Shodan IoT search скрипты - обнаружение устройств 2026

<h2 id="poisk-po-portu">Поиск по порту</h2>

port:80



<h2 id="poisk-po-strane">Поиск по стране</h2>

country:RU



<h2 id="poisk-po-gorodu">Поиск по городу</h2>

city:Moscow



<h2 id="poisk-po-organizatsii">Поиск по организации</h2>

org:"Google LLC"



<h2 id="poisk-po-hostname">Поиск по hostname</h2>

hostname:example.com

<h2 id="obschiy-poisk-ip-kamer">Общий поиск IP-камер</h2>

"IP Webcam" port:80



<h2 id="poisk-kamer-s-rtsp">Поиск камер с RTSP</h2>

rtsp port:554



<h2 id="hikvision-kamery">Hikvision камеры</h2>

"Hikvision" port:80



<h2 id="dahua-kamery">Dahua камеры</h2>

"Dahua" port:80



<h2 id="axis-kamery">Axis камеры</h2>

"Axis" port:80

<h2 id="foscam-kamery">Foscam камеры</h2>

"Foscam" port:88



<h2 id="amcrest-kamery">Amcrest камеры</h2>

"Amcrest" port:80



<h2 id="reolink-kamery">Reolink камеры</h2>

"Reolink" port:80



<h2 id="tp-link-kamery">TP-Link камеры</h2>

"TP-Link" port:80



<h2 id="xiaomi-mi-home-kamery">Xiaomi Mi Home камеры</h2>

"Mi Home" port:80

<h2 id="kamery-s-defoltnymi-parolyami">Камеры с дефолтными паролями</h2>

"admin:admin" port:80 "IP Webcam"



