Argues that Shodan, Insecam, and Censys have indexed this same surface for over a decade. What's actually new in IP Crawl is the polished search interface that makes a long-standing security exposure accessible to non-researchers, not the underlying scanning or fingerprinting techniques.
Frames the issue as economic: cheap IP camera vendors face no incentive to ship secure defaults because buyers don't price security into $40 devices. The technical pipeline (ZMap, Masscan, default credential checks) is trivial, so the exposure persists because manufacturers profit from ignoring it.
A segment of the top comments focuses on implementation details like RTSP fingerprinting, port scanning strategy, and stream classification. They treat the project as a legitimate engineering achievement worth dissecting on its technical merits.
Roughly half of the top comments argue the searchable atlas crosses an ethical line by making voyeurism and stalking trivially accessible to the general public. They contend that even if scanning is legal and the streams are technically open, productizing the result causes real harm to the people on camera.
IP Crawl, a site that bills itself as a "living atlas" of open webcams discovered on the public internet, hit 309 points on Hacker News. The premise is unsubtle: scan IPv4 (and presumably some IPv6) for devices serving unauthenticated video streams on common ports, classify what the camera is pointed at, and put a search box in front of the result. Filter by country. Filter by manufacturer. Filter by whether you're looking at a parking lot in Osaka or a hallway in Toledo.
This is not new behavior. Shodan has done variants of it since 2009. Insecam ran a similar gallery for years. Censys indexes the same surface for security researchers. What IP Crawl ships that the others don't is consumer-grade search UX over a category of exposure that the security community has been screaming about for fifteen years and the device vendors have largely ignored.
The HN thread itself is the more interesting artifact. Top comments split predictably: half are admiring the engineering ("how are you handling the RTSP fingerprinting?"), half are arguing about whether the site should exist at all, and a recurring third faction is pointing out that the only thing actually new here is the polish.
The technical pipeline behind a project like this is not exotic. ZMap can scan the entire IPv4 space for a single port in under an hour on a 10GbE link. Masscan does it from a laptop in a few hours. Once you have a list of hosts responding on 80, 554, 8080, 8000, 37777, and the usual suspects, you fingerprint the response — a Hikvision login page looks different from an Axis one, which looks different from a generic Dahua DVR — and you try the manufacturer's default credentials or just check whether the stream is open.
The reason this keeps working in 2026 is structural, not technical: the device manufacturers have no economic incentive to fix it. A $40 Chinese-brand IP camera ships, gets installed by a homeowner who follows the QuickStart card, and lives on the network until it dies. The vendor sold the unit. They make zero recurring revenue from the firmware. Patching is a cost center with no associated income line. So they don't.
The consumer-facing camera makers (Ring, Nest, Wyze) actually do better here — they tunnel everything through their own cloud, which is a privacy disaster of a different shape but at least isn't broadcasting to the open internet. The exposure surface IP Crawl is indexing is overwhelmingly the long tail: small-business DVRs, factory-floor monitoring rigs, gas-station back offices, and a meaningful number of municipal traffic cameras that someone port-forwarded in 2014 and never touched again.
Community reaction in the HN thread is notable for what's missing: nobody is seriously arguing the feeds shouldn't be findable. The debate is about whether centralizing the search makes things worse. The honest answer is probably no — the people who want to find these have been finding them for a decade. What changes is that now a curious teenager with no scripting skill can browse them like Netflix. That's a different distribution of harm than "anyone with nmap can do this," even if the technical capability is identical.
If you run anything with an embedded HTTP server — a camera, a printer, a NAS, an industrial controller, a Raspberry Pi with a USB webcam — assume it is being scanned right now. Not occasionally. Continuously. The internet background radiation from ZMap-class scanners has been measurable since 2013 and has only gotten louder. Your home router's port-forward UI is the single most dangerous control surface in your house, and "UPnP" is the polite way of saying "automatic port-forwarding without consent."
Concrete actions, in order of effort: disable UPnP on your router (one checkbox, prevents a category of accidental exposure). Audit your existing port forwards (most people have one or two they forgot about — an old game server, a Plex install from 2017). For anything that genuinely needs to be reachable, put it behind WireGuard or Tailscale rather than a port-forward — you get the same access without the public attack surface. If you ship products with embedded HTTP, your security baseline should include forcing credential change on first boot and refusing to start the service until it's done. Several Chinese vendors are now doing this under EU CRA pressure; the rest will follow when the fines start.
For engineers building any kind of device-cloud product: the lesson from IP Crawl is that the moment you let the device speak directly to the internet, you've inherited a 20-year liability tail. Tunnel everything through your control plane. It costs more in bandwidth and latency and gives you a single point of failure, but it also means there's a server you control between the device and every script kiddie on Earth.
IP Crawl will get a cease-and-desist or a hosting suspension within months — Insecam went through the same cycle multiple times and just kept reappearing on new TLDs. The site is a symptom, not the disease. The disease is that we shipped two decades of network-connected hardware with the security posture of a 1998 web server and the patch cadence of a paperweight. The EU's Cyber Resilience Act, which starts biting in late 2027, is the first regulation with real teeth aimed at this — manufacturers will owe security updates for the "expected lifetime" of the product, with fines up to 2.5% of global revenue. Whether that actually changes vendor behavior or just produces a thicket of compliance theater is the open question. Either way, the next IP Crawl is already being built, probably with better search.
This website---naturally, I think---weirds me out. Many of these cameras are in private spaces, with some places you most certainly don't want people to have live feeds of. It's quite disturbing how you can see personal snapshots of people's lives without them knowing. There's a
Nothing changed compared to 2012 https://web.archive.org/web/20151013010243/http://internetce...> As a rule of thumb, if you believe that "nobody would connect that to the Internet, really nobody", there are at least 1000 people who did.
Someone keeping an eye on their (illegal?) cannabis pants in the UK? https://ipcrawl.com/?cam=3892f36f150ff9db
Hehe, this one has a feeding tray with a novelty sign on it:> Baiting deer is illegal!> This corn pile is intended for squirrels, chipmunks, and other such critters.> Any deer found eating this corn will be shot!https://ipcrawl.com/fun/c/373ef0178c5281a5
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Everyone: For a moment forget everything you know about computers and wonder if perhaps 99% of normies are just following the directions on the package of their $19 Chinese IP camera. They have no idea what a firewall is, or what the "public internet" even means.There's also a differe