achillean

From 2017 through 2022 there was a large increase in the number of exposed refrigerators:

https://trends.shodan.io/search?query=http.favicon.hash:-853...

Over the past few years it has fluctuated but not the same continued growth as before. If you don't have a Shodan account you can see a chart on twitter:

https://x.com/shodanhq/status/2110526116679021055

The numbers are a bit lower if you exclude honeypots (~2k hosts): https://www.shodan.io/search/report?query=rockwell+port%3A44...

And the problem has actually gotten better over the years:

https://trends.shodan.io/search?query=tag%3Aics+rockwell

The situation used to be worse with things like the Lantronix password recovery service (i.e. a UDP port that would just send you the device password without any auth). It's still not ideal and takings things offline isn't easy (https://blog.shodan.io/taking-things-offline-is-hard/) but it's getting better (slowly).

We are writing https://terminal.shodan.io using iced and the development aspect has been great. Biggest issues are around distributing on Windows.

There will be some honeypots in this data but this is a start:

https://www.shodan.io/search/report?query=product%3Atelnetd+...

FYI: it might be better to search by port:23

https://www.shodan.io/search?query=port%3A23

Or to filter by product:telnetd

https://www.shodan.io/search?query=product%3Atelnetd

A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet":

https://book.shodan.io/getting-started/query-syntax/

Port 23 has decreased significantly over the past decade:

https://i.imgur.com/tZoTWu6.png

Still seeing a sizable number of open ports but it's on the decline.

FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/

More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.

Honeypots are advertising that header as well nowadays:

https://www.shodan.io/search/report?query=x-clacks-overhead

Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

The results have increased significantly over time:

https://trends.shodan.io/search?query=x-clacks-overhead

Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.

Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...

The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline

Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).

Around 40,000 services on the Internet are currently including the header:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:

https://trends.shodan.io/search?query=x-clacks-overhead+-tag...

There are still more than 300,000 services on the Internet that support SSLv2:

https://www.shodan.io/search/report?query=ssl.version%3Asslv...

And a trend line of how it's changed:

https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...

It has dropped significantly though over the years but it will continue to stick around for a while.

In absolute numbers probably not highly representative but the relative numbers are meaningful to measure adoption. And no, it requires the user to disable authentication in order to get the service details to differentiate between Redis and Valkey. But again, you can compare unauthenticated Redis to unauthenticated Valkey to see how the percentages are changing over time.

Based on Internet-accessible services the number of Valkey servers is low (~120):

https://trends.shodan.io/search?query=valkey_version+port%3A...

Here's a chart of all Redis-compatible services (~55,000):

https://trends.shodan.io/search?query=port%3A6379+redis_vers...

It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.

We released a tool to calculate the favicon hash called "favscan": https://blog.shodan.io/deep-dive-http-favicon/

And here's a map of favicons that Shodan has seen across the Internet: https://faviconmap.shodan.io/

We developed "geodns" for situations where you want to do DNS lookups from different regions around the world. For example, ycombinator.com returns different IPs depending on your location:

  $ geodns ycombinator.com
  108.156.133.117                Singapore
  108.156.133.21                 Singapore
  108.156.133.25                 Singapore
  108.156.133.59                 Singapore
  108.156.39.26                  London
  108.156.39.61                  London
  108.156.39.62                  London
  108.156.39.64                  London
  13.32.27.123                   Frankfurt am Main
  13.32.27.47                    Frankfurt am Main
  13.32.27.51                    Frankfurt am Main
  13.32.27.80                    Frankfurt am Main
  13.35.93.12                    Clifton
  13.35.93.14                    Clifton
  13.35.93.46                    Clifton
  13.35.93.47                    Clifton
  18.239.94.100                  Amsterdam
  18.239.94.114                  Amsterdam
  18.239.94.33                   Amsterdam
  18.239.94.79                   Amsterdam
  99.86.20.42                    Doddaballapura
  99.86.20.54                    Doddaballapura
  99.86.20.64                    Doddaballapura
  99.86.20.96                    Doddaballapura

https://gitlab.com/shodan-public/geonet-rs

Looks like there are at least a few hundred instances of OpenEMR exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

A few others:

- Want to distribute data to users that don't want to manage a server? A lot of people don't want to manage a server and don't need the best possible performance.

- Want to take data with you on a thumb drive and work with it offline? It's extremely convenient to be able to use SQLite for an app that has to work offline.

- Does the app mostly just read from the database and fit in memory? It's undervalued to just put the entire database into memory so you don't hit the disk and don't introduce network latency. For example, the following website does all enrichment with in-memory SQLite databases: https://shdn.io/analyze?target=ycombinator.com

At Shodan, we distribute versions of our datasets as SQLite and they're a popular way to consume the data without having to manage infrastructure.

Note that all of them have been flagged as honeypots by Shodan (see the "Tags" section below the IP in the top left).

Among the non-standard ports for SSH, 443 is in the top ports used:

https://www.shodan.io/search/facet?query=ssh&facet=port https://www.shodan.io/search/facet.png?query=ssh&facet=port

Port 80 is a lot less common though.

We do it for https://internetdb.shodan.io

Looks like there are still quite a few? https://www.shodan.io/search/report?query=product%3A%22Outlo...

Show a demo of the CLI without the end-user having to install anything. A recording gives a sense of the expected latency/ performance of the commands and is easier to digest for many than a wall of commands. Plus it uses minimal bandwidth so it's more efficient than a video, though you don't get audio. Imo it doesn't replace tutorials as much as it is a low friction way for people to get a feel for things.

Gravwell (https://www.gravwell.io) has a community edition that's free to use and runs locally.

If you're looking for something that can handle unstructured data and has a similar query syntax to Splunk then Gravwell (https://www.gravwell.io) might be a fit.

As a vendor that tried accepting crypto I can confirm that it's basically non-existent. And the few transactions that do take place have a lot more issues than regular payments: https://blog.shodan.io/accepting-crypto-a-vendor-perspective...