A Scan-Based Analysis of Internet-Exposed IoT Devices Using Shodan Data

Determining whether scan-observable network configurations capture meaningful security exposure characteristics across large-scale Internet of Thing (IoT) populations remains an open problem in measurement research. This study analyzes Internet-exposed IoT endpoints associated with the TR-069 protocol within a global population exceeding 37 million hosts, using a structured sample of 7,634 hosts derived from an initial collection of approximately 10,000 hosts obtained via Shodan Search and Shodan InternetDB. Data were collected during a fixed observation window in April 2026 and sampled across ten countries with the highest observed prevalence of TCP port 7547 exposure. Hosts were enriched with scan-derived metadata, including open ports, service indicators, CPE identifiers, vulnerability-associated fields, and network attribution metadata, enabling construction of a composite exposure proxy capturing externally observable service-surface characteristics. The analysis combines descriptive statistics, nonparametric hypothesis testing using the Kruskal–Wallis H test, and exploratory feature separability analysis to evaluate whether exposure patterns vary systematically across geographic regions and whether observable service-level characteristics differentiate between exposure groups. Results demonstrate statistically significant cross-country variation in exposure structure, reflected in differences in both average exposure levels and distributional characteristics. The exploratory feature separability analysis using logistic regression and random forest approaches yielded a balanced accuracy of 0.58, indicating that scan-derived service-level features capture only limited information related to the exposure proxy. These findings suggest that Internet-wide scan data can support systematic, population-level analysis of IoT exposure while also highlighting the limitations of port-based features as indicators of broader exposure characteristics. The study contributes a reproducible framework for large-scale exposure measurement using previously collected Internet-wide scan data, without requiring device interaction or exploit-based validation.