The response headers are kept in a SQLite db that you can perform regex queries on. It's surprisingly easy to find particular devices based on the headers. And

The response headers are kept in a SQLite db that you can perform regex queries on. It's surprisingly easy to find particular devices based on the headers. And, yes, it's just making basic HTTP requests on port 80 so it's overlooking tons of devices. But I run this from my own devices and doing blast scans of ports other than 80 can look a bit suspicious.