From Scanning to Self-Assessment: Using ZoomEye to Inventory Your Own Attack Surface

In the digital landscape, scanning services like Censys and ZoomEye are tools that both attackers and defenders utilize. Attackers leverage these services to identify exposed systems, while defenders can harness the same capability to discover unintentionally exposed assets. The increasing reliance on scanning services by adversaries has been acknowledged in recent government advisories, emphasizing the need for defensive use of the data obtained.

This article explores how to transform ZoomEye measurements into a self-assessment routine. One of the primary challenges organizations face is the lack of a comprehensive and up-to-date inventory of what is accessible from the internet. Assets are frequently added by various teams and may be temporarily exposed for projects before being forgotten.

Attackers do not depend on an organization's inventory; instead, they rely on the real-time state of the internet. This discrepancy between internal and external inventories presents an opportunity for breaches to occur. The August 2026 advisory on Siemens S7 PLCs explicitly demonstrated this by illustrating how attackers utilized services such as Censys and ZoomEye to locate exposed controllers before crafting exploits.

The process of self-assessment using ZoomEye involves several steps. First, identify the technologies that an organization utilizes and construct fingerprint queries to detect these technologies. By running queries such as app=nginx, app=Apache, app=WordPress, app=Exchange, app=VMware, app=Fortinet, and app=MongoDB on ZoomEye, organizations can benchmark their exposure against global statistics.

For instance, the app=nginx query returned 309,196,565 matches, highlighting the ubiquity of web servers. Similarly, app=Apache returned 594,958,906 matches, app=WordPress returned 7,881,967 matches, and app=Exchange returned 2,357,417 matches, indicating that these platforms are commonly exposed on the open internet. Other significant findings include app=VMware with 1,423,789 matches and app=Fortinet with 4,523,889 matches, reflecting the extensive virtualization and network-security footprints.

Interestingly, app=MongoDB returned 680,348 matches, suggesting that this database should rarely be exposed to the internet. These global totals serve as a reference point, demonstrating that the technologies commonly utilized by organizations are also prevalent on the internet, increasing the likelihood of accidental exposure. To effectively leverage ZoomEye for self-assessment, organizations should follow a structured approach.

Begin by compiling a list of technologies and their corresponding fingerprints. Then, conduct scoped queries and compare the results with the organization's internal asset inventory. Investigate any discrepancies where the inventory does not account for matches found in external scans. These unexpected matches represent unknown exposures, which are prime targets for attackers.

Treating each unexpected match as a finding rather than dismissing it as a false positive is crucial to the effectiveness of this routine. Organizations should periodically update their fingerprint lists and run comparisons on a scheduled basis, as asset exposure is dynamic and changes frequently with additions and removals. Prioritizing unexpected matches is essential, as assets that are publicly accessible without proper knowledge pose the highest risk.

Combining this measurement process with patch management further enhances security. Exposure coupled with an unpatched version of software creates a dangerous scenario, as it provides attackers with both an entry point and a potential means to exploit vulnerabilities. Finally, it is imperative to adopt a defensive posture when utilizing these scanning techniques.

The same queries that reveal an organization's exposure can also expose potential targets to attackers. Therefore, using these queries to identify and remediate gaps is crucial. ZoomEye provides defenders with a unique advantage by answering questions that traditional inventories might miss: what does the internet actually see? By identifying and addressing these gaps, organizations can significantly reduce their attack surface and enhance their overall security posture.

References The ZoomEye queries executed on 2026-09-19 include app=nginx, app=Apache, app=WordPress, app=Exchange, app=VMware, app=Fortinet, and app=MongoDB. Additionally, Joint Advisory AA26-231A, issued by NSA, CISA, FBI, DOE, and EPA on 2026-08-19, highlighted the risk of attackers scanning systems via Censys and ZoomEye. The CISA Known Exploited Vulnerabilities Catalog was also referenced on 2026-09-19 for further context.