TI-2026-061G — The One-Way Mirror

Classification: HIGH · Mass Reconnaissance · Internet "Observatories" / Exposure Indexing Confidence: HIGH on the tooling integration (Metasploit/nuclei/OWASP, in-corpus); MEDIUM on the architectural claims about scanning and sales, from public design. TLP:WHITE — public tooling, public products, public research. Series: The Fake Umbrella — Part G. G is for GreyNoise. They call it an observatory — a neutral place from which to watch the weather of the internet. But the observatory also makes the weather, sells the forecast to the storm, and you are not allowed to look back in. Facts are facts. They are good for some and bad for others. You decide.

The seed: the "observatory" is a menu item in the attack framework

In 061A a scanner told us its name. Here the seed is a line of the attacker's own toolkit. Open the Metasploit framework — the offensive platform of Part E — and among its reconnaissance modules you find these, verbatim from our corpus:

auxiliary/gather/censys_search   → "uses the Censys REST API to access the same
                                    data accessible through the web interface…
                                    queries against the Hosts dataset"
auxiliary/gather/leakix_search   → search exposed services and data leaks

And in nuclei — the scanner everyone runs — templates carry a field called shodan-query:, used to locate exposed cabinets, unpatched cameras, even live Quasar RAT command-and-control by its certificate. Read what that means. The "neutral internet observatories" — Shodan, Censys — are not a defender's dashboard that attackers happen to misuse. They are wired directly into the attack framework as target-discovery modules. You run use auxiliary/gather/censys_search, and the observatory hands you a map of who is exposed. OWASP's own testing guide lists them as standard reconnaissance. The map of the internet's weaknesses is a first-class weapon input — and it is sold, by subscription, as a public good.

What an "observatory" actually is

The word is chosen to sound passive and benign — an observatory watches, it doesn't touch. But that is exactly backwards. These firms are among the busiest scanners on the entire internet:

• Censys grew directly out of ZMap, the University of Michigan tool built to scan the entire IPv4 internet in minutes. It scans everything, continuously, and sells the resulting Hosts and Certificates datasets via API.
• Shodan crawls every reachable service, grabs its banner, and indexes it — your router, your camera, your database, your industrial controller — into a searchable catalogue.
• GreyNoise runs a global sensor grid to watch who else is scanning, and sells that intelligence.

So the "observatory" that claims to neutrally report the weather is, in fact, the entity generating the largest share of the unsolicited scanning traffic on the map. It knocks on every door on Earth, without consent, logs what it finds, and sells the ledger. Calling that an observatory is like calling a company that photographs through every window on the planet a weather station. The passivity is in the name only.

The one-way mirror

Now the asymmetry that gives Part G its title, and it is sharpest at GreyNoise. Its product is surveillance of the scanners — a live catalogue of who is probing the internet, from where, for what. Used narrowly, it is genuinely helpful: it lets a defender ignore the benign background hum and focus on the real threat. But look at the shape of the relationship:

• The observatory sees you — every service you expose, every scan you emit, timestamped and catalogued.
• You cannot see the observatory — you cannot query who queried you, who bought the row about your network, or how your exposure is being priced and to whom.
• The observatory is not itself observable on the terms it imposes on everyone else. It watches the watchers, and answers to none of the watched.

That is a one-way mirror. Total sight of you; zero accountability to you. And the thing being sold through the glass is not an abstraction — it is a single, queryable index of the entire internet's weaknesses. Whatever the intent of any individual customer, an aggregated, searchable map of every exposed system on Earth is a targeting database. Giving it a calm, academic name does not change what a hostile subscriber does with a query.

The symmetric search box

Here is the structural point the "we help defenders" framing cannot escape. A Censys or Shodan query that lets your security team find your forgotten exposed database is, byte-for-byte, the query that lets an attacker find someone else's. There is:

• one search box,
• one price list,
• and no mechanism by which the index can serve the defender without equally serving the attacker.

We have proof the attacker side is real and routine, because it is compiled into their tools: Metasploit's censys_search, nuclei's shodan-query, OWASP's recon guide. The defender uses the observatory to find their exposure before the attacker does; the attacker uses the identical observatory to find it first. The map does not choose. It sells the same view to both, and — per the vendors' own enterprise sales — to government and defense customers besides. This is the exact structure 061A found in LeakIX, which describes itself as "similar to Shodan or Censys." Part G is simply the whole category, and the layer above it that watches the watchers.

The seven questions

Who is this? Internet-exposure observatories — Shodan, Censys, GreyNoise (and LeakIX, from 061A) — that scan the internet, index what they find, and sell query access.

Why did it attack? To stock the index. The continuous, consent-free scanning is the data-collection step of a subscription product.

Who does it claim to be? A neutral observatory / research utility / defender's early-warning system. Passive, benign, on everyone's side.

Whom is it related to? The attacker toolchain, intimately — its APIs and dorks are compiled into Metasploit and nuclei; and the wider exposure-index market (LeakIX/061A) and its government/defense buyers.

Where is the money? API tiers and enterprise subscriptions to query the index (and, for GreyNoise, to query the surveillance-of-scanners). The scanned world generates the value; the observatory captures it; the scanned are not paid and did not consent.

What is the official anchor? Academic and "research" legitimacy (ZMap/Michigan lineage; "internet measurement"), which lends the extraction a neutral, scholarly gloss.