<h2 id="kamery-bez-parolya">Камеры без пароля</h2>

"no password" port:80 webcam



<h2 id="ustarevshie-firmware">Устаревшие firmware</h2>

"Hikvision" "version:4.0" port:80



<h2 id="eksponirovannye-kamery">Экспонированные камеры</h2>

webcam port:80 country:US

<h2 id="obschiy-poisk-dvr">Общий поиск DVR</h2>

"DVR" port:80



<h2 id="nvr-sistemy">NVR системы</h2>

"NVR" port:80



<h2 id="avigilon-sistemy">Avigilon системы</h2>

"Avigilon" port:80



<h2 id="milestone-sistemy">Milestone системы</h2>

"Milestone" port:80



<h2 id="genetec-sistemy">Genetec системы</h2>

"Genetec" port:80

<h2 id="rtsp-potoki">RTSP потоки</h2>

rtsp port:554



<h2 id="http-videopotoki">HTTP видеопотоки</h2>

"rtsp://" port:80



<h2 id="mjpeg-potoki">MJPEG потоки</h2>

"mjpeg" port:80



<h2 id="h-264-potoki">H.264 потоки</h2>

"h.264" port:80

<h2 id="sistemy-kontrolya-dostupa">Системы контроля доступа</h2>

"Access Control" port:80



<h2 id="suprema-sistemy">Suprema системы</h2>

"Suprema" port:80



<h2 id="hid-sistemy">HID системы</h2>

"HID" port:80



<h2 id="honeywell-sistemy">Honeywell системы</h2>

"Honeywell" port:80

<h2 id="ulichnye-kamery">Уличные камеры</h2>

"traffic camera" port:80



<h2 id="domofonnye-kamery">Домофонные камеры</h2>

"intercom" port:80



<h2 id="kamery-v-magazinah">Камеры в магазинах</h2>

"store camera" port:80



<h2 id="kamery-v-ofisah">Камеры в офисах</h2>

"office camera" port:80

<h2 id="alexa-ustroystva">Alexa устройства</h2>

"Alexa" port:80



<h2 id="echo-dot">Echo Dot</h2>

"Echo Dot" port:80



<h2 id="amazon-echo">Amazon Echo</h2>

"Amazon Echo" port:443

<h2 id="google-home">Google Home</h2>

"Google Home" port:80



<h2 id="nest-hub">Nest Hub</h2>

"Nest Hub" port:80



<h2 id="chromecast">Chromecast</h2>

"Chromecast" port:80

<h2 id="homepod">HomePod</h2>

"HomePod" port:80



<h2 id="apple-tv">Apple TV</h2>

"Apple TV" port:80

<h2 id="nest-termostat">Nest термостат</h2>

"Nest" "thermostat" port:80



<h2 id="nest-learning">Nest Learning</h2>

"Nest Learning" port:443

<h2 id="ecobee">Ecobee</h2>

"Ecobee" port:80



<h2 id="ecobee-smart">Ecobee Smart</h2>

"Ecobee Smart" port:443

<h2 id="honeywell-thermostat">Honeywell thermostat</h2>

"Honeywell" "thermostat" port:80



<h2 id="lyric-termostat">Lyric термостат</h2>

"Lyric" port:80

<h2 id="lg-thinq">LG ThinQ</h2>

"LG ThinQ" port:80



<h2 id="lg-refrigerator">LG refrigerator</h2>

"LG" "refrigerator" port:80

<h2 id="samsung-smartthings">Samsung SmartThings</h2>

"SmartThings" port:80



<h2 id="samsung-refrigerator">Samsung refrigerator</h2>

"Samsung" "refrigerator" port:443

<h2 id="whirlpool">Whirlpool</h2>

"Whirlpool" port:80



<h2 id="whirlpool-appliance">Whirlpool appliance</h2>

"Whirlpool" "appliance" port:80

<h2 id="august-smart-lock">August Smart Lock</h2>

"August" "Smart Lock" port:80



<h2 id="august-connect">August Connect</h2>

"August Connect" port:443

<h2 id="schlage">Schlage</h2>

"Schlage" port:80



<h2 id="schlage-sense">Schlage Sense</h2>

"Schlage Sense" port:443

<h2 id="ring-video-doorbell">Ring Video Doorbell</h2>

"Ring" "Video Doorbell" port:80



<h2 id="ring-pro">Ring Pro</h2>

"Ring Pro" port:80

<h2 id="tp-link-kasa">TP-Link Kasa</h2>

"TP-Link Kasa" port:80



<h2 id="kasa-smart-plug">Kasa Smart Plug</h2>

"Kasa Smart Plug" port:9999

