A Scan-Based Analysis of Internet-Exposed IoT Devices Using Shodan Data

Abstract

Determining whether scan-observable network configurations capture meaningful characteristics of security exposure across large-scale Internet of Things (IoT) populations remains an open problem in measurement research. This study analyzes Internet-exposed IoT endpoints associated with the TR-069 protocol across a global population exceeding 37 million hosts, using a structured sample of 7,634 hosts derived from approximately 10,000 hosts identified via Shodan Search and Shodan InternetDB. Data were collected during a fixed observation window in April 2026 across ten countries with the highest observed prevalence of transmission control protocol (TCP) port 7547 exposure. Scan-derived metadata, including open ports, service indicators, customer premises equipment (CPE) identifiers, vulnerability-associated fields, and network attribution metadata, were used to construct a composite exposure proxy representing externally observable service-surface characteristics. The analysis combines descriptive statistics, the Kruskal–Wallis H test, and exploratory feature separability analysis to assess geographic variation and whether service-level characteristics differentiate exposure groups. Results show statistically significant cross-country variation in exposure structure. Logistic regression and random forest analyses produced limited feature separability, with the random forest approach achieving a balanced accuracy of 0.58. These findings suggest that Internet-wide scan data can support systematic population-level analysis of IoT exposure while highlighting the limitations of port-based features as indicators of broader exposure characteristics. The study provides a reproducible framework for large-scale exposure measurement using passive scan data without requiring device interaction or exploit-based validation.