What if it is not who it claims? It is who it claims — a real, useful observatory. The finding is that a real, useful observatory of everyone's weaknesses, sold to anyone, watching from behind a one-way mirror, is a surveillance and targeting utility regardless of the calm name.

What if…

• What if GreyNoise genuinely reduces false alarms? It does, and that value is real — a defender drowning in scan noise is helped. But being helpful to subscribers does not dissolve the asymmetry: the same system that de-noises your alerts is a catalogue of everyone's scanning and exposure, sold from behind glass you cannot see through.
• What if the data is all "already public"? Each open port is individually visible, yes. The harm is the aggregation: turning billions of scattered, ephemeral facts into one durable, searchable, priced index is a new capability, not a mirror of the status quo — which is precisely why people pay for it.
• What if defenders need this to keep up with attackers? They do — because the attackers have it, because it was sold to them too. "We must arm the defense with the same map we sold the offense" is an argument for the map's symmetry being a problem, not a defense of it.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Internet observatories are a public good and a research triumph. They let organisations discover their own exposed assets, let researchers measure the internet's security, and — GreyNoise especially — cut the noise so defenders focus on real threats. The data is already public; indexing it is legal and transparent; the vast majority of use is defensive. Attackers would scan anyway; at least this arms the defenders equally."

Where it breaks:

• "Arms the defenders equally" concedes it arms the attackers. Equality of a targeting map between predator and prey is not a public good; it is a wash that the vendor is paid for either way. The symmetry is the indictment, restated as a selling point.
• "Already public" understates aggregation. A dispersed, transient exposure and a permanent, queryable, cross-indexed record of it are different objects. The second is a manufactured capability — the reason there is a price — not a neutral reflection of the first.
• "Transparent and legal" is the 061A finding again. Openness makes the extraction respectable, not neutral. A one-way mirror is still one-way when it is honest about being a mirror.
• The one true thing: the defensive value is genuine — finding your own exposure and de-noising alerts really do help, and researchers really do learn from internet measurement. That legitimate core is real, and it is the fig leaf: it does not neutralise a paid, symmetric, government-supplying index of the whole world's weaknesses, watched from behind glass, feeding the attacker's own tools.

Verdict: internet measurement and self-exposure discovery are legitimate and useful. The observatory as built — a consent-free mass-scanner selling a symmetric targeting index and a one-way surveillance of the scanned — is HIGH. "Observatory" is not a mitigation. It is the serene name on a chokepoint that sees everyone and answers to no one. Confidence: HIGH on the attacker-toolchain integration; MEDIUM on the architectural framing, from public design.

Read between the lines

Notice the vocabulary the category chose: observatory, measurement, noise, weather. Every word is drawn from astronomy and meteorology — the two sciences that watch things too distant and too vast to affect, from a position of pure, powerless observation. It is the most reassuring possible frame: we are only looking at what is already there. But an astronomer's star does not get compromised because it was catalogued, and the weather does not have an attacker who buys the forecast. The metaphor is chosen precisely because it drains agency from an act that is dense with it — scanning the whole world without asking, and selling the atlas of its weak points to both sides and the state. The calm of the word is the cover. You do not name a targeting database "the weather" by accident.

The human layer

A small hospital has a forgotten server, exposed by a contractor years ago and never decommissioned. It sits there quietly, breaking no alarms. Three parties can see it at this moment through the same pane of glass: the hospital's own overstretched IT person, if they think to search and can afford the query; an attacker running nuclei with a shodan-query, who did not have to think about the hospital at all because the observatory volunteered it; and the observatory itself, which has known about the server the whole time, catalogued and priced, and owes the hospital nothing — not a warning, not a call, not even the right to ask who else has looked. If the hospital is lucky and diligent and funded, it finds the server first and closes it, and the observatory "helped." If it is not, the first hand on that server belongs to whoever paid for the same view with worse intent, and the interface behind the mirror recorded both visits impassively, because it was built to sell the seeing, not to care about the seen.

Defense — use the map, distrust the mirror

(1) Use it on yourself, first and often. Query Shodan/Censys against your own ranges before an attacker does — the defensive value is real and you have already paid for it in exposure; take it. (2) Assume the attacker has the same view. Anything the observatory can see about you is already, functionally, in the target list; remediate exposed services on that assumption, not on the hope that no one looked. (3) Name the asymmetry when you buy. A GreyNoise-class subscription is useful — and it is a one-way mirror; know that your money rents a seat behind glass that others are renting to look at you. (4) For policymakers: an aggregated, sold index of a nation's exposed critical infrastructure is a strategic asset, not "measurement"; regulate the aggregation and sale, not the individual open port, because the calm name is doing work the risk does not deserve.

Investigation metadata

Next — TI-2026-061H: H is for "Threat intelligence" — how the feeds that promise to warn you about the targets quietly become the list that targets them, and the fine line between a blocklist and a kill-list.

They named it after the sciences that only watch — astronomy, meteorology — so that scanning the whole world without asking would sound like stargazing. But the star is not compromised by being seen, and the weather has no one buying the forecast to aim the storm. The observatory sees every window on Earth, sells the map to both sides and the state, and stands behind a mirror you may never look through. Facts are facts. They are good for some and bad for others. You decide.