CensysInspect in Your Access Log: Censys Internet-Wide Scanning

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)

What it is

CensysInspect is the user agent of Censys, a company that maps the internet’s exposed services. Censys says it makes “a small number of harmless connection attempts to every IPv4 address worldwide each day” and records what each service answers in its dataset of internet hosts. The header carries Censys’s URL, so anyone reading their log can look it up.

On our own server the requests were exactly that kind of light touch: about two hundred in the last 30 days, spread over about ninety addresses, asking for /, /.well-known/security.txt, /app-ads.txt and /robots.txt (counts above). No secret files, no exploit payloads.

Who sends it

Censys, Inc., founded by computer scientists at the University of Michigan. Censys scans from subnets it lists publicly, and says that blocking those addresses “is sufficient to prevent your device from appearing in our IPv4 dataset”. The opt-out page has the current ranges. Those ranges are also how to tell a real CensysInspect request from a copy: anyone can send the header, but only Censys sends it from Censys’s subnets.

Is it a threat?

No. It is reconnaissance in the plain sense of the word (MITRE ATT&CK T1595, active scanning) — but announced, light, and published under the operator’s name. The real question is what Censys sees: if a service on your server answers Censys, it answers everyone, including scanners that never say who they are. Use the visit as a reminder to check what is exposed.

How to handle it

1. Leave it alone unless you have a reason to keep your server out of Censys’s dataset.
2. To opt out, block Censys’s published subnets at the firewall; by address, not by user agent, because the subnet list also covers connections that never send an HTTP request.
3. Search your own data: an attacker’s view of your server is no smaller than Censys’s.
4. Censys asked our server for /.well-known/security.txt. Publishing one, as RFC 9116 describes, tells researchers who find a problem where to report it.

Count Censys’s requests and the paths it asked for:

grep 'CensysInspect' /var/log/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head

If you only want to keep its HTTP requests out of your application logs, refuse the user agent in nginx (server block) — the firewall block above is the actual opt-out:

if ($http_user_agent ~* "CensysInspect/") {
    return 403;
}

The web probe reference explains what the unannounced scanners in the same log are after.