<h2 id="belkin-wemo">Belkin Wemo</h2>

"Belkin Wemo" port:80



<h2 id="wemo-switch">Wemo Switch</h2>

"Wemo Switch" port:49153

<h2 id="philips-hue-bridge">Philips Hue Bridge</h2>

"Philips Hue" port:80



<h2 id="hue-bridge">Hue Bridge</h2>

"Hue Bridge" port:80

<h2 id="scada-sistemy">SCADA системы</h2>

"SCADA" port:80



<h2 id="scada-web-interface">SCADA web interface</h2>

"SCADA" "web interface" port:8080



<h2 id="scada-login">SCADA login</h2>

"SCADA" "login" port:80

<h2 id="siemens-simatic">Siemens SIMATIC</h2>

"SIMATIC" port:80



<h2 id="siemens-wincc">Siemens WinCC</h2>

"WinCC" port:80



<h2 id="siemens-tia-portal">Siemens TIA Portal</h2>

"TIA Portal" port:102

<h2 id="allen-bradley">Allen-Bradley</h2>

"Allen-Bradley" port:44818



<h2 id="rockwell-plc">Rockwell PLC</h2>

"Rockwell" "PLC" port:80



<h2 id="factorytalk">FactoryTalk</h2>

"FactoryTalk" port:80

<h2 id="schneider-electric">Schneider Electric</h2>

"Schneider Electric" port:80



<h2 id="modicon-plc">Modicon PLC</h2>

"Modicon" port:502



<h2 id="citect-scada">Citect SCADA</h2>

"Citect" port:80

<h2 id="plc-kontrollery">PLC контроллеры</h2>

"PLC" port:502



<h2 id="modbus-protokol">Modbus протокол</h2>

modbus port:502



<h2 id="dnp3-protokol">DNP3 протокол</h2>

dnp3 port:20000

<h2 id="mitsubishi-plc">Mitsubishi PLC</h2>

"Mitsubishi" port:5002



<h2 id="omron-plc">Omron PLC</h2>

"Omron" port:9600



<h2 id="beckhoff-plc">Beckhoff PLC</h2>

"Beckhoff" port:48898

<h2 id="industrial-camera">Industrial camera</h2>

"industrial camera" port:80



<h2 id="basler-kamery">Basler камеры</h2>

"Basler" port:80



<h2 id="sony-industrial">Sony industrial</h2>

"Sony" "industrial" port:80

<h2 id="industrial-sensor">Industrial sensor</h2>

"industrial sensor" port:80



<h2 id="temperature-sensor">Temperature sensor</h2>

"temperature sensor" port:502



<h2 id="pressure-sensor">Pressure sensor</h2>

"pressure sensor" port:20000

<h2 id="smart-meter">Smart meter</h2>

"smart meter" port:80



<h2 id="electricity-meter">Electricity meter</h2>

"electricity meter" port:502



<h2 id="gas-meter">Gas meter</h2>

"gas meter" port:20000

<h2 id="energy-management">Energy management</h2>

"energy management" port:80



<h2 id="building-automation">Building automation</h2>

"building automation" port:47808



<h2 id="bacnet-protokol">BACnet протокол</h2>

bacnet port:47808

<h2 id="linksys-routery">Linksys роутеры</h2>

"Linksys" port:80



<h2 id="netgear-routery">Netgear роутеры</h2>

"Netgear" port:80



<h2 id="d-link-routery">D-Link роутеры</h2>

"D-Link" port:80



<h2 id="tp-link-routery">TP-Link роутеры</h2>

"TP-Link" port:80

<h2 id="cisco-routery">Cisco роутеры</h2>

"Cisco" port:80



<h2 id="juniper-routery">Juniper роутеры</h2>

"Juniper" port:80



<h2 id="huawei-routery">Huawei роутеры</h2>

"Huawei" port:80

<h2 id="cisco-switches">Cisco switches</h2>

"Cisco" port:23



<h2 id="hp-switches">HP switches</h2>

"HP" "switch" port:80



<h2 id="dell-switches">Dell switches</h2>

"Dell" "switch" port:80

<h2 id="netgear-smart-switch">Netgear smart switch</h2>

"Netgear" "smart switch" port:80



<h2 id="tp-link-smart-switch">TP-Link smart switch</h2>

"TP-Link" "smart switch" port:80



<h2 id="ubiquiti-switches">Ubiquiti switches</h2>

"Ubiquiti" port:80

