Hacker News: achillean

New comment by achillean in "The state of building user interfaces in Rust"

achillean — Sun, 14 Jun 2026 01:59:13 +0000

We are writing https://terminal.shodan.io using iced and the development aspect has been great. Biggest issues are around distributing on Windows.

New comment by achillean in "The Day the Telnet Died"

achillean — Wed, 11 Feb 2026 17:04:09 +0000

There will be some honeypots in this data but this is a start:

https://www.shodan.io/search/report?query=product%3Atelnetd+...

New comment by achillean in "The Day the Telnet Died"

achillean — Wed, 11 Feb 2026 17:01:55 +0000

FYI: it might be better to search by port:23

https://www.shodan.io/search?query=port%3A23

Or to filter by product:telnetd

https://www.shodan.io/search?query=product%3Atelnetd

A query of "telnet" searches Shodan for banners where the "data" property contains the string "telnet":

https://book.shodan.io/getting-started/query-syntax/

New comment by achillean in "The Day the Telnet Died"

achillean — Wed, 11 Feb 2026 04:40:18 +0000

Port 23 has decreased significantly over the past decade:

https://i.imgur.com/tZoTWu6.png

Still seeing a sizable number of open ports but it's on the decline.

New comment by achillean in "Clawdbot Renames to Moltbot"

achillean — Wed, 28 Jan 2026 00:12:16 +0000

FYI we released a tool to calculate a bunch of these types of hashes: https://book.shodan.io/command-line-tools/shodan-hash/

More info about the favicon hashing technique: https://blog.shodan.io/deep-dive-http-favicon/

New comment by achillean in "Clawdbot Renames to Moltbot"

achillean — Tue, 27 Jan 2026 20:02:04 +0000

Already seeing some of the new Moltbot deployments exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

New comment by achillean in "A flawed paper in management science has been cited more than 6k times"

achillean — Mon, 26 Jan 2026 00:29:30 +0000

I had a similar experience where a competitor released an academic paper rife with mistakes and misunderstandings of how my software worked. Instead of reaching out and trying to understand how their system was different than mine they used their incorrect data to draw their conclusions. I became rather disillusioned with academic papers as a result of how they were able to get away with publishing verifiably wrong data.

New comment by achillean in "X-Clacks-Overhead"

achillean — Sat, 03 Jan 2026 23:30:24 +0000

Honeypots are advertising that header as well nowadays:

https://www.shodan.io/search/report?query=x-clacks-overhead

Most of the non-honeypot results are for the Gargoyle Router Management interface exposed by Korea Telecom:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

The results have increased significantly over time:

https://trends.shodan.io/search?query=x-clacks-overhead

New comment by achillean in "10 years bootstrapped: €6.5M revenue with a team of 13"

achillean — Wed, 24 Dec 2025 20:10:01 +0000

Maybe it depends on the type of business/ customers that you have because I've had the opposite experience. For us as a security SaaS, B2B enterprise is incredibly stable and predictable. B2C has a lot more variability and payment issues compared to large orgs with dedicated procurement departments, vendor processes etc.

New comment by achillean in "Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves"

achillean — Tue, 23 Dec 2025 09:46:56 +0000

Searching for ALPR was also one of the popular early queries: https://github.com/jakejarvis/awesome-shodan-queries?tab=rea...

The old PIPS ALPR devices aren't online anymore but they had horrible security as well. Just sending a newline to their UDP port would cause them to send you all images as they were being collected in real-time - no authentication needed. And the images had the license plate information encoded in the JPG metadata. I did a talk about it at some point (https://imgur.com/HHcpJOr) and worked with EFF to take them offline

New comment by achillean in "Finding thousands of exposed Ollama instances using Shodan"

achillean — Wed, 03 Sep 2025 16:09:57 +0000

Shodan also has built-in detection for some of them. For example, you can search for "product:ollama" (https://www.shodan.io/search?query=product%3Aollama). Or if you have access to the tag filter then simply "tag:ai" (https://www.shodan.io/search/report?query=tag%3Aai).

New comment by achillean in "X-Clacks-Overhead"

achillean — Sun, 06 Jul 2025 02:24:03 +0000

Around 40,000 services on the Internet are currently including the header:

https://www.shodan.io/search/report?query=x-clacks-overhead+...

