Censys scanner: what it is and how to block it

Censys runs internet-wide scans to build a searchable map of exposed services, so seeing it in your logs usually means your server is reachable, not that someone is targeting you. It publishes the networks it scans from, which makes it easy to verify and block.

How to recognise it

• Networks: Censys lists AS398722, AS398705 and AS398324, along with specific address ranges in its documentation.
• HTTP user agent: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/). Anyone can copy a user agent, so check the address as well.

curl -s "https://isipsafe.com/api/v1/check?ip=167.94.146.54"

Why its addresses can score highly here

A score reflects how many sources reported an address recently. Censys addresses touch many servers, so they collect port scan and similar reports, and can reach the blacklist. A high score shows that the activity is widely reported, not that Censys is breaking into systems. See one example.

Should you block it?

That is your choice. Blocking reduces log noise and keeps your services out of its future results. It does nothing about other scanners or attackers, so you still need to close and patch what is exposed.

How to opt out

1. Block its networks using the current list in the Censys opt-out documentation. Censys says blocking stops new indexing but does not remove historical data.
2. Ask for exclusion by following the same page. It asks for proof that you own the address or domain, and notes that it does not exclude addresses dedicated to cloud hosting.