One Day of US Attack Surface: 199,400 Services, Zero Exploitation

Everybody in this industry talks about advanced persistent threats. Nobody talks about the fact that on a random Tuesday, 2,509 Android devices in the United States are answering Debug Bridge commands from the public internet, and 730 databases are sitting on port 3306, 5432, or 6379 like they were configured in 2009 and never looked at again.

We spent one day collecting passive exposure telemetry across US address space. No exploitation. No authentication attempts. No brute force. We knocked, recorded who answered and with what, and built a classified dataset out of the responses. This post is the aggregate view: what the boring internet actually looks like when you count it honestly.

1. Method: Knock, Record, Classify

The collection is passive in the sense that matters: we observe service banners and fingerprints that any internet scanner already emits. What we did not do: exploit anything, guess credentials, walk directory trees, or touch a host beyond the initial handshake that any monitoring system would log anyway.

Every observation was normalized into a per-host record: service class, product and version fingerprint, ASN and organization attribution, registered domain join where the host had one, geo, and TLS certificate detail where the service spoke TLS. Raw capture payloads stay internal. What we publish and sell is the classified layer, not the captures.

2. Coverage

unique IP addresses:        156,371
host:service observations:  199,400
hosts with hostname joins:   98,993
hosts with SSL detail:       49,378
geography:                   United States
collection window:           ~1 day, continuous

Half the corpus answers on 443 or 80. The interesting half is everywhere else.

3. The Risk Segments (the part that should annoy you)

34,418 hosts carry at least one exposure flag. The distribution is not subtle:

ntp_amplifier        18,432   DDoS reflection vectors, free to use
panel_exposed         7,152   admin panels answering publicly
media_server_exposed  2,700   Plex, mostly unpatched, mostly home users
mail_exposed          2,648   Exim. See: every Exim CVE since 2019
adb_exposed           2,509   Android Debug Bridge. From the internet.
router_cwmp_exposed   1,635   TR-069 router management. ISP-grade negligence.
ftp_exposed           1,442   plaintext credentials, still, in 2026
db_exposed              730   MySQL/Postgres/Redis/Mongo on public IPs
k8s_api_exposed           76   Kubernetes API servers. Anonymous access.
smb_exposed               59   port 445. EternalBlue was seven years ago.
winrm_exposed             67   remote shell, no TLS, no excuses

The ADB number deserves a minute. Android Debug Bridge on port 5555 is a root-equivalent shell on someone's phone, TV stick, or IoT board. The attackers know this. ADB command capture is a whole honeypot category now. The defenders apparently don't, because the count isn't going down.

The 730 databases are worse. A public MySQL or Redis instance is not a configuration, it's an abandonment. And 76 Kubernetes API servers answering publicly means 76 clusters where the entire workload inventory, secrets, and orchestration surface depend on whether the anonymous-auth flag was left in its default state.

4. Who Runs This (the infrastructure cut)

Classified by operating organization: 68,705 observations sit on enterprise infrastructure, 40,967 on cloud (AWS, Google, Microsoft, Oracle), 34,579 on ISP space, 19,607 behind CDNs, 6,399 on shared hosting. The long tail: 1,711 on educational networks and 793 on government.

The cloud number is the misleading one. Cloud-hosted exposure is somebody's customer: an ASM platform flags it, the cloud provider forwards an abuse notice, somebody patches it. The enterprise and government slices are the ones that linger, because the exposure sits on infrastructure nobody's monitoring and nobody scans by mandate.

5. What This Is Not

• Not a targeting package. We publish aggregate counts and service classes. No IPs, no hostnames, no victim organizations, no "how to find these" recipes beyond what any public scanner query already returns to anyone.
• Not exploitation data. Nothing was accessed, executed, or escalated. The dataset describes what answered a handshake.
• Not a complete map. One country, one day, one vantage. It's a sample of the boring internet, not a census.
• Not news to anyone who runs an ASM platform. Xpanse, Falcon Surface, and CyCognito have sold this class of data for years. What's new here is only that a two-person lab with a pipeline can produce it too. Which is exactly the point.

6. The Point

The point is that exposure intelligence is not exotic. It's a pipeline, a classification layer, and the discipline to publish aggregates instead of trophies. The same collection that produced these numbers feeds our perimeter diffing tooling. Because the difference between a snapshot and a breach is usually just time.

If you want the classified dataset behind this post: per-host records, risk tiers, infrastructure attribution, refreshed as the corpus grows. It exists, and it's licensable. If you want the same class of problem checked against your five domains instead of the whole country, that's the fixed-scope audit.

And if you own one of the 2,509 ADB hosts: turn it off. Nobody needs it. You certainly don't.