Moving Beyond the Noise by Filtering Internet Pseudo Services

This Censys analysis examines unexpected and prolific services observed on many non-standard ports, finding that a tiny fraction of "super" hosts—often middleboxes, web application firewalls like Imperva/Incapsula, cache servers, or Portspoof honeypot-like tools—generate large numbers of identical or fake service responses (“pseudo services”) that skew service counts; Censys mitigates this noise by flagging truncated pseudo services and refreshing them less frequently in the Universal Internet Dataset.