<h2 id="wi-fi-access-point">Wi-Fi access point</h2>

"wireless access point" port:80



<h2 id="wi-fi-router">Wi-Fi router</h2>

"WiFi router" port:80



<h2 id="wireless-ap">Wireless AP</h2>

"Wireless AP" port:80

<h2 id="wps-enabled">WPS enabled</h2>

"WPS" port:80



<h2 id="wep-encryption-ustarevshaya">WEP encryption (устаревшая)</h2>

"WEP" port:80



<h2 id="default-password">Default password</h2>

"default password" "WiFi" port:80

<h2 id="synology-dsm">Synology DSM</h2>

"Synology" "DSM" port:5000



<h2 id="synology-diskstation">Synology DiskStation</h2>

"DiskStation" port:5000

<h2 id="qnap-storage">QNAP Storage</h2>

"QNAP" port:8080



<h2 id="qnap-ts">QNAP TS</h2>

"QNAP" "TS" port:80

<h2 id="wd-my-cloud">WD My Cloud</h2>

"My Cloud" port:80



<h2 id="wd-nas">WD NAS</h2>

"WD" "NAS" port:80

<h2 id="network-printer">Network printer</h2>

"network printer" port:80



<h2 id="hp-printer">HP printer</h2>

"HP" "printer" port:80



<h2 id="canon-printer">Canon printer</h2>

"Canon" "printer" port:80

<h2 id="mfp-device">MFP device</h2>

"MFP" port:80



<h2 id="all-in-one-printer">All-in-one printer</h2>

"all-in-one" port:80



<h2 id="multifunction-printer">Multifunction printer</h2>

"multifunction" port:9100

<h2 id="medical-camera">Medical camera</h2>

"medical camera" port:80



<h2 id="endoscope-camera">Endoscope camera</h2>

"endoscope" port:80



<h2 id="surgical-camera">Surgical camera</h2>

"surgical camera" port:80

<h2 id="patient-monitor">Patient monitor</h2>

"patient monitor" port:80



<h2 id="vital-signs-monitor">Vital signs monitor</h2>

"vital signs" port:80



<h2 id="ecg-monitor">ECG monitor</h2>

"ECG" port:80

<h2 id="pacs-system">PACS system</h2>

"PACS" port:80



<h2 id="dicom-viewer">DICOM viewer</h2>

"DICOM" port:80



<h2 id="medical-imaging">Medical imaging</h2>

"medical imaging" port:104

<h2 id="lab-equipment">Lab equipment</h2>

"lab equipment" port:80



<h2 id="medical-analyzer">Medical analyzer</h2>

"medical analyzer" port:80



<h2 id="blood-analyzer">Blood analyzer</h2>

"blood analyzer" port:80

<h2 id="infusion-pump">Infusion pump</h2>

"infusion pump" port:80



<h2 id="iv-pump">IV pump</h2>

"IV pump" port:80



<h2 id="syringe-pump">Syringe pump</h2>

"syringe pump" port:80

<h2 id="x-ray-machine">X-ray machine</h2>

"X-ray" port:80



<h2 id="ct-scanner">CT scanner</h2>

"CT scanner" port:80



<h2 id="mri-machine">MRI machine</h2>

"MRI" port:80

<h2 id="kamery-v-opredelennoy-strane">Камеры в определенной стране</h2>

webcam port:80 country:RU



<h2 id="uyazvimye-routery-v-gorode">Уязвимые роутеры в городе</h2>

router port:80 city:Moscow "admin:admin"



<h2 id="iot-ustroystva-s-opredelennym-firmware">IoT устройства с определенным firmware</h2>

"smart home" port:80 "firmware:1.0"

<h2 id="ustroystva-v-radiuse">Устройства в радиусе</h2>

geo:55.7558,37.6173,10  # Москва, радиус 10км



<h2 id="kamery-v-regione">Камеры в регионе</h2>

webcam port:80 region:Saint-Petersburg



<h2 id="ustroystva-po-pochtovomu-indeksu">Устройства по почтовому индексу</h2>

iot port:80 postal:101000

<h2 id="nedavno-dobavlennye-ustroystva">Недавно добавленные устройства</h2>

webcam port:80 after:2024-01-01



<h2 id="ustroystva-naydennye-do-opredelennoy-daty">Устройства, найденные до определенной даты</h2>

