Data & access
The observations behind this study are open. Query them live or export a snapshot for offline analysis, with original Observatory metadata licensed separately from third-party material.
How to get the data
- Export API. GET /api/v2/export?format=json|csv returns records with the same filters as search (q, network, time_range, product, port, status, secured, has_vulns, tag, verdict, limit, offset, sort). Sort values are newest, relevance, vulns, ip. Requests are rate-limited. Pagination is manual: request 1–2,000 records at a time with limit, then increase offset until an export contains fewer records than requested. Export responses do not include a total or next-page link. The response headers X-RWO-Schema-Version and X-RWO-Generated-At identify the contract and export time.
- Live JSON API. The read endpoints under /api/v2/ (gallery, search, map, stats, per-service detail, enrichment) power this site and are documented in the repository. Machine-readable contracts are available as OpenAPI and JSON Schema.
- Snapshots. Dated archival dumps are planned but are not published yet. Until then, record the export time and query parameters when citing a live export.
Examples
Record schema
Each record describes one observed service. The JSON export uses the same summary-record shape as gallery and search, including capture URLs and metadata when available. Its core fields are:
| Field | Meaning |
|---|---|
ip / port | The observed service endpoint. |
banner / product | Service banner and the parsed product/version, when present. |
http_status | HTTP status returned by the capture. |
secured | true = captured over TLS (HTTPS); false = cleartext HTTP. |
cert_cn | TLS certificate common name, when HTTPS. |
geo | Coarse IP-based geolocation (country, region, city, lat/lon, and accuracy radius). |
whois | Network / organization from WHOIS, when available. |
vuln_count | Number of CVEs Shodan InternetDB associates with the host, not necessarily this service. |
verdict | A derived summary of third-party reputation evidence; not an independently verified finding. |
sources | Which enrichment feeds contributed to this record. |
enriched_at | When enrichment was last refreshed (RFC 3339). |
updated_at | When the service was last observed (RFC 3339). |
The flat CSV export is intentionally smaller. Its columns are ip, port, secured, http_status, product, product_version, banner, cert_cn, whois, country_iso, city, lat, lon, vuln_count, verdict, sources, enriched_at, updated_at. In particular, CSV includes only country code, city, and coordinates from the richer JSON geo object.
License
Original Observatory metadata, annotations, and applicable database rights are released under Creative Commons Attribution 4.0 (CC-BY-4.0) — free to use, share, and build on with attribution. That license does not grant rights the Observatory does not hold. Captured screenshots and page content, provider-supplied data, trademarks, privacy or publicity rights, and other third-party material remain subject to their respective owners' rights and provider terms.
The source code has a separate rights status. Publication of the Go reimplementation was authorized by elixx, creator of the private Python system behind What's on HTTP, but an open-source license for portions based on that system has not yet been documented. No new source-code license is currently offered. See the repository's licensing and provenance records before reusing source code.
How to cite
Please cite the dataset and note the snapshot date when using it in published work.