Host Reputation

In the Censys Platform, hosts are assigned a reputation score that describes whether they are benign or malicious. This score enables you to prioritize alerts with IP indicators faster and perform triage and analysis more effectively with a transparent and consistent scoring methodology.

Reputation scores and their attendant data are only available to Censys Enterprise users. Additional score context data is available to Censys Enterprise users with access to the Adversary Investigation module. See the entitlement table below for more information.

Video overview

Score details and data

Hosts are assigned a score ranging from 0 (benign) to 100 (malicious). This score is visible on host preview and detail cards in the Platform web UI and is present in the host.reputation data object for searching across in the UI or API.

Ranges for each reputation score level are described below.

Reputation scores are determined based on the following criteria.

Reputation score criteria weighting and formula

The weighting system is structured to ensure that any asset identified with a single, validated threat signal, such as an active phishing domain, is immediately classified in the High Risk (61-80) or Malicious (81-100) categories in the user interface.

For example, when a confirmed threat matches a primary risk factor like the presence of offensive tooling, the calculation is designed to result in a sufficiently high score (in the range of 81 or higher) to accurately reflect its true severity.

The formula for determining a reputation score is as follows.

• The values for phishing_impersonation_and_deceptive_activity, network_infra, and anonymization_infra will be 0 if the signal is not present. The value will be 1 if the signal is present.
• Values for command_and_control_and_offensive_tooling can be the following:
  • 1 if a threat or C2 tool was present in the Censys scans of the host within the past 7 days.
  • 0.75 if a threat or C2 tool was observed by Censys scans in the from 7 to 30 days.
  • 0.5 if a threat or C2 tool was observed by Censys scans from 30 to 60 days.
  • 0 if a threat or C2 has not been observed by Censys scans or was present over 60 days ago.

Reputation score = ((command_and_control_and_offensive_tooling * 0.82) + (phishing_impersonation_and_deceptive_activity * 0.82) + (network_infra * 0.42) + (anonymization_infra * 0.42)) x 100

While the raw calculation for an asset that matches multiple categories could potentially result in a score above 100 (such as 124), the final Reputation Score is capped at 100 to ensure it remains within the 0-100 range.

Reputation score in the UI

A host's reputation score is shown on search result cards and on the host details page.

On host detail cards, click the Reputation tab to see additional detail about the asset's score, including the evidence categories used to determine the host's score and the host data associated with each category.

Reputation score data

Reputation score data can be searched across in the UI or retrieved via API by targeting the host.reputation object. Note that score values are floating integers containing up to three decimal places. A reputation score of 81 in the UI is represented in the data as 0.81.

Reputation score data availability

The following table describes which data fields are available to different user entitlement levels.

Historical reputation score data

Historical reputation score data is not available. On historical hosts, the reputation score shown in the raw data is the reputation score based on the most recent scan data. It is not reflective of the reputation score of the host at a particular point in time.