IP Crawl maps thousands of unsecured webcams left exposed on the public internet

IP Crawl is a continuously updated directory that surfaces internet-connected cameras reachable without authentication, cataloging them by city and internet provider. The sample feed reads like a global census of carelessly exposed devices — live and snapshot streams tied to residential and business connections across consumer ISPs like Comcast, Verizon, BT, Free, Telecom Italia, KDDI, and Rogers, spanning the US, UK, Netherlands, France, Italy, Japan, and beyond. Entries range from home broadband customers to named businesses such as a pet resort in Tulsa, underscoring that the exposure spans both households and small organizations.

The project is the latest in a lineage of exposed-camera aggregators (Shodan, the now-infamous Insecam) that exist because IP cameras and DVRs routinely ship with default or absent credentials and get plugged directly into the open internet. Once a device answers on a public IP with no access control, indexing it is trivial — IP Crawl simply makes the scale and persistence of the problem visible and browsable.

The significance is mostly about privacy and basic device hygiene. These feeds can reveal interiors of homes, storefronts, and workplaces to anyone, and the per-ISP, per-city breakdown highlights how widespread the misconfiguration remains years after the issue was first publicized. The practical takeaway for defenders and owners is unchanged: cameras should sit behind authentication and a firewall or VPN, never be directly addressable from the public internet, and have default passwords changed before deployment.