From Scanning to Self-Assessment: Using ZoomEye to Inventory Your Own Attack Surface

Internet-wide scanners are a double-edged tool. Attackers use them to find exposed systems; defenders can use the same capability to discover what they have accidentally exposed. In 2026, government advisories have repeatedly pointed to scanning services as part of the attacker's workflow, which makes the defensive use of the same data both practical and urgent. This article explains how to turn ZoomEye measurement into a self-assessment routine.

The problem and why it matters

Most organizations do not have a complete, current picture of what is reachable from the internet. Assets are added by different teams, exposed temporarily for a project, and forgotten. Attackers do not rely on the organization's inventory; they rely on the internet's actual state. The gap between the two is where breaches begin. In the August 2026 advisory on Siemens S7 PLCs, the scanning step was explicit: attackers used services like Censys and ZoomEye to find exposed controllers before generating exploits.

Context and method

The approach is straightforward. For each technology an organization runs, construct a fingerprint query and check whether any of its own assets appear. The counts below, collected with ZoomEye on 2026-09-19 (sub_type "all", pagesize one), illustrate the scale of common technologies and give a sense of which fingerprints return meaningful results.

• app="nginx" returned 309,196,565 matches and app="Apache" returned 594,958,906, showing how ubiquitous web servers are.
• app="WordPress" returned 7,881,967 and app="Exchange" returned 2,357,417, two of the most commonly exposed application platforms.
• app="VMware" returned 1,423,789 and app="Fortinet" returned 4,523,889, reflecting large virtualization and network-security footprints.
• app="MongoDB" returned 680,348, a database that should rarely be internet-facing. These figures are global totals, not an organization's own exposure. Their value is as a reference point: they show that the technologies most organizations run are also the technologies most present on the open internet, which means accidental exposure is common.

Interpretation and practical value

The self-assessment workflow has four steps. First, enumerate the technologies the organization runs and the fingerprints that identify them. Second, run scoped queries and compare the results to the internal asset inventory. Third, investigate every match that the inventory does not explain. Fourth, remediate by removing unnecessary exposure and patching what must remain public.
The most valuable output of this process is the unexpected match: a service that appears in an external scan but not in the inventory. That is an unknown exposure, and it is exactly the kind of asset attackers find first. Treating each unexpected match as a finding, rather than dismissing it as a false positive, is what makes the routine effective.

Implications and next steps

• Build a fingerprint list for your technologies. Map each major platform to a query that identifies it.
• Run the comparison on a schedule. Exposure changes as assets are added and removed.
• Prioritize unexpected matches. An asset you did not know was public is the highest-value finding.
• Combine measurement with patching. Exposure plus an unpatched version is the dangerous combination.
• Keep the process defensive. The same queries that find your exposure also find an attacker's targets; use them to close gaps, not to scan systems you do not own. ZoomEye's practical value for defenders is that it answers a question inventories often cannot: what does the internet actually see? For organizations that want to reduce their attack surface, that answer is the starting point.

References

• ZoomEye queries executed 2026-09-19 (sub_type=all, pagesize=1): app="nginx"; app="Apache"; app="WordPress"; app="Exchange"; app="VMware"; app="Fortinet"; app="MongoDB".
• Joint advisory AA26-231A (NSA, CISA, FBI, DOE, EPA), 2026-08-19 (attacker scanning via Censys and ZoomEye).
• CISA Known Exploited Vulnerabilities Catalog, retrieved 2026-09-19.