BitSight Internet Census — the 17 scanner /24, ASN ownership and FCrDNS methodology

Under the "Internet Census Group" brand, BitSight runs an internet-wide security / asset-discovery scanner — comparable to Shodan, Censys or Driftnet. Unlike Driftnet, however, BitSight publishes no official IP list, only an FCrDNS methodology. Here are the empirically determined 17 /24 (part of our PARC Security feed) and how we verified them via ASN ownership and reverse DNS.

bitsight.json — view feed   internet-census.org →

The determined ranges

A total of 4,352 IPs across 17 × /24:

45.156.128.0/24     185.180.142.0/24
45.156.129.0/24     185.180.143.0/24
45.156.130.0/24     185.226.196.0/24
45.156.131.0/24     185.226.197.0/24
109.105.208.0/24    185.226.198.0/24
109.105.209.0/24    185.226.199.0/24
109.105.210.0/24    185.117.225.0/24
109.105.211.0/24    185.180.140.0/24
185.180.141.0/24

This list does not exist as an official download — we derived it from the ASN ownership of AS211680 (NSEC, RIPE Stat) and validated it via FCrDNS against *.internet-census.org. All 17 /24 are NSEC-owned (IRR + RPKI valid).

What BitSight / Internet Census Group is

BitSight Technologies, Inc. (US, HQ Boston, founded 2011) is a cybersecurity ratings firm — it sells external security ratings to insurers, M&A buyers and supply-chain risk managers. A direct competitor of SecurityScorecard, the parent company of Driftnet.

The scanning infrastructure runs through the Portuguese subsidiary NSEC - Sistemas Informaticos, S.A., which joined the group via BitSight’s acquisition of AnubisNetworks (27 October 2014). The public brand name of the scanning programme is “Internet Census Group” (internet-census.org, “led by BitSight Technologies, Inc.”); the scanner’s internal codename is “Groma”.

According to BitSight, it scans for the risk vectors TLS/SSL certificates and configurations, open ports, web application headers and server software — plus the most important ICS/OT protocols (Modbus, BACnet, Ethernet/IP, DNP3 and others).

ASN constellation

• AS211680 — NSEC - Sistemas Informaticos, S.A. (AS-BITSIGHT): BitSight's own ASN, originates all NSEC-owned subnets. IRR + RPKI valid.
• AS21859 — Zenlayer Inc.: hosting partner for most of the pools (Dallas, Los Angeles, Amsterdam).
• AS32475 — Internap (formerly SingleHop): hosting partner for several pools (Chicago, Phoenix, ORD, Santa Clara).
• AS14618 — Amazon / AWS: one pool (ICG-1-AMAZON = BitSightBot, 185.117.225.0/24).
• AS396982 — Google LLC / GCP: one pool (ICG-1-GOOGLE, MOAS origin).

The hoster is only the location in each case — ownership and control of the ranges sit with NSEC/BitSight (AS211680).

FCrDNS methodology and result

We scanned all 4,352 IPs of the 17 /24 via forward and reverse DNS (resolvers 8.8.8.8 and 1.1.1.1) and checked them against the suffix *.internet-census.org with forward verification back to the original IP.

Operationally active scanner IPs (FCrDNS + FWDMISS): ~1,139. Co-tenants in the scan: none (serial re-check of all questionable entries — all DNS races, 0 genuine third-party IPs).

The PTR scheme reveals hoster, location and worker:

Why all 17 /24 belong in the feed

The PTR-empty (“NOPTR”) pools are not dead reserve stock: all ICMP ping samples from the reserve /24 respond with 0 % packet loss — the IPs are live, allocated and routed, and NSEC uses them as outgoing probes without PTR branding. Together with the consistent ICG-{N}-{HOSTER}-{LOCATION} naming, this means BitSight rotates internally and any IP can become an active census worker at any time. That is why the full allocation (17 /24, 4,352 IPs) is in the feed, not just the currently 942 strictly verified ones.

BitSightBot — a separate user-agent

Alongside the census scanner (which performs port/protocol probes and sets no specific user-agent), there is a distinct HTTP bot from the AWS pool 185.117.225.0/24:

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0

This block is included in the feed — for HTTP/HTTPS probes, an additional validation via the user-agent token BitSightBot is possible.

No official list, but no stealth either

Unlike Driftnet, BitSight publishes no IP list — only the FCrDNS methodology against *.internet-census.org plus an opt-out address (optout@internet-census.org, valid for six months, then renewal required). But there is no stealth behaviour: no Googlebot impersonation, consistent PTRs, honest ASN attribution. So the list here is not a leak but the clean derivation from publicly visible ASN ownership.

Deliberately NOT in the feed

• survey.internet-census.org resolves to rotating AWS S3 endpoints (16.x / 52.x / 54.x) — not NSEC-owned IPs, not blockable as a fixed list. Probably used to upload scanner data, not for scanning itself.
• IPv6 /48 from AS211680 exist (including 2a10:3c0:2::/48, 2a10:3c0:100::/48, 2a10:3c0:101::/48) but are not yet fully verified and therefore currently not in the feed.
• Historical census IPs (2014–2018, SingleHop/Linode) are completely dead today (no PTR match) — no blocking value.

Distinction from Driftnet

Both are internet-wide security scanners, but completely disjoint — not a single overlapping block, different ASNs. They run as two independent feeds with no duplicates.

Sources

• internet-census.org — FCrDNS methodology & opt-out
• BitSight KB — Groma Internet Scanning Infrastructure (July 2024)
• BitSight Blog — Groma Next-generation Internet Scanning
• BGP.he.net — AS211680 NSEC (AS-BITSIGHT)
• RIPE Stat — AS211680 announced prefixes
• NetworksDB.io — NSEC Sistemas Informaticos
• AnubisNetworks — BitSight acquisition (2014)
• DarkVisitors / Known Agents — BitSightBot user-agent
• Wikipedia — BitSight

← Back to PARC Security   Contact us