Tools

An internet-wide scanning platform and search engine similar in purpose to Shodan/Censys — exposed services, vulnerabilities and threat intelligence indexed from continuous global scans.

An internet-wide device and certificate search engine built from continuous internet scanning — heavily used for attack-surface discovery and certificate-based host enumeration.

Internet-wide scan search engine for hosts, services and certificates, built from continuous scanning of the public IPv4 space plus a hosted certificate-transparency index.

Threat-intel-flavoured internet asset search engine combining Shodan-like banner search with IP risk scoring, phishing/malicious-URL lookups and domain intel.

Internet asset search engine (Huawei/Baimaohui-affiliated) with its own query syntax for finding hosts by banner, title, certificate or icon hash.

Attack-surface search engine and monitoring platform that continuously tracks a company's exposed hosts, subdomains and services.

Internet-asset search engine with a particular focus on IoT/ICS device fingerprinting, alongside general host/service banner search.

Directory of publicly reachable IP cameras with no or default authentication, browsable by country and manufacturer — an oft-cited example of what exposed device search finds.

Open-source network recon framework for running your own internet-wide or internal scans and organising the results in a queryable database, essentially a self-hosted Shodan.

Builds interactive maps and screenshot galleries of internet-connected cameras and ICS devices discovered via internet scan-search-engine APIs.

Open-data search engine that indexes misconfigured/exposed services and leaked data found on the public internet, including open databases and plaintext credential leaks.

Internet-scanning search engine covering hosts, domains, certificates and WHOIS, positioned as a cheaper alternative to Shodan/Censys with a similar dork syntax.

Cyber defense search engine that collects internet-wide scan, passive DNS and threat data and exposes it via a query language and API for attack-surface discovery.

The original internet-wide device search engine — indexes banners from scanning the whole IPv4 space, so you can search for exposed services, devices and misconfigurations by product, port or CVE.

shodan search "apache" country:DK

Shodan's own reference for its search filter syntax (product, port, org, ssl.cert, etc.) — essential for turning a vague "find exposed X" into a precise query.

Crowd-sourced database and search engine of wireless networks (Wi-Fi, Bluetooth, cellular) mapped by GPS location, built from years of wardriving submissions.

Chinese-run internet device/service search engine indexing banners, ports and web components, comparable in scope to Shodan/Censys with different vantage points.