooling, and a fraudulent identity verification service.

ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […]

A deep look at how Mirai and its descendents have evolved over the past decade — and why the botnet's methodology still works today.

Learn about Censys' new IOC Investigator: an AI-powered threat investigation feature that automates pivoting, infrastructure mapping, and host profiling.

Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.

CISA alert: Threat actors targeting PLCs in Water and Wastewater Systems. This report includes current Censys-observed internet exposure for each named vendor.

Cl0p's recent targeting of Windchill shows that Internet-exposed enterprise back office software remains a high value target for threat actors.

AI makes vulnerability discovery and exploitation faster than defenders can patch. Learn why attack surface reduction—not faster patching—is the path forward, and how Censys ASM helps.

Censys delivers Internet intelligence as a foundational layer to all security operations: triage, investigate, hunt, and defend.

Get an early look at Censys' 2026 State of the Internet Report, including Internet-exposed AI infrastructure and shifting global trends in ICS exposures.

ANN ARBOR, Mich. – July 22, 2026 – Censys, the authority in Internet intelligence and insights, today announced record first half 2026 growth, reflecting growing enterprise adoption of Internet intelligence as organizations accelerate security modernization and deploy AI-enabled security workflows. Key first half 2026 highlights include: As AI-enabled attacks accelerate, organizations require comprehensive, accurate, and […]

Learn how to operationalize Censys intelligence by building custom feeds with the Collections API and pushing to OpenCTI.

Censys ARC investigates the Russian camera-hacking espionage campaign against countries in the EU, NATO, and Ukraine.

Censys is introducing Unlimited Enrichment, a host enrichment API that doesn’t draw down your credit balance. Here's how it works.

Learn how Censys Active DNS supports NIST CSF 2.0 by connecting domain names to live Internet infrastructure for faster investigation and threat response.

An exploration of Roblox and Minecraft offerwalls and phishing lures — infrastructure that isn’t well covered by conventional threat intelligence.

Over 70% of publicly visible WordPress sites are running outdated PHP. See Censys data on EOL software risks across the WordPress ecosystem.

DLP monitors movement. Censys discovers exposure. You need both; this blog shows you how to find the second one, with queries you can run today.