The Shadowserver Foundation

Accessible/Open CoAP Server Scanning Project

If you are looking at this page, then more than likely, you noticed a scan coming from this server across your network and/or poking at your CoAP (Constrained Application Protocol) service.

The Shadowserver Foundation is currently undertaking a project to search for publicly accessible devices that have a Constrained Application Protocol (CoAP) server running. The goal of this project is to identify openly accessible systems that have CoAP running and report them back to the network owners for remediation.

In addition to CoAP services having a habit of leaking information (including authorization credentials to services, such as wifi networks), these devices have the potential to be used in UDP amplification attacks and if at all possible, we would like to see these services made un-available to miscreants that would misuse these resources.

All CoAP servers that we find have been incorporated into our reports and are being reported on a daily basis.

Methodology

We are querying all computers with routable IPv4 addresses that are not firewalled from the internet on port 5693/udp with a 21-byte CoAP CoRE Resource Discovery request, which is a CoAP GET request for /.well-known/core and capturing the response. We intend no harm, but if we are causing problems, please contact us at gro [tod] revfooreswodahs [ta] nacbarssnd

This scan was enabled as part of the European Union INEA CEF VARIoT project.

Blocklisting

To be removed from this set of scanning you will need to send an email to dnsscan [at] shadowserver [dot] org with the specific CIDR's that you would like to have removed. You will have to be the verifiable owner of these CIDR's and be able to prove that fact. Any address space that is blocklisted will be publicly available here: https://scan.shadowserver.org/coap/exclude.html

Useful Links

Scan Status

Statistics on current run

Other Statistics

If you would like other statistics and information on historical trends, please take a look at: https://scan.shadowserver.org/coap/stats/. Otherwise, stats from the most current scan are listed below.

Stats from the most current scan are listed below.


All devices with CoAP Accessible

All CoAP

(Click image to enlarge)

If you would like to see more regions click here

All devices with CoAP Accessible

All CoAP

(Click image to enlarge)




If you would like us to not scan your network, please let us know and we will remove your networks from the scan.

Likewise, if you have anymore questions please feel free to send us an email at: gro [tod] revfooreswodahs [ta] nacbarssnd

This scan was enabled as part of the European Union INEA CEF VARIoT project.

The Shadowserver Foundation