Censys maps real-time DNS data to internet infrastructure

Censys has expanded its Internet Map to include real-time DNS data, offering security teams a unified view of domains, IPs, and infrastructure. This update allows analysts to pivot between name-based and IP-based information without switching tools, streamlining workflows that previously required multiple datasets. The integration of DNS data into the Internet Map enables security teams to analyze the evolution of infrastructure over time, replacing fragmented intelligence with cohesive insights. By connecting domains, DNS records, IPs, hosts, services, and certificates, analysts can identify complex relationships between different components of internet infrastructure.

Unified View of Internet Infrastructure

The new feature connects domains, DNS records, IPs, hosts, services, and certificates into a single interface. Analysts can now trace how infrastructure evolves over time, replacing fragmented intelligence with cohesive insights. This integration helps identify connections that might otherwise go unnoticed in isolated datasets. The unified view also enables analysts to understand the names associated with internet infrastructure, allowing them to pivot seamlessly between name-based and IP-based infrastructure. By analyzing the historical relationships between different components, security teams can gain a deeper understanding of the underlying infrastructure and identify potential vulnerabilities.

Security operations now benefit from faster decision-making across four key stages. In triage, suspicious domains can be quickly validated against associated infrastructure. During investigations, analysts can explore relationships between domains, IPs, and historical data to map incident scope. Hunting efforts gain depth by tracing a single indicator to broader adversary networks. Defensive strategies also improve by uncovering threat infrastructure before attacks materialize. The ability to analyze DNS records and IP addresses in a single interface enables security teams to identify patterns and anomalies that may indicate malicious activity.

Real-World Impact on Security Operations

Censys customers have used the updated tool to disrupt phishing campaigns at scale. A recent case involved a USPS-themed attack where one malicious domain exposed hundreds of related phishing sites and historical DNS links. This visibility allowed defenders to address the entire campaign, not just individual indicators. The ability to analyze historical DNS relationships also helped security teams identify phishing sites that were no longer active, but had been used in the past. By understanding the broader campaign infrastructure, defenders can take proactive measures to prevent future attacks.

Raj Sivasankar, Senior Director of Product Management at Censys, said security teams rely on fragmented intelligence from multiple tools. By integrating DNS into the Internet Map, they give defenders a unified platform to understand threat infrastructure and uncover broader campaigns as attacks grow more automated. The reduction in manual cross-referencing between tools saves time and reduces error risks, allowing security teams to focus on higher-level analysis and decision-making. The unified view also enables security teams to analyze the relationships between different components of internet infrastructure, identifying potential vulnerabilities and weaknesses that can be exploited by attackers.

This change reduces the need for manual cross-referencing between tools, saving time and reducing error risks. For organizations facing increasingly complex threats, the ability to see infrastructure relationships in context could mean the difference between reacting to isolated incidents and preventing large-scale breaches. The integration of DNS data into the Internet Map also enables security teams to analyze the evolution of infrastructure over time, identifying patterns and trends that may indicate malicious activity. By analyzing historical DNS relationships, security teams can gain a deeper understanding of the underlying infrastructure and identify potential vulnerabilities.

They can now trace historical DNS relationships that live queries might miss. This capability helps security teams build a more complete picture of campaigns, even when attackers use short-lived or obfuscated domains, which is similar to how cyber readiness is tested with AI attack simulations. The ability to analyze historical DNS relationships also enables security teams to identify patterns and anomalies that may indicate malicious activity, allowing them to take proactive measures to prevent future attacks. By integrating DNS data into the Internet Map, Censys provides security teams with a powerful tool to analyze and understand the complex relationships between different components of internet infrastructure.

Censys’ update has a practical effect on security teams. It allows them to focus on prevention rather than reaction. By analyzing the relationships between different components of internet infrastructure, security teams can identify potential vulnerabilities and weaknesses that can be exploited by attackers. The unified view of internet infrastructure enables security teams to take a proactive approach to security, analyzing potential threats and vulnerabilities before they materialize. This proactive approach enables security teams to stay one step ahead of attackers, preventing large-scale breaches and minimizing the impact of security incidents.