> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Scanning > Search continuously refreshed observations of internet hosts and services Infrawatch continuously scans public internet infrastructure and turns protocol responses into typed, searchable observations. Use Scanning to understand what a host exposes now and how that exposure has changed. ## What Scanning gives you * **Host context** - IP address, ASN, ISP, country, observed ports, protocols, transports, tags, and first-seen and last-seen dates. * **Service evidence** - Protocol status, banners, HTTP and TLS facts, certificates, fingerprints, and protocol-specific fields. * **Typed protocol data** - Query parsed fields instead of searching only raw banners. * **Observation history** - Filter recent results, compare time windows, and follow changes in exposed services. * **Detection tags** - Use curated classifications to move from a protocol observation to the security meaning behind it. ## The page as a browser sees it Most scanning stops at what a socket returns. Infrawatch also renders web services in a real browser and keeps what the page did, not just what it sent. | Captured | Why it matters | | --------------------- | ---------------------------------------------------------------------------------------------------------- | | Console output | Errors and debug output name the framework, the kit, and often the developer's own hostnames | | Downloads | Files the page pulled down, with filename, MIME type, size, and hashes | | Network transactions | Every request the page made, with response hashes, including the third parties it reached | | Frames | Domains and hosts loaded in iframes, which is where embedded panels and kits appear | | JavaScript globals | The names and types a page defines, which identify a framework even when the branding is stripped | | Analytics identifiers | Tag and analytics IDs with their provider, the classic way to link separate infrastructure to one operator | | Browser storage | Values the page leaves behind | | Redirects and links | Where the page sends a visitor next | A banner tells you a web server is running. This tells you which application it is, who instrumented it, and where else the same operator has deployed it. Evidence records both what was kept and what existed, through paired `*_stored_count` and `*_total_count` fields. When capture limits truncate a page, the result says so rather than presenting a partial record as complete. ## Indicators extracted from the page Criminal infrastructure has to be reachable to be useful. Ransomware leak sites publish a negotiation contact, scam pages publish a wallet, and marketplaces publish both. Infrawatch extracts those identifiers from the HTML body while scanning, validates them, and keeps them as typed evidence. | Extracted | Detail | | ------------------------ | -------------------------------------------------------------------------------------------------- | | Email addresses | From visible text or `mailto:` links, lowercased and deduplicated | | Tox IDs | 76-character Tox addresses, checksum-validated | | Cryptocurrency addresses | Validated public addresses, each with its normalized currency such as bitcoin, ethereum, or monero | | OpenPGP key IDs | 16-character key IDs from armored blocks, with private-key packets tracked separately | | Key material | The kinds of key, certificate, and armored blocks present, and how many | These are the artefacts that survive a rebuild. An operator can move hosts, change providers, and re-theme a site, but the wallet still has to be theirs and the contact still has to reach them. Only identifiers are kept. Raw private-key values and raw key or certificate bytes are never stored, so a private key found on a page is recorded as its kind and a count, not its value. These fields are available to [detection rules](/scanning/rules/writing-rules) under `infrawatch.scan.http.response.body.html`, which is where you turn one observed wallet or contact into a standing detection: ```yara theme={null} condition: defined infrawatch.scan.http.response.body.html.crypto.private_key_count and infrawatch.scan.http.response.body.html.crypto.private_key_count > 0 ``` ## Fingerprints on every observation Each observed service is fingerprinted as it is scanned, so clustering is available immediately rather than being something you compute afterwards. That covers the full JA4 suite for TLS, HTTP, TCP, and network behaviour, HASSH for SSH, JA4X for certificate structure, and content hashes over what the service actually served. The two families fail differently, which is the point: an operator who changes their TLS stack usually keeps their page, and one who rewrites their page usually keeps their stack. Every fingerprint and content hash, with worked pivots that combine them. ## Coverage | | | | ------------------------------------------ | ----------- | | Protocols parsed into typed fields | 199 | | Queryable fields on the `services` dataset | 2,374 | | Protocols probed over UDP | Close to 50 | Transport is searchable directly. `transport_protocol` takes `tcp`, `udp`, or `tls`, so you can ask for a class of exposure rather than guessing at ports: ```text theme={null} transport_protocol:udp AND protocol:coap ``` UDP is where the quiet exposure lives. Services like mDNS, SSDP, CoAP, MQTT-SN, and WS-Discovery are rarely reached by TCP-oriented scanning, and they answer readily to anyone who asks. ## Region-specific protocols Web-first scanners concentrate on the protocols that are common everywhere, which leaves whole categories of exposed infrastructure unparsed. Infrawatch probes the protocols that dominate particular regions and industries, and parses them into typed fields like any other service. | Where it is common | Protocols | | -------------------------------------- | ------------------------------------------ | | Japanese factory floors | `melsecq`, `fins` | | German and European industrial control | `s7comm`, `proconos`, `pcworx` | | European building and grid systems | `eib_knx_homeserver`, `iec104`, `iec61850` | | North American utilities | `dnp3`, `ge_srtp` | | European automotive | `autosar_dlt` | That matters when a query has to be complete. A search for exposed industrial control systems that only understands the protocols popular in one market returns a regional answer while looking like a global one. All parsed protocols with their fields, types, and operators. ## Start an investigation ```text theme={null} same_service( protocol:https AND port:443 AND tls.not_after Combine protocol, network, HTTP, TLS, fingerprint, and tag evidence. Find typed fields and the operators each one supports. Cluster related infrastructure using TLS, HTTP, TCP, SSH, and certificate fingerprints. Understand scope, safety controls, and opt-out handling. Turn typed scan observations into a reusable detection.