Here are our top infrastructure recon queries across Shodan, Censys, and FOFA for mapping open proxy nodes, unauthenticated scraping dashboards, and misconfigured cloud gateways: ```text # Open Squid / 3proxy / Tinyproxy Gateways http.title:"Squid-Cache" OR "X-Squid-Error" port:3128,8080 "Via: 1.1 tinyproxy" http.status:200,400 # Unauthenticated Selenium Grid / Playwright Browser Nodes http.title:"Selenium Grid" "maxSession" "/wd/hub/status" "build" "os.arch" # Exposed Prometheus / Grafana & Spring Boot Actuators http.favicon.hash:-1398433489 "/actuator/env" http.status:200 ``` Pipe the JSON output from `shodan download` straight into our 1Anon Proxy Checker to filter low-latency Elite nodes.