Techzone/IoT Search Engines

IoT Search Engines

3 min readArticle

Beyond Shodan, there are several other search engines that index internet-connected devices and services. Each has different coverage, features, and strengths. Knowing multiple tools gives you better recon coverage.

Main IoT Search Engines

Shodan (shodan.io)

The most well-known. Indexes banners from ports across the internet.

  • See shodan.io for full notes
  • Best for: port banners, certificates, industrial systems
  • API: Yes, paid tiers

Censys (censys.io)

Very similar to Shodan but with different scanning methodology. Often has complementary results.

bash 
# Install Python client
pip install censys

# Initialize
censys config

# Search via Python API
from censys.search import CensysHosts

h = CensysHosts()
results = h.search("same_service.transport_protocol: TCP AND services.port: 22")

for host in results:
    print(host['ip'], host['services'])

Web queries:

shell 
# Find Apache servers
services.software.product=Apache HTTP Server

# Find by org
autonomous_system.name=`Target Company`

# Exposed databases
services.port=27017 AND services.service_name=MONGODB

# SSL certs
parsed.names=target.com

ZoomEye (zoomeye.org)

Chinese cybersecurity company's search engine. Good coverage of Chinese networks and often has different results than Shodan/Censys.

bash 
# Python client
pip install zoomeye-sdk

# Search
from zoomeye.sdk import ZoomEye

zm = ZoomEye(api_key="your_key")
results = zm.dork_search("port:3389 country:CN")
for r in results['matches']:
    print(r['ip'], r['portinfo']['port'])

Web queries:

shell 
port:3389                    # RDP
app:Apache                   # Apache servers
country:US port:22           # SSH in US

FOFA (fofa.info)

Another Chinese platform with extensive coverage:

shell 
port=3389 && country=US
protocol=redis && country=GB
cert.subject.cn="*.target.com"

GreyNoise (greynoise.io)

Different angle — focuses on identifying which IPs are scanners/bots vs actual targets:

bash 
pip install greynoise

from greynoise import GreyNoise

gnapi = GreyNoise(api_key="your_key")
result = gnapi.ip("8.8.8.8")
print(result['classification'])  # benign, malicious, unknown

Use case: When you see an IP hitting your systems, GreyNoise tells you if it's a known scanner vs a targeted threat.

BinaryEdge (binaryedge.io)

Scans different ports and has good coverage of IoT and industrial protocols:

shell 
port:9200 type:elasticsearch
port:6379 type:redis

ONYPHE (onyphe.io)

French SIEM/threat intel platform with historical data:

shell 
category:datascan port:22 country:FR

Comparison Table

Tool Free Tier Coverage Special Strengths
Shodan 100 results Global Best overall, industrial
Censys 250/day Global Certificates, IPv6
ZoomEye Limited Global (CN strength) Asian networks
FOFA Limited Global (CN strength) IoT
GreyNoise 100/day Scanner data Classifying noise vs signal
BinaryEdge Limited Global IoT protocols

Combined OSINT Search Workflow

bash 
# 1. Start with Shodan for broad results
shodan search "org:\"Target Company\""

# 2. Cross-reference with Censys
censys search "autonomous_system.name:\"Target Company\""

# 3. Check certificate transparency for subdomains
# crt.sh?q=%25.target.com

# 4. Use GreyNoise to classify any IPs you find
# Check if they're known scanners

# 5. Combine findings for full picture

Certificate Transparency (Bonus)

crt.sh isn't an IoT engine but it's invaluable for finding domains/subdomains via SSL certificate logs:

bash 
# Find all subdomains of target.com via certs
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# Find wildcard certs
curl "https://crt.sh/?q=*.target.com&output=json" | jq '.'

See Also

  • shodan.io - Shodan detailed notes
  • future-of-tech-emerging-trends-2023 - Active OSINT overview
  • ../index - OSINT overview
techzonesite.comUnlock Your IT Potential