iot port:80 before:2024-12-01

<h2 id="heartbleed-uyazvimye-ustroystva">Heartbleed уязвимые устройства</h2>

"OpenSSL" "1.0.1" port:443



<h2 id="shellshock-uyazvimye">Shellshock уязвимые</h2>

"Bash" port:80



<h2 id="wannacry-uyazvimye">WannaCry уязвимые</h2>

"Windows" "445" port:445

<h2 id="defoltnye-paroli">Дефолтные пароли</h2>

"admin:admin" port:80



<h2 id="pustye-paroli">Пустые пароли</h2>

"no password" port:80



<h2 id="slabye-paroli">Слабые пароли</h2>

"password:123456" port:80

<h2 id="otkrytyy-telnet">Открытый Telnet</h2>

port:23



<h2 id="otkrytyy-ftp">Открытый FTP</h2>

port:21



<h2 id="otkrytyy-rdp">Открытый RDP</h2>

port:3389

<h2 id="ustarevshie-servery">Устаревшие серверы</h2>

"Server: Apache/2.2" port:80



<h2 id="uyazvimye-php-versii">Уязвимые PHP версии</h2>

"X-Powered-By: PHP/5.6" port:80



<h2 id="eksponirovannye-zagolovki">Экспонированные заголовки</h2>

"X-Forwarded-For" port:80

<h2 id="ustarevshie-ssh">Устаревшие SSH</h2>

"SSH-1.99" port:22



<h2 id="openssh-versii">OpenSSH версии</h2>

"OpenSSH_7.2" port:22

<h2 id="ftp-servery">FTP серверы</h2>

"220" "FTP" port:21



<h2 id="anonimnyy-ftp">Анонимный FTP</h2>

"Anonymous FTP" port:21

#!/usr/bin/env python3

import shodan

import sys



<h2 id="initsializatsiya-api">Инициализация API</h2>

SHODAN_API_KEY = "your_api_key_here"

api = shodan.Shodan(SHODAN_API_KEY)



<h2 id="funktsiya-poiska">Функция поиска</h2>

def shodan_search(query, limit=10):

    try:

        results = api.search(query, limit=limit)

        print(f"Результаты поиска: {results['total']}")

        

        for result in results['matches']:

            print(f"IP: {result['ip_str']}")

            print(f"Port: {result['port']}")

            print(f"Hostnames: {result.get('hostnames', [])}")

            print(f"Data: {result['data'][:200]}...")

            print("-" * 50)

            

    except shodan.APIError as e:

        print(f"Ошибка: {e}")



if __name__ == "__main__":

    if len(sys.argv) != 2:

        print("Использование: python shodan_search.py 'query'")

        sys.exit(1)

    

    query = sys.argv[1]

    shodan_search(query)

#!/usr/bin/env python3

import shodan

import json

import csv



SHODAN_API_KEY = "your_api_key_here"

api = shodan.Shodan(SHODAN_API_KEY)



<h2 id="spisok-iot-poiskovyh-zaprosov">Список IoT поисковых запросов</h2>

IOT_QUERIES = [

    'webcam port:80',

    'router port:80',

    'printer port:80',

    'smart home port:80',

    'thermostat port:80',

    '"IP Webcam" port:80',

    'SCADA port:80',

    'PLC port:502'

]



def search_iot_devices():

    all_results = []

    

    for query in IOT_QUERIES:

        print(f"Поиск: {query}")

        try:

            results = api.search(query, limit=5)

            

            for result in results['matches']:

                device_info = {

                    'query': query,

                    'ip': result['ip_str'],

                    'port': result['port'],

                    'country': result.get('location', {}).get('country_name', ''),

                    'city': result.get('location', {}).get('city', ''),

                    'org': result.get('org', ''),

                    'banner': result['data'][:500]

                }

                all_results.append(device_info)

                

        except shodan.APIError as e:

            print(f"Ошибка при поиске {query}: {e}")

    

    return all_results



def save_to_csv(results, filename='iot_devices.csv'):

    if not results:

        print("Нет результатов для сохранения")

        return

    

    with open(filename, 'w', newline='', encoding='utf-8') as csvfile:

        fieldnames = ['query', 'ip', 'port', 'country', 'city', 'org', 'banner']

        writer = csv.DictWriter(csvfile, fieldnames=fieldnames)

        

        writer.writeheader()

        for result in results:

            writer.writerow(result)

    

    print(f"Результаты сохранены в {filename}")



if __name__ == "__main__":

    results = search_iot_devices()

    save_to_csv(results)

    print(f"Найдено устройств: {len(results)}")

#!/usr/bin/env python3

import shodan

import time

import smtplib

from email.mime.text import MIMEText



SHODAN_API_KEY = "your_api_key_here"

EMAIL_FROM = "your_email@example.com"

EMAIL_TO = "alert@example.com"

SMTP_SERVER = "smtp.example.com"



api = shodan.Shodan(SHODAN_API_KEY)



<h2 id="uyazvimye-zaprosy-dlya-monitoringa">Уязвимые запросы для мониторинга</h2>

VULNERABLE_QUERIES = [

    '"admin:admin" webcam port:80',

    '"default password" router port:80',

    'SCADA port:80 "login"',

    'printer port:80 "no password"'

]



def check_vulnerabilities():

    alerts = []

