6 ms·
For those a bit confused: This subdomain redirects to https://beta.shodan.io/host/$YOUR_REMOTE_ADDR https://beta.shodan.io/host/$YOUR_REMOTE_ADDR. This runs a s
by withinrafael 6y ago
For those a bit confused: This subdomain redirects to https://beta.shodan.io/host/$YOUR_REMOTE_ADDR https://beta.shodan.io/host/$YOUR_REMOTE_ADDR. This runs a search against their existing database of information. Shodan has an army of bots that crawl the entire Internet and stores what it finds along the way. Folks generally pay Shodan for access to these notes.
The site returns various HTTP error codes based on the results of that lookup, or shows a fancier page with open ports and other information it has on that IP address. (Example: https://beta.shodan.io/host/1.1.1.1 https://beta.shodan.io/host/1.1.1.1)
There is no active scan occurring here. (But you could be hinting to Shodan that these particular IPs are valid though!)
- xoa 6y ago>(I wouldn't rule out that you may be hinting to Shodan that these particular IPs are valid though!) For those of us on IPv4, eh. Only 4 billion addresses, and with a lot of that itself tied up in various large /8s to a few specific organizations many of which can be assumed to be beyond casual level, it's just no longer a real haul to scan everything all the time at a basic level. Plus for those of us browsing from our main address we're leaving a trail all over the web anyway through a host of poorly secured servers. So I while I don't disagree it's worth thinking about information leaks and honey pots and the like whenever dealing with infosec in any way, in this specific case I also don't think this reveals anything of significant value.
- nycdatasci 6y agoSupporting your point: With zmap (https://zmap.io/ https://zmap.io/) you can scan IPv4 in 45 mins using a 1 Gb pipe, or in 5 mins on a 10 Gb pipe.
- Fnoord 6y agoFull UDP range?
- H8crilA 6y agoWait, why does a port scan need to transfer > 30 GiB of data? Or do you mean all of IPv4?
- JustFinishedBSG 6y agoAll of the internet yes
- ed25519FUUU 6y agoOn a beefy enough host, you could probably run massscan[1] while out at lunch and probably touch every ipv4 host on the internet. https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
- RL_Quine 6y agoIf you want active scanning, http://portscan.me/ http://portscan.me/ will do a reverse nmap port scan of whatever requests it.
- vit05 6y ago"Access Denied! Your address is blacklisted. More information about this error may be available in the server error log." What should I do?
- simonklitj 6y agoGot the same message.
- contravariant 6y agoYou should just run nmap yourself I reckon.
- mcny 6y agohere's a portscan.me if you are getting forbidden and just want to see what a result looks like Scanning {ip} for interesting ports on 2020-09-22 20:14:00 CEST… This may take a short while. Starting Nmap 5.21 ( http://nmap.org ) at 2020-09-22 20:14 UTC Initiating Ping Scan at 20:14 Scanning {ip} [2 ports] Stats: 0:00:01 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan Ping Scan Timing: About 50.00% done; ETC: 20:14 (0:00:01 remaining) Stats: 0:00:02 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan Ping Scan Timing: About 50.00% done; ETC: 20:14 (0:00:02 remaining) Stats: 0:00:03 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan Ping Scan Timing: About 99.99% done; ETC: 20:14 (0:00:00 remaining) Completed Ping Scan at 20:14, 3.00s elapsed (1 total hosts) Nmap scan report for {ip} [host down, received no-response] Read data files from: /usr/share/nmap Note: Host seems down. If it is really up, but blocking our ping probes, try -PN Nmap done: 1 IP address (0 hosts up) scanned in 3.07 seconds The scan was performed from 89.186.169.101. Best regards gigahost.dk -- OP's link archived from archive.fo https://archive.fo/72cS5 https://archive.fo/72cS5
- tzs 6y agoI'm still confused, because "curl -D - https://beta.shodan.io/host/$ALIP https://beta.shodan.io/host/$ALIP" where $ALIP is the IP address of my Amazon Lightsail instance, gives different results depending on where I do it from. If I do that query from home, it correctly tells me that 22, 80, and 443 are open. If I do that query from the Lightsail instance itself, I get 404. I also get 404 if I do it from work.
- deleted 6y ago[deleted]
- withinrafael 6y agoStrange! Maybe they have Amazon compute resources on a list and respond differently to avoid abuse? If they don't pop in here, maybe ping @shodanhq on Twitter.
- nash 6y agoSame IP? Don't forget your instance has different public and private IPs.
- achillean 6y agoAre you sure it's a 404 and not a 403? We block access to the website from the cloud so you're probably getting blocked.
- tzs 6y agoOops...you are right.
- achillean 6y agoWe don't retain web logs and the way users interact with Shodan doesn't change the way Shodan crawls the Internet. I.e. using the website/ API doesn't change how we look at the Internet.
- developer2 6y agoI've had the same static ipv4 address for just over 19 months, and have been running an exposed OpenVPN server on an alternative port on that IP for the entire duration. I get no results. Color me unimpressed that "an army of bots that crawl the entire Internet and stores what it finds along the way" hasn't port scanned every ipv4 address at least once in the span of 19+ months. That is a very long time for a limited address space. tldr; There is no "army", or that army is armed with pool noodles.
- jessaustin 6y agoWell, they've found a port 22 that I have open. Oh noes! Actually, this seems to undercut the whole "don't use standard ports" argument. They would have found it as well if ssh were at 22222 instead.
- achillean 6y agoIt also depends how you've configured OpenVPN. If you've properly configured to drop connections that didn't provide a valid certificate then even running it on a regular port would make it invisible to scanners.
- lipnitsk 6y agoWon't the server need to accept a TCP connection to receive the cert? If so, the port will show as open. I suppose with UDP it is possible.