xSpctr homexSpctr

Research & authorities

Global data.
Fine-grained search.

A separate platform designed for government, authorities, research, CERT and law-enforcement work: research across a whole country’s or region’s internet-facing hosts and services, not limited to a scope you own.

Request access
Contact us
fortigate

318 hosts

  1. 203.0.113.30:443matched in titleFortiGate
  2. 198.51.100.61:10443matched in namefortigate.example.com
  3. 192.0.2.18:443matched in page…/remote/login…

Global data

No limited scope.

A company account sees the domains it verified. Research covers the internet-facing hosts and services of a whole country or region.

5 hosts under the domains one company verified

Every internet-facing host of a country or region, with what was found

Search

A query language,
down to one banner.

Fields joined by AND, OR and NOT, a minus to exclude, brackets, "phrases" and * wildcards. Every result says where it matched.

banner:mikrotik -port:22

1,204 hosts

  1. 203.0.113.14:21matched in banner220 MikroTik FTP server ready
  2. 203.0.113.52:23matched in bannerMikroTik v6 Login:
  3. 198.51.100.23:21matched in banner220 MikroTik FTP server ready
fortigate

318 hosts

  1. 203.0.113.30:443matched in titleFortiGate
  2. 198.51.100.61:10443matched in namefortigate.example.com
  3. 192.0.2.18:443matched in page…/remote/login…
ip:203.0.113.0/24 AND kev:yes

4 hosts

  1. 203.0.113.40:443matched in addressApache/2.4.49 · CVE-2021-41773
  2. 203.0.113.30:443matched in addressa known-exploited CVE matches
  3. 203.0.113.77:80matched in addressa known-exploited CVE matches
name:*.example.com AND (port:3389 OR port:5900)

3 hosts

  1. api-dev.example.com:3389matched in nameRemote Desktop
  2. lab.example.com:5900matched in nameVNC
  3. ops.example.com:3389matched in nameRemote Desktop

Fields

  • title:page title
  • content:page content
  • banner:service banner
  • tech:technology
  • name:host name
  • net:network
  • ip:address or range
  • cert:certificate
  • port:port
  • kev:known-exploited
  • cve:CVE
  • favicon:favicon
  • page:page fingerprint
  • jarm:TLS fingerprint

Operators

  • ANDboth
  • OReither
  • NOTnot this
  • -port:22minus excludes
  • ( )group parts
  • "sign in"an exact phrase
  • *.example.comwildcard

Related hosts

Same fingerprint,
related hosts.

From one host to the others that share its favicon, its page or its TLS fingerprint (JARM).

favicon-1838420281

  • 203.0.113.30 :443sign-in page
  • 198.51.100.61 :10443sign-in page
  • 192.0.2.18 :443sign-in page
  • 203.0.113.88 :8443sign-in page

page fingerprint1485257654

  • vpn.example.orgsame login page
  • 203.0.113.12 :443same login page
  • 198.51.100.4 :443same login page

JARM29d29d00029d…

  • 203.0.113.30 :443same TLS answer
  • 203.0.113.31 :443same TLS answer
  • 198.51.100.90 :443same TLS answer
  • 192.0.2.77 :8443same TLS answer
  • 192.0.2.78 :8443same TLS answer

Risks

By category,
ranked by High.

Risks are grouped by category, for example remote control, directory services and industrial control, and ranked by their High findings.

Risks by categoryranked by High findings
  1. 01Remote control142 High310 hosts
  2. 02Directory services61 High128 hosts
  3. 03Industrial control23 High40 hosts

Briefings

Per network,
per risk.

A briefing for one network or one risk, ready to hand over: Print to PDF.

Briefing · AS64500network · demo
  • Hosts1,204
  • High findings38
  • Top riskRemote control, 14 High
  • Known-exploited6 hosts

Print to PDF

Briefing · Remote controlrisk · demo
  • Hosts310
  • High findings142
  • Most seenRemote Desktop, VNC
  • NetworksAS64500 and 41 more

Print to PDF

Public bodies

An entity for
each public body.

Ministries, communes and agencies each get their own entity. Its scope is set by central administrators, not by the entity.

Central administratorscreate entities and set their scope

  • Ministry (demo)example.com198.51.100.0/24sees only its own scope
  • Commune (demo)example.netsees only its own scope
  • Agency (demo)example.org203.0.113.0/24sees only its own scope

Built apart

Its own platform,
on request.

  • Its own sign-in

    A separate platform with its own accounts.

  • Its own data

    Never mixed with the data of company customers.

  • Access on request

    For government, authorities, research, CERT and law-enforcement teams.

Questions

Research, explained

Is this part of the company platform?

No. It is a separate platform with its own sign-in and its own data. Nothing from it is mixed with the data of company customers.

Who can get access?

Teams in government, authorities, research, CERTs and law enforcement, on request. Tell us who you are and what you need to research.

Can a ministry or a commune see only its own hosts?

Yes. Each public body gets its own entity, and central administrators set the scope of each entity.

Research access, on request.

Tell us who you are and what you need to research.

Request access
Contact us