What Scanning gives you
- Host context - IP address, ASN, ISP, country, observed ports, protocols, transports, tags, and first-seen and last-seen dates.
- Service evidence - Protocol status, banners, HTTP and TLS facts, certificates, fingerprints, and protocol-specific fields.
- Typed protocol data - Query parsed fields instead of searching only raw banners.
- Observation history - Filter recent results, compare time windows, and follow changes in exposed services.
- Detection tags - Use curated classifications to move from a protocol observation to the security meaning behind it.
The page as a browser sees it
Most scanning stops at what a socket returns. Infrawatch also renders web services in a real browser and keeps what the page did, not just what it sent.
A banner tells you a web server is running. This tells you which application it
is, who instrumented it, and where else the same operator has deployed it.
Evidence records both what was kept and what existed, through paired
*_stored_count and *_total_count fields. When capture limits truncate a
page, the result says so rather than presenting a partial record as complete.Indicators extracted from the page
Criminal infrastructure has to be reachable to be useful. Ransomware leak sites publish a negotiation contact, scam pages publish a wallet, and marketplaces publish both. Infrawatch extracts those identifiers from the HTML body while scanning, validates them, and keeps them as typed evidence.
These are the artefacts that survive a rebuild. An operator can move hosts,
change providers, and re-theme a site, but the wallet still has to be theirs and
the contact still has to reach them.
These fields are available to detection rules
under
infrawatch.scan.http.response.body.html, which is where you turn one
observed wallet or contact into a standing detection:
Fingerprints on every observation
Each observed service is fingerprinted as it is scanned, so clustering is available immediately rather than being something you compute afterwards. That covers the full JA4 suite for TLS, HTTP, TCP, and network behaviour, HASSH for SSH, JA4X for certificate structure, and content hashes over what the service actually served. The two families fail differently, which is the point: an operator who changes their TLS stack usually keeps their page, and one who rewrites their page usually keeps their stack.
Fingerprinting
Every fingerprint and content hash, with worked pivots that combine them.
Coverage
Transport is searchable directly.
transport_protocol takes tcp, udp, or
tls, so you can ask for a class of exposure rather than guessing at ports:
Region-specific protocols
Web-first scanners concentrate on the protocols that are common everywhere, which leaves whole categories of exposed infrastructure unparsed. Infrawatch probes the protocols that dominate particular regions and industries, and parses them into typed fields like any other service.
That matters when a query has to be complete. A search for exposed industrial
control systems that only understands the protocols popular in one market
returns a regional answer while looking like a global one.
Browse every protocol
All parsed protocols with their fields, types, and operators.
Start an investigation
same_service(...) keeps every condition on one observed service when you
search hosts. Without it, separate services on the same host may satisfy
different conditions.
Hunt exposed services
Combine protocol, network, HTTP, TLS, fingerprint, and tag evidence.
Browse service fields
Find typed fields and the operators each one supports.
JA4 and fingerprints
Cluster related infrastructure using TLS, HTTP, TCP, SSH, and certificate fingerprints.
Scanning policy
Understand scope, safety controls, and opt-out handling.
Write a detection rule
Turn typed scan observations into a reusable detection.