"Nobody knows my IP, so I have some time before anyone finds this" is the quiet assumption behind a lot of exposed services, and it is wrong by orders of magnitude. The public internet is swept continuously and indiscriminately; a freshly exposed service starts taking automated probes within seconds to minutes, and a weakly secured one is routinely compromised inside a day. None of it is aimed at you specifically, which is exactly why it is so reliable.
//The Whole Internet Is Cheap to Scan
Scanning all of IPv4 stopped being expensive over a decade ago. The ZMap scanner demonstrated in 2013 that a single machine can sweep the entire public IPv4 address space in under 45 minutes. That capability is now industrialised: Shodan and Censys continuously index exposed services and keep the results queryable, and a large population of opportunistic scanners and botnets sweeps constantly on top of them. A Unit 42 measurement counted roughly 75,000 unique scanner IPs active globally, with a single internet-facing endpoint seeing on the order of 1,500 distinct scanners probing 1,900 ports a day.
One precision worth keeping: not every individual scanner covers the whole address space. The accurate picture is two-part - internet-wide scanning of all of IPv4 is cheap and routine for the indexers, and the broader scanner population is large and indiscriminate, trying to reach as many hosts as possible rather than singling you out. Either way, "obscure" is not a property your IP has.
//Seconds to First Contact, Hours to Compromise
How fast is "fast"? Sophos exposed SSH honeypots across ten AWS regions and recorded one device attacked in under a minute from deployment, with SSH login attempts then arriving at around 13 per minute per host - millions of attempts across a handful of hosts in a month. Unit 42's broader study of 320 honeypots (SSH, Postgres, RDP, Samba) found 80% compromised within 24 hours and all of them within a week, with one actor compromising 96% of 80 Postgres honeypots within 30 seconds of exposure. Average time to first compromise varied by service - roughly 3 hours for SSH, 8.5 for Postgres, 11 for RDP - but those averages hide a vicious fast tail when the credentials are guessable.
//The Unauthenticated Case: Discovery Is Compromise
When a service has no authentication at all, there is no gap to measure, because there is nothing to break. The self-hosted AI wave made this vivid: Cisco Talos pulled over a thousand exposed, unauthenticated Ollama servers straight from Shodan's existing index - more than 1,000 of them surfacing in the first ten minutes of their query (that is Shodan's collection speed, not how fast a server gets found), with about 89% exposing the standard OpenAI-compatible API routes and a fifth actively serving models. Bind a dashboard, database, or model endpoint to 0.0.0.0 with auth left off and you have not created a race against attackers; you have published an open API and are waiting for it to be indexed.
//What Actually Buys You Time
Not obscurity. What changes the outcome is authentication and surface reduction. For SSH, key-only auth with passwords disabled turns the 13-attempts-a-minute spray into noise that never succeeds - the attempts keep coming, but none land. Moving SSH off port 22 is worth doing for a narrow reason: it removes most of the automated background spray that only ever targets the default port, so your logs quiet down and a remaining hit is more likely to be someone actually scanning you. It is not protection - an attacker who scans all ports, or who is targeting you, finds it regardless - but it is a real reduction in noise. This is exactly the signal this site's own honeypot data separates: the ocean of indiscriminate spray, versus the handful of sources that came looking specifically.
The IPv6 wrinkle
A single IPv6 host on a /64 is effectively invisible to blind scanning - the address space is far too large to sweep, so IPv6 services are generally found through DNS records, logs, certificate transparency and hitlists rather than brute enumeration. That makes IPv6-only exposure a genuine obscurity gain. It is still only obscurity: the moment your AAAA record or a cert publishes the name, you are discoverable, so it is a reason to prefer IPv6 where you can, never a substitute for auth.
//Sourcing and Framing
The ZMap "entire IPv4 in under 45 minutes" figure is from the 2013 USENIX Security paper. The scanner-population figures (around 75,000 global scanner IPs; ~1,500 per endpoint per day) and the "not every scanner scans all of IPv4" caveat are from Unit 42's cloud network-scanning study. The time-to-first-attack (under a minute) and the ~13 SSH attempts per minute are from Sophos's 2019 cloud-honeypot study; the 80%-within-24-hours, the 96%-of-Postgres-in-30-seconds, and the per-service mean compromise times are from Unit 42's 2021 honeypot study. The exposed-Ollama figures - over 1,000 within the first ten minutes of the Shodan query, ~89% on OpenAI-compatible routes, ~20% actively serving models - are from Cisco Talos (2025), with the "ten minutes" correctly attributed to Shodan collection speed rather than discovery latency. The IPv6 point is from APNIC's analysis of IPv6 scanning. The off-port-22 noise-reduction claim is qualitative (SANS ISC) and is stated as a reduction in automated noise, not as protection. The interpretation is the site's standard one: the defensible variable is authentication, and obscurity is consistently oversold.