Exposure

Lookups answers questions about one address. Exposure answers them about a small block of addresses at once: what is already published about everything around a given IP.

Exposure is on paid plans. Each run costs one network exposure check — 60 a month on Watch, 180 on Overwatch.

#What it does

Give it an address and a block size between /32 (that one address) and /29 (eight addresses). It geolocates the centre, looks up every host in the block, and reports, per host:

Open ports and the services behind them
Known CVEs already on record for that host
Hostnames and software fingerprints
A device class — router, camera, server, industrial device — inferred from what answers
A risk level, from the combination of the above

Results plot on the map at the block's location, so a network becomes a place rather than a list of numbers.

#Where the data comes from, and what that means

Exposure reads Shodan's InternetDB — a published dataset of scans Shodan has already performed.

Nothing is sent to the addresses you look up. No packet leaves for the subject, no connection is attempted, nothing appears in anyone's logs because of your query. You are reading a public record about the block, not probing it.

Two consequences worth holding on to:

The data is as old as the last scan. A port listed here was open when Shodan last looked; a port absent may have opened since.
Absence is weak evidence. A host that answers nothing in this dataset may simply not have been scanned recently, or may be filtering the scanner.

#Exposed CVEs

The second tab in the app narrows the same request to the vulnerability side: the CVEs already recorded against the addresses in a block, without the rest of the service detail.

It reads the same dataset as Exposure and costs the same meter.

#Why the block is capped at eight addresses

One request would otherwise fan out to hundreds of upstream lookups and hold resources for a minute at a time. Eight hosts per request keeps a check fast and keeps one user's sweep from becoming everyone's queue. Run several if you need a wider range.

#What this is not

This is not an attack-surface assessment of a system you own. It will not port-scan a host, inspect its TLS configuration, enumerate its subdomains, fingerprint its stack or run a vulnerability scan against it. exo[intel] does not perform active scanning of any kind, on any plan.

What it gives you is the honest, passive half of that question: what your block is already telling the internet, as the internet has already recorded it.