The internet gets scanned every few minutes. All of it.

Not targeted at you. Targeted at everything. Automated tools sweep all four billion addresses on the internet, around the clock, and flag anything that answers — including the gear at your transmitter site.

Here's how that works, how fast it is, and why "nobody knows we're out here" stopped being true a long time ago.

By the FusionAir engineering team / Matt Aaron

Scanning the whole internet isn't hard anymore. It's a free download.

There are about four billion addresses on the public internet. Reaching all of them used to take weeks. Today it takes minutes, with tools anyone can download for free. Two of them run the whole show.

Nmap is the one most people have heard of — "Network Mapper." Point it at a device or a network and it tells you everything: which ports are open, what's running behind them, even the make and version. It's thorough, and it's what someone reaches for once they've found a target worth a closer look. What it isn't is fast across the whole internet — aimed at four billion addresses it would take weeks.

ZMap was built for exactly that job. It's a free, openly published scanner that does one thing at blinding speed: sweep the entire internet looking for the one thing you care about. One open port. One kind of device. From a single ordinary computer on a normal (gigabit) connection, ZMap can reach every address on the internet, on that one port, in under 45 minutes. On a fast (10-gigabit) connection, it does the whole internet in under 5 minutes.

To check every address on the internet for one thing, on a 10-gigabit line. Under 45 minutes on an ordinary gigabit connection.

And this isn't something that happens once in a while. It runs around the clock, from thousands of machines at once. In one study, researchers counted more than 700,000 separate scanners sweeping the internet in a single day, probing over 9,500 different ports. The whole internet, checked over and over, every day.

Separate scanners counted sweeping the internet in a single day — probing 9,500+ ports, all day, every day.

None of this is secret or sophisticated. Both tools came out of ordinary security work and are used every day by researchers and IT shops doing their jobs. The same tools, pointed the wrong way, are what the bad guys use — and the cost of a rough sweep of the whole internet is about $10 in rented computing power. A tank of gas costs more than finding every exposed device on earth.

Here's what all of that adds up to, and it's the whole point of this page. Take any device you've got with an internet connection — a Barix box, a Comrex or Tieline codec, an RDS encoder, an STL, a transmitter remote. Unless it sits behind a firewall locked down to your own IP addresses, so the public internet can't reach it at all; or a VPN; or some other transport the public internet simply can't touch, somebody has almost certainly already found it and indexed it. Not might have. Has. These tools run all day, every day, and your gear answers the moment they knock.

They don't even have to scan. Somebody already did it for them.

Here's the part that surprises people. The attacker usually doesn't run the scan at all. Companies run it for them, publicly, and put the results in a search box.

Sites like Shodan and Censys scan the entire internet continuously and keep a searchable index of every device they find — what it is, what it's running, what version, and where it is. Censys says it refreshes its map of known devices every day and covers all 65,535 ports. It's Google, except instead of web pages it catalogs the actual machines plugged into the internet.

You don't search these by keyword. You search by exactly the things that describe your gear:

By where you are. country:US, city:"Nashville", or a map region. Want every exposed device in one town? One click.

By your address block. net: your IP range, or org: your internet provider. Everything your station owns, in one list.

By what the gear is. The brand and model of a transmitter, codec or encoder, because each one announces itself the moment it's asked. A search for one specific make of controller returned around 1,800 of them sitting on the open internet — that's exactly how the people who went after a U.S. water plant in 2023 found their target.

So when we say hackers "target areas and zones," this is the literal mechanism. They filter the list down to a region, a provider, or a kind of equipment, and work straight down it.

And then a script taps them on the shoulder the moment you show up.

It gets more automatic than that. They don't have to keep checking back. They set up a standing alert and wait for you to appear.

Shodan has a built-in feature, network monitoring, that does exactly this. You hand it an IP range and pick your triggers. From then on, the moment a new open port or a new service shows up in that range, it emails you or pings a chat channel — with the address, the port, what the device is, and a link straight to it. It was built so a company could watch its own network. Nothing stops someone pointing it at yours.

Think about what that means for the day you install a new box. An engineer plugs in a codec or a remote control, forwards a port so he can reach it from home, and moves on. He didn't announce it to anybody. He didn't have to. Within a scan cycle it shows up in the index, the standing alert fires, and now a stranger knows your new device is live before you've finished the paperwork.

These alerts can be tuned to the nasty stuff on purpose — a known-vulnerable version, a database with no password, a remote-login port. Whatever you most don't want found is the easiest thing to get notified about.

From "it's online" to "it's broken into" can be under a minute.

Finding a device and breaking into it are two different steps, but the gap between them has basically disappeared. A few numbers from people who measure this for a living:

How long one brand-new server lasted before its first attack, in a Sophos study that put decoy servers online around the world. On average they were hit 13 times a minute, each.

How long it took one attacker to break into 96% of a batch of 80 decoy databases, in a Palo Alto Networks study. Four out of five of their decoys were compromised within 24 hours; all of them within a week.

How fast attackers started scanning the whole internet for a brand-new Microsoft flaw after it was announced, per Palo Alto's Cortex team. Most new flaws drew scans within 15 minutes.

Put those together and the picture is simple. The scan that finds you runs constantly. The moment a flaw in your make of gear is published, the scanning for it spikes within minutes. And once something answers, the attempt to get in starts in under a minute. There is no quiet window where you get to patch in peace. The attackers are faster than the defenders, every study says so, and it's not close.

This isn't theory for radio. It's already happened — on the air.

Broadcast gear is a perfect target for this. A lot of it was built for a private studio network years ago, it sits at an unmanned transmitter site, and it announces its make and model the second it's scanned. Every pattern above lines up with it.

Those are a few off the top. We keep a longer, sourced list — including published flaws in transmitters, processors and EAS gear that need no password at all — on the Evidence page.

See the documented break-ins →

You can't stop the scanning. You can stop answering.

The scanners aren't going away, and you can't opt out of being looked at. What you can do is know what's reachable from outside your plant and shut the doors you didn't mean to leave open — before one of those standing alerts finds them first.

That's the whole reason AirScan exists. It looks at your station the same way the scanners do, from the outside, and hands you the list in plain English: here's what's reachable, here's what it is, here's how to close it. It's free, it only looks, and it's safe to run in the middle of a live show.

The fix isn't a better password. It's keeping the data off the open internet.

Everything on this page is the reason our other products are built the way they are. If a scanner can only find what's reachable from the public internet, then the surest protection is simple: don't put it there. So we didn't.

Same idea every time: the safest device is the one a stranger's scanner never sees. AirScan shows you what's exposed today. Our other gear is how you stop exposing it.