    

    for query in VULNERABLE_QUERIES:

        try:

            results = api.search(query, limit=10)

            

            if results['total'] > 0:

                alert = {

                    'query': query,

                    'count': results['total'],

                    'sample_ips': [r['ip_str'] for r in results['matches'][:3]]

                }

                alerts.append(alert)

                

        except shodan.APIError as e:

            print(f"Ошибка при проверке {query}: {e}")

    

    return alerts



def send_alert_email(alerts):

    if not alerts:

        return

    

    subject = f"Shodan Alert: {len(alerts)} уязвимых устройств найдено"

    

    body = "Обнаружены потенциально уязвимые IoT устройства:\n\n"

    

    for alert in alerts:

        body += f"Запрос: {alert['query']}\n"

        body += f"Количество: {alert['count']}\n"

        body += f"Примеры IP: {', '.join(alert['sample_ips'])}\n\n"

    

    msg = MIMEText(body)

    msg['Subject'] = subject

    msg['From'] = EMAIL_FROM

    msg['To'] = EMAIL_TO

    

    try:

        server = smtplib.SMTP(SMTP_SERVER)

        server.sendmail(EMAIL_FROM, EMAIL_TO, msg.as_string())

        server.quit()

        print("Alert email sent")

    except Exception as e:

        print(f"Failed to send email: {e}")



def main():

    while True:

        print("Проверка уязвимостей...")

        alerts = check_vulnerabilities()

        

        if alerts:

            print(f"Найдено {len(alerts)} потенциальных уязвимостей")

            send_alert_email(alerts)

        else:

            print("Уязвимости не найдены")

        

        # Проверка каждые 24 часа

        time.sleep(86400)



if __name__ == "__main__":

    main()

#!/usr/bin/env python3

import shodan

import json

import argparse



SHODAN_API_KEY = "your_api_key_here"

api = shodan.Shodan(SHODAN_API_KEY)



def export_results(query, limit=100, format='json'):

    try:

        results = api.search(query, limit=limit)

        

        if format == 'json':

            with open(f'shodan_{query.replace(" ", "_")}.json', 'w') as f:

                json.dump(results, f, indent=2)

        elif format == 'csv':

            import csv

            with open(f'shodan_{query.replace(" ", "_")}.csv', 'w', newline='') as f:

                writer = csv.writer(f)

                writer.writerow(['IP', 'Port', 'Country', 'City', 'Org', 'Banner'])

                

                for result in results['matches']:

                    writer.writerow([

                        result['ip_str'],

                        result['port'],

                        result.get('location', {}).get('country_name', ''),

                        result.get('location', {}).get('city', ''),

                        result.get('org', ''),

                        result['data'][:200]

                    ])

        

        print(f"Экспортировано {len(results['matches'])} результатов")

        

    except shodan.APIError as e:

        print(f"Ошибка: {e}")



if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='Shodan data exporter')

    parser.add_argument('query', help='Search query')

    parser.add_argument('--limit', type=int, default=100, help='Result limit')

    parser.add_argument('--format', choices=['json', 'csv'], default='json', help='Export format')

    

    args = parser.parse_args()

    export_results(args.query, args.limit, args.format)

<h2 id="ispolzuyte-shodan-facets-dlya-statistiki">Используйте Shodan facets для статистики</h2>

curl -H "X-Shodan-API-Key: YOUR_API_KEY" \

  "https://api.shodan.io/shodan/host/search/facets?query=webcam&facets=country"



<h2 id="analiz-s-python">Анализ с Python</h2>

import shodan

api = shodan.Shodan(SHODAN_API_KEY)



results = api.search('webcam port:80')

countries = {}



for result in results['matches']:

    country = result.get('location', {}).get('country_name', 'Unknown')

    countries[country] = countries.get(country, 0) + 1



<h2 id="sortirovka-po-kolichestvu">Сортировка по количеству</h2>

sorted_countries = sorted(countries.items(), key=lambda x: x[1], reverse=True)

for country, count in sorted_countries[:10]:

    print(f"{country}: {count}")

