Tags

Tag	Means	Hosts	With known CVEs
Tor	A Tor relay or exit: traffic from it may come from any Tor user.	1 673	492
VPN	An address of a commercial VPN service.	43 346	20 348
Privacy relay	An egress address of a privacy relay (traffic of many users leaves through it).	136	51
Blocklisted	On at least one current public blocklist of attacking, abusive or malicious addresses.	40 819	10 548
Botnet C2	Listed as a botnet command-and-control server.	373	123
CDN	A content delivery network edge: the site behind it is elsewhere.	3 164 785	8 128
Cloud	In the published address ranges of a cloud provider.	6 874 496	1 020 212
Hosting	A data centre or hosting address rather than an access network.	13 875 219	2 448 596
Database	A database port is open to the internet.	372 526	63 507
Remote access	Remote desktop, VNC or Telnet is open to the internet.	417 940	8 245
Industrial control	An industrial-control protocol port is open to the internet.	8 418	599
AI tool	The web interface of an AI or notebook tool is reachable.	1 174	342
Self-signed certificate	A TLS service presents a self-signed certificate.	1 461 542	181 963
Expired certificate	A TLS service presents an expired certificate.	3 221 747	708 427
End-of-life software	A service reports a software version that is no longer supported.	269 907	132 043
Possible honeypot	Answers on 100 or more ports: likely a honeypot or a tarpit.	1 490	102
Data looks unreliable	1,000 or more CVEs would count, mostly from an operating-system version read off a banner or from two operating systems at once: likely a decoy. Its CVEs are counted nowhere.	36	0