Shodan port scans most of the internet and records the response, TLS certificates, etc. They have a search engine and tools like monitoring so you can run queries like “find anything where the certificate has this key (or organization name)” or “notify me any time a new port opens on my organization’s network.
This is the same data but a UI theme for nostalgic 90s internet users.
They scan and report what the servers advertise, so normally you’d see a list of services and it’d list versions which have known CVEs (obviously, this doesn’t say it’s actually vulnerable if e.g. a Linux distribution patched it without changing the advertised major version).
The “compromised” tag is only added after some confirmation of known malicious activity. I’m not sure what all that includes but I believe that can be things like 200 responses to known malware paths or a database reporting names used by common malware.
It's not looking for compromised devices, just anything with an open port. Conceptually they are just running an nmap scan of the entire public IP range and aggregating the results in a searchable index.
They scan pretty regularly and with a membership you can submit scans on demand. Picking a /16 I work with, the oldest full scan is 12/15 and the newest is 1/14 — and I say “full scan” because the oldest hosts show far more recent updates (1/13) for things like the web server ports which had previously been found open.
"compromised" means that it looks like the service was taken over by somebody else. That can mean website defacement (ex. "Hacked by XXX"), database ransomware or any other way that a bad guy can compromise a service.
Is an semi-real-time readout of New(how new? Not sure) devices/addresses accessible from the internet, including unlisted stuff like power plants, fridges, Botswanan cable companies, etc.
Comments
What am I looking at here?
Shodan port scans most of the internet and records the response, TLS certificates, etc. They have a search engine and tools like monitoring so you can run queries like “find anything where the certificate has this key (or organization name)” or “notify me any time a new port opens on my organization’s network.
This is the same data but a UI theme for nostalgic 90s internet users.
Does "compromised" actually mean pwn'd or just "i ping'd and it responded"?
Also, what should I be looking for in my own logs to see who is scanning me and using what? 99% its stuff I'm not running (wordpress, mysql).
They scan and report what the servers advertise, so normally you’d see a list of services and it’d list versions which have known CVEs (obviously, this doesn’t say it’s actually vulnerable if e.g. a Linux distribution patched it without changing the advertised major version).
The “compromised” tag is only added after some confirmation of known malicious activity. I’m not sure what all that includes but I believe that can be things like 200 responses to known malware paths or a database reporting names used by common malware.
It's not looking for compromised devices, just anything with an open port. Conceptually they are just running an nmap scan of the entire public IP range and aggregating the results in a searchable index.
How up-to-date is it?
They scan pretty regularly and with a membership you can submit scans on demand. Picking a /16 I work with, the oldest full scan is 12/15 and the newest is 1/14 — and I say “full scan” because the oldest hosts show far more recent updates (1/13) for things like the web server ports which had previously been found open.
"compromised" means that it looks like the service was taken over by somebody else. That can mean website defacement (ex. "Hacked by XXX"), database ransomware or any other way that a bad guy can compromise a service.
This is… the internet.
I think you meant:
THE INTERNET...NET...NET...Net...net...!!!
(I feel like that's a good representation for a booming echo effect.)
Is an semi-real-time readout of New(how new? Not sure) devices/addresses accessible from the internet, including unlisted stuff like power plants, fridges, Botswanan cable companies, etc.
the webcam datestamps have ranged from today to a couple weeks ago, so probably a mix
Shodan is basically a port scan of the entire internet