<h2 id="raspredelenie-portov">Распределение портов</h2>

ports = {}

for result in results['matches']:

    port = result['port']

    ports[port] = ports.get(port, 0) + 1



<h2 id="vyvod-top-portov">Вывод топ портов</h2>

for port, count in sorted(ports.items(), key=lambda x: x[1], reverse=True)[:10]:

    print(f"Port {port}: {count} устройств")

import folium

import shodan



api = shodan.Shodan(SHODAN_API_KEY)

results = api.search('webcam port:80', limit=100)



<h2 id="sozdanie-karty">Создание карты</h2>

m = folium.Map(location=[20, 0], zoom_start=2)



for result in results['matches']:

    location = result.get('location')

    if location and 'latitude' in location and 'longitude' in location:

        folium.Marker(

            location=[location['latitude'], location['longitude']],

            popup=f"{result['ip_str']}:{result['port']}<br>{result['data'][:100]}..."

        ).add_to(m)



m.save('iot_devices_map.html')

import matplotlib.pyplot as plt

import shodan



api = shodan.Shodan(SHODAN_API_KEY)

results = api.search('iot port:80', limit=500)



<h2 id="sbor-dannyh-po-stranam">Сбор данных по странам</h2>

countries = {}

for result in results['matches']:

    country = result.get('location', {}).get('country_name', 'Unknown')

    countries[country] = countries.get(country, 0) + 1



<h2 id="sozdanie-grafika">Создание графика</h2>

plt.figure(figsize=(12, 6))

plt.bar(list(countries.keys())[:15], list(countries.values())[:15])

plt.xticks(rotation=45, ha='right')

plt.title('Распределение IoT устройств по странам')

plt.xlabel('Страна')

plt.ylabel('Количество устройств')

plt.tight_layout()

plt.savefig('iot_countries.png')

plt.show()

import shodan

from reportlab.lib import colors

from reportlab.lib.pagesizes import letter

from reportlab.platypus import SimpleDocTemplate, Table, TableStyle



def generate_report(query, filename='shodan_report.pdf'):

    api = shodan.Shodan(SHODAN_API_KEY)

    results = api.search(query, limit=50)

    

    doc = SimpleDocTemplate(filename, pagesize=letter)

    elements = []

    

    # Данные для таблицы

    data = [['IP', 'Port', 'Country', 'Organization']]

    for result in results['matches']:

        data.append([

            result['ip_str'],

            str(result['port']),

            result.get('location', {}).get('country_name', 'Unknown'),

            result.get('org', 'Unknown')[:30]

        ])

    

    # Создание таблицы

    table = Table(data)

    table.setStyle(TableStyle([

        ('BACKGROUND', (0, 0), (-1, 0), colors.grey),

        ('TEXTCOLOR', (0, 0), (-1, 0), colors.whitesmoke),

        ('ALIGN', (0, 0), (-1, -1), 'CENTER'),

        ('FONTNAME', (0, 0), (-1, 0), 'Helvetica-Bold'),

        ('FONTSIZE', (0, 0), (-1, 0), 14),

        ('BOTTOMPADDING', (0, 0), (-1, 0), 12),

        ('BACKGROUND', (0, 1), (-1, -1), colors.beige),

    ]))

    

    elements.append(table)

    doc.build(elements)

    print(f"Отчет сохранен в {filename}")



generate_report('webcam port:80')

<h2 id="otpravka-rezultatov-v-siem">Отправка результатов в SIEM</h2>

curl -X POST -H "Content-Type: application/json" \

  -d '{"source":"shodan","data":'$SHODAN_RESULTS'}' \

  http://siem.example.com/api/ingest

<h2 id="sravnenie-rezultatov-so-vremenem">Сравнение результатов со временем</h2>

def monitor_changes(query, previous_results):

    current_results = api.search(query)

    current_ips = set(r['ip_str'] for r in current_results['matches'])

    previous_ips = set(r['ip_str'] for r in previous_results['matches'])

    

    new_devices = current_ips - previous_ips

    disappeared_devices = previous_ips - current_ips

    

    return new_devices, disappeared_devices