- id: shodan-openai-proxy
  name: "OpenAI proxy servers"
  source: shodan
  category: frontier
  query: 'http.title:"openai" http.html:"/v1/chat/completions"'
  description: "Exposed OpenAI-compatible proxy servers serving chat completions"
  tags: [openai, proxy, tier1]
- id: shodan-litellm-proxy
  name: "LiteLLM proxies on default port"
  source: shodan
  category: frontier
  query: 'http.title:"LiteLLM" port:4000'
  description: "LiteLLM gateway dashboards exposed on default port 4000"
  tags: [litellm, gateway, tier5]
- id: shodan-openai-nginx
  name: "Nginx front-ends leaking OPENAI_API_KEY"
  source: shodan
  category: frontier
  query: 'http.html:"OPENAI_API_KEY" http.component:nginx'
  description: "Nginx-fronted services exposing OPENAI_API_KEY in HTML"
  tags: [openai, nginx, tier1]
- id: shodan-azure-openai
  name: "Azure OpenAI certificate matches"
  source: shodan
  category: frontier
  query: 'ssl.cert.subject.cn:"openai.azure.com"'
  description: "TLS certificates referencing Azure OpenAI endpoints"
  tags: [azure, openai, tier1]
- id: shodan-bedrock-runtime
  name: "AWS Bedrock runtime certificates"
  source: shodan
  category: frontier
  query: 'ssl.cert.subject.cn:"bedrock-runtime"'
  description: "TLS certificates referencing AWS Bedrock runtime hosts"
  tags: [aws, bedrock, tier1]
- id: shodan-anthropic-proxy
  name: "Anthropic-compatible proxy servers"
  source: shodan
  category: frontier
  query: 'http.html:"anthropic" http.html:"messages"'
  description: "Proxy servers routing to Anthropic messages API"
  tags: [anthropic, proxy, tier1]