I discovered shodan.io recently when I was tailing the logs of a vpn server and saw a connection attempt from an IP I did not recognize. The IP was registered to shodan.io and tried to connect without authentication credentials. I looked up the IP of my box on Shodan and sure enough, there it was, right on the wall of sheep.<p>Of course I blame myself for not whitelisting IP addresses, but I did not appreciate the connection attempt. Passive port scanning is one thing, but actively trying to establish a VPN session is another.<p>I was under the impression that port scanning IP addresses on the open internet without prior authorization was illegal under the CFAA. Obviously that&#x27;s a provision commonly ignored by researchers, but at least they disclose any port scanning activity with some discretion and acknowledgement of its potential illegality.  I&#x27;m surprised how blatantly upfront Shodan is about its operation.<p>Does anyone know the deal with this company&#x2F;website? Why are they not worried about prosecution for their mass port scanning?