For some reason, a lot of honeypots are also using that header so I filtered those out. The number of services has slowly increased over time:

https://trends.shodan.io/search?query=x-clacks-overhead+-tag...

New comment by achillean in "Why SSL was renamed to TLS in late 90s (2014)"

achillean — Mon, 16 Jun 2025 00:59:11 +0000

There are still more than 300,000 services on the Internet that support SSLv2:

https://www.shodan.io/search/report?query=ssl.version%3Asslv...

And a trend line of how it's changed:

https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...

It has dropped significantly though over the years but it will continue to stick around for a while.

New comment by achillean in "Redis is open source again"

achillean — Sat, 03 May 2025 02:54:06 +0000

In absolute numbers probably not highly representative but the relative numbers are meaningful to measure adoption. And no, it requires the user to disable authentication in order to get the service details to differentiate between Redis and Valkey. But again, you can compare unauthenticated Redis to unauthenticated Valkey to see how the percentages are changing over time.

New comment by achillean in "Redis is open source again"

achillean — Thu, 01 May 2025 20:22:23 +0000

Based on Internet-accessible services the number of Valkey servers is low (~120):

https://trends.shodan.io/search?query=valkey_version+port%3A...

Here's a chart of all Redis-compatible services (~55,000):

https://trends.shodan.io/search?query=port%3A6379+redis_vers...

New comment by achillean in "Exposed DeepSeek database leaking sensitive information, including chat history"

achillean — Thu, 30 Jan 2025 04:09:10 +0000

It's not anymore! They actually changed their defaults and it helped tremendously to reduce the exposure of Redis instances on the Internet.

New comment by achillean in "The importance of favicons in website OSINT research"

achillean — Fri, 24 Jan 2025 15:42:40 +0000

We released a tool to calculate the favicon hash called "favscan": https://blog.shodan.io/deep-dive-http-favicon/

And here's a map of favicons that Shodan has seen across the Internet: https://faviconmap.shodan.io/

New comment by achillean in "Show HN: Doggo – A powerful, human-friendly DNS client for the command line"

achillean — Mon, 01 Jul 2024 23:24:50 +0000

We developed "geodns" for situations where you want to do DNS lookups from different regions around the world. For example, ycombinator.com returns different IPs depending on your location:

  $ geodns ycombinator.com
  108.156.133.117                Singapore
  108.156.133.21                 Singapore
  108.156.133.25                 Singapore
  108.156.133.59                 Singapore
  108.156.39.26                  London
  108.156.39.61                  London
  108.156.39.62                  London
  108.156.39.64                  London
  13.32.27.123                   Frankfurt am Main
  13.32.27.47                    Frankfurt am Main
  13.32.27.51                    Frankfurt am Main
  13.32.27.80                    Frankfurt am Main
  13.35.93.12                    Clifton
  13.35.93.14                    Clifton
  13.35.93.46                    Clifton
  13.35.93.47                    Clifton
  18.239.94.100                  Amsterdam
  18.239.94.114                  Amsterdam
  18.239.94.33                   Amsterdam
  18.239.94.79                   Amsterdam
  99.86.20.42                    Doddaballapura
  99.86.20.54                    Doddaballapura
  99.86.20.64                    Doddaballapura
  99.86.20.96                    Doddaballapura

https://gitlab.com/shodan-public/geonet-rs

New comment by achillean in "OpenEMR: Open-source medical record software"

achillean — Sun, 23 Jun 2024 08:08:46 +0000

Looks like there are at least a few hundred instances of OpenEMR exposed to the Internet: https://www.shodan.io/search/report?query=http.favicon.hash%...

New comment by achillean in "SQLite is likely used more than all other database engines combined"

achillean — Sun, 16 Jun 2024 01:16:38 +0000

A few others:

- Want to distribute data to users that don't want to manage a server? A lot of people don't want to manage a server and don't need the best possible performance.

- Want to take data with you on a thumb drive and work with it offline? It's extremely convenient to be able to use SQLite for an app that has to work offline.

- Does the app mostly just read from the database and fit in memory? It's undervalued to just put the entire database into memory so you don't hit the disk and don't introduce network latency. For example, the following website does all enrichment with in-memory SQLite databases: https://shdn.io/analyze?target=ycombinator.com

At Shodan, we distribute versions of our datasets as SQLite and they're a popular way to consume the data without having to manage infrastructure.