Viewing profile — achillean

The numbers are a bit lower if you exclude honeypots (~2k hosts): https://www.shodan.io/search/report?query=rockwell+port%3A44... And the problem has actually gotten better over th…

We are writing https://terminal.shodan.io using iced and the development aspect has been great. Biggest issues are around distributing on Windows.

There will be some honeypots in this data but this is a start: https://www.shodan.io/search/report?query=product%3Atelnetd+...

FYI: it might be better to search by port:23 https://www.shodan.io/search?query=port%3A23 Or to filter by product:telnetd https://www.shodan.io/search?query=product%3Atelnetd A que…

Port 23 has decreased significantly over the past decade: https://i.imgur.com/tZoTWu6.png Still seeing a sizable number of open ports but it's on the decline.

FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/ More info about the favicon hashing technique: https://…

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to u…

Honeypots are advertising that header as well nowadays: https://www.shodan.io/search/report?query=x-clacks-overhead Most of the non-honeypot results are for the Gargoyle Router Man…

Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predi…

Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea... The old PIPS ALPR devices aren't online anymore but th…

Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" ( https://www.shodan.io/search?query=product%3Aollama ). Or if you have access…

Around 40,000 services on the Internet are currently including the header: https://www.shodan.io/search/report?query=x-clacks-overhead+... For some reason, a lot of honeypots are a…

There are still more than 300,000 services on the Internet that support SSLv2: https://www.shodan.io/search/report?query=ssl.version%3Asslv... And a trend line of how it's changed:…

In absolute numbers probably not highly representative but the relative numbers are meaningful to measure adoption. And no, it requires the user to disable authentication in order …

Based on Internet-accessible services the number of Valkey servers is low (~120): https://trends.shodan.io/search?query=valkey_version+port%3A... Here's a chart of all Redis-compat…

It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.

We released a tool to calculate the favicon hash called "favscan": https://blog.shodan.io/deep-dive-http-favicon/ And here's a map of favicons that Shodan has seen across the Inter…

We developed "geodns" for situations where you want to do DNS lookups from different regions around the world. For example, ycombinator.com returns different IPs depending on your …

Looks like there are at least a few hundred instances of OpenEMR exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

A few others: - Want to distribute data to users that don't want to manage a server? A lot of people don't want to manage a server and don't need the best possible performance. - W…

Note that all of them have been flagged as honeypots by Shodan (see the "Tags" section below the IP in the top left).

Among the non-standard ports for SSH, 443 is in the top ports used: https://www.shodan.io/search/facet?query=ssh&facet=port https://www.shodan.io/search/facet.png?query=ssh&facet=p…

We do it for https://internetdb.shodan.io

Looks like there are still quite a few? https://www.shodan.io/search/report?query=product%3A%22Outlo...