State of the Pops: Mapping the Digital Waters
Presents findings from passive OSINT reconnaissance across the top 50 global maritime organizations, analyzing DNS, email authentication, and exposed services.
Summary
Passive Reconnaissance in the Maritime Industry
As global maritime shipping digitizes, the cybersecurity posture of foundational internet infrastructure across maritime enterprises remains uneven. Evaluating this posture through passive, non-intrusive open-source intelligence (OSINT) surfaces critical visibility into sector-wide vulnerabilities.
Methodology: Mapping Top 50 Maritime Organizations
A large-scale OSINT assessment evaluated the public digital footprints of the top 50 maritime shipping and logistics organizations. The research relied entirely on public records, DNS registries, and passive telemetry without transmitting intrusive network packets to target systems.
Findings in DNS and Email Security Protocols
Analysis revealed widespread gaps in fundamental security controls, including missing or misconfigured SPF, DKIM, and DMARC email authentication records, unmanaged subdomains, and exposed administrative web interfaces.
Open-Source Tooling and Sector Resilience
Releasing the assessment methodology and analysis scripts empowers practitioners and asset owners to audit maritime infrastructure, benchmark organizational defenses, and strengthen foundational cyber hygiene across supply chain operations.
Related talks
Creator Stage·14 min
Mehmet Onder Key · Furkan Aydogan
Demonstrates low-cost OSINT techniques leveraging vessel tracking, port data, and open intelligence to detect anomalous behavior and maritime security risks.
Creator Stage·16 min
Lukas McCullough
Introduces foundational open-source intelligence methods and resources for gathering facility and site intelligence prior to physical visits.
Recon Village·30 min
Andy Dennis
Andy Dennis demonstrates leveraging passive DNS databases to uncover competitor infrastructure, corporate acquisitions, and business intelligence.