Port Watch · Methodology

How Port Watch scores yacht cyber-pressure

Every score input is visible on every region page. No black-box weighting. This page documents the data sources, scoring rules, and limits — so anyone reading a Port Watch score can verify how it was built.

What Port Watch is not. Port Watch surfaces public exposure indicators. We do not observe attacks against any marina, vessel, or operator. Vendors named in our evidence sections are referenced as global CVE subjects, not as port-specific compromises. Regional buckets only — no per-marina ratings.

The regions

Seven regional buckets that cover the megayacht cruising loop. Each bucket spans multiple cities so no single famous marina maps 1-to-1 to a score.

South Florida — Fort Lauderdale, Miami, Palm Beach, Stuart, North Palm Beach
US Northeast — Newport RI, Mystic CT, Greenwich CT, Nantucket MA
Eastern Caribbean — St. Maarten, St. Barths, Antigua, BVI, St. Lucia, Grenada
Côte d'Azur — Monaco, Antibes, Cannes, Nice, Saint-Tropez, Beaulieu
Balearics — Palma de Mallorca, Ibiza, Menorca
Italian Riviera — Genoa, Viareggio, La Spezia, Imperia, Portofino, Sanremo
UAE / Arabian Gulf — Dubai, Abu Dhabi, Doha

Scoring

The algorithm

Three per-region signals sum to a 0–7 aggregate. KEV/NVD global pulse is shown as context but does NOT enter the score — it would just shift every region in lockstep and add noise.

The captain checklist on each region page is generated from these same signals. Every red bullet is a region-specific finding from the score inputs (top probes, KEV cross-reference, phishing infrastructure, season). Every grey "baseline" bullet is operational hygiene that always applies.

Signal 1 — Regional exposed services (0–3, Shodan)

Count of Shodan banner-grab hits in the region's cities matching products that show up in active CISA KEV entries: Fortinet, Cisco ASA, Palo Alto GlobalProtect, SonicWall, RDP, Outlook Web Access, Ruckus, Aruba. One Shodan /host/count per city per probe (free at this endpoint).

Total hits	Score
0–49	0
50–199	1
200–999	2
1,000+	3

Signal 2 — Regional phishing infrastructure (0–3)

Count of URLhaus + OpenPhish entries where the abused host or URL path matches the region's phishing-terms dictionary (sub-port names, yacht agent / broker / shipyard domain stems). This is a sentinel signal: most cycles it sits at 0, and that's fine. When it fires, regional-themed phishing infrastructure has appeared in the public feeds — that's meaningful.

Matches	Score
0	0
1	1
2–3	2
4+	3

Signal 3 — Seasonal load (0–1)

A binary boost: +1 if the current month falls in the region's high-season window, otherwise 0. Med regions: May–September. Caribbean + Gulf: November–April / March. US Northeast: June–September. South Florida: November–April. This is a weighting we own and document, not a third-party feed.

Aggregate pressure

Aggregate (0–7)	Pressure level
0–1	Calm
2–4	Elevated
5–7	High

Inputs

Data sources

CISA KEV

US government catalog of vulnerabilities actively exploited in the wild. Drives the global pulse strip.

NVD CVE feed

Recently published CVEs with CVSS scores. Drives the global pulse strip.

URLhaus (abuse.ch)

Malware distribution URLs. Mass-feed; usually catches mass-distribution, occasionally region-themed.

OpenPhish Community

Active phishing URLs feed. The "yacht-region" signal usually lives here when it fires.

Shodan

Internet-wide service banner index. We use /host/count only — count-only, 0 query credits per call.

Seasonal calendar

Our own table mapping each region to its high-season months. Documented above.

The exposure map

The map on each region page shows the geographic spread of internet-exposed devices that match our yacht-relevant Shodan probes. It's a visual aid for scale, not a directory of vulnerable devices. Three stacked protections keep it defamation-safe.

Layer 1 — ISP geo-IP precision is metro-level by construction. Shodan returns lat/lon based on the IP block's ISP routing, not the device's GPS. A "Fort Lauderdale, FL" coordinate is the ISP's metro-level approximation — never an actual marina address.

Layer 2 — We deliberately jitter every dot. On top of the ISP-level imprecision, we add a small random offset (~±1 km) to each dot's position. The offset is deterministic per snapshot (same seed → same offset within one day) but moves on the next refresh. Positions are visibly approximated.

Layer 3 — The base map has no marina labels. Only coastline + city anchors + city names. No streets. No buildings. No marina names. A reader literally cannot connect a dot to a specific marina because no specific marina is on the map.

What the map does and does not mean. The map shows where public-internet scans see exposure indicators in the region. It is not an attack feed and it is not a per-operator risk score. A region with few dots is not "safer" — Shodan only measures internet-exposed kit. The actual yacht risk surface (crew personal devices on marina Wi-Fi, agent network compromise, captive-portal phishing) does not appear on the map at all. The Captain's Read and checklist on each region page remain the operational layer.

Honest limitations

Geo accuracy is city/metro, not marina. Shodan documents this. We never claim a specific marina is exposed — only that a region's metros contain N exposed services on yacht-relevant kit.
Mass phishing feeds are not yacht-focused. Most cycles the phishing-infra signal is 0; that's expected. Yacht-themed phishing is a tiny slice of global mass-distribution.
This is exposure, not attack. We do not see attack traffic. We see what's exposed in public scans and what's appeared in public abuse feeds.
Score is bucketed. A region with score 4 and a region with score 2 both render as Elevated. The visible inputs let you see the difference.
No history yet. v1 shows the current snapshot only. Week-over-week trends are on the roadmap.

Refresh + change log

Snapshot rebuilt daily at 02:30 UTC. Phishing-infra feed at 02:00. CISA KEV + NVD on the upstream /threat-intel hourly pipeline.

Current snapshot generated 39 min ago (2026-06-22T02:38:55+00:00).
Methodology v1 — published 2026-06-15. Future revisions will be dated here.