Comparative analysis of Shodan and Censys platforms for assessing IoT exposure

Abstract

The exponential growth of Internet of Things (IoT) infrastructures has introduced new cybersecurity challenges, often poorly managed or overlooked. This study aims to compare two major Open Source Intelligence (OSINT) platforms, Shodan and Censys, in order to evaluate their effectiveness in mapping exposed infrastructures and identifying potential vulnerabilities. Previous research has shown the importance of OSINT tools for network reconnaissance and threat intelligence, yet few studies have directly compared their practical accuracy and data coverage. Building on existing analyses of IoT security assessment frameworks, this paper focuses on the empirical differences between two widely used scanning platforms. The research involved extracting 561 IP addresses from the BitTorrent network and querying both Shodan and Censys using their free access interfaces. The analysis assessed detection rates, metadata richness (open ports, protocols, TLS certificates), and capabilities in identifying insecure configurations and outdated software components. The results reveal notable differences between the platforms in detection accuracy, data freshness, and the identification of standard services (HTTP/HTTPS, SSH, FTP, Telnet) as well as IoT-specific protocols (MQTT, CoAP, Modbus). These differences highlight the distinct scanning methodologies and indexing strategies used by each tool. The findings offer practical guidance for researchers and cybersecurity practitioners in selecting appropriate OSINT instruments for large-scale exposure analysis. The paper contributes a structured comparative framework for evaluating OSINT-based network intelligence platforms, enhancing understanding of their limitations and potential applications in securing IoT ecosystems.