OSINT for the Lazy Part 16: Discovering Hidden Corporate Infrastructure Through Shodan
If the internet is compared to a large city, the visible part consists of main streets and side alleys that host official company websites, while the backyards, basements, and service entrances are where maintenance staff and potential intruders move. Shodan specializes in exploring exactly these hidden areas by indexing devices instead of web pages.
Unlike conventional search engines such as Google that crawl HTML content, Shodan catalogs internet-connected hardware including servers, IP cameras, databases, routers, administration panels, and IoT equipment. When administrators leave such systems exposed, analysts can discover valuable information about a company’s infrastructure.
1. Search by company domain
The simplest method uses the filter hostname:company.com. Results often reveal forgotten development, VPN, test, and API endpoints such as dev.company.com, vpn.company.com, test.company.com, and api.company.com.
2. Search by SSL certificates
The query ssl:"company.com" locates certificates that mention the target domain and frequently surfaces additional subdomains including jenkins.company.com, internal-api.company.com, and staging.company.com.
3. Search by ASN
Companies that own IP address blocks usually possess an ASN (Autonomous System Number). The filter asn:ASXXXX returns every device registered to that network, exposing servers, routers, and sometimes cameras.
4. Search by IP range
When the exact network block is known, the filter net:192.168.10.0/24 lists all devices inside the range, potentially revealing VPN services, SSH ports, Docker, Kubernetes, GitLab instances, and even internal databases.
5. Search for development infrastructure
Developers commonly use keywords such as dev, stage, staging, test, qa, beta, and internal. Queries like hostname:dev or hostname:staging can uncover unprotected development and staging environments.
6. Search for administration panels
Filters such as title:"Jenkins", title:"Grafana", and title:"Kibana" locate continuous-integration systems, monitoring dashboards, and other operational tools that sometimes remain accessible with default credentials.
7. Search for databases
Port-based queries including port:27017, port:6379, and port:9200 identify MongoDB, Redis, and Elasticsearch instances. Adding an organization filter can tie these services to the target company.
8–10. Cloud, organization, and IoT searches
Additional techniques cover cloud-hosted Docker and Kubernetes APIs, organization-name searches with org:"Company Name", and queries that surface corporate webcams, industrial controllers, and building-automation systems.
A practical five-step workflow combines hostname, SSL, organization, development-keyword, and service-title searches. In one documented case the search sequence led directly to an unprotected jenkins.dev.company.com instance containing CI pipelines, source repositories, and deployment keys.
Shodan does not exploit or attack any system; it merely displays services that are already reachable from the public internet. The most frequent reasons for exposure remain human error: forgotten test servers, temporary development environments, incorrectly configured firewalls, and rushed deployments that leave ports open.
Related articles
PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.
How to Prepare Your Website for Data Center Outages: Business Resilience Checklist
Following strikes on Yandex data centers, many businesses discovered that their sites and all backups were stored in a single location, leading to complete outages. The article provides a detailed checklist to mitigate such risks by separating critical components across different providers. Key recommendations include moving DNS to an independent provider, lowering TTL values, maintaining a live mirror site on separate hosting, and isolating corporate email. Additional steps cover local backups, monitoring, access management, and CDN usage. The guidance differentiates between virtual hosting, VPS or dedicated servers, and website builders like Tilda, while emphasizing compliance with Russian data localization laws such as 152-FZ.
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.