WarBrief Live | Intelligence Tool Profile | October 20, 2026
ZoomEye is a cyberspace search engine, the Shodan-style service analysts use to map internet-connected devices, open ports, and web applications across the globe. Developed in 2013 by Chinese cybersecurity firm Knownsec’s 404 Team, it continuously scans and indexes IPv4 and IPv6 address space. Its standout reputation is Asia-Pacific visibility, a region where Western scanners historically see less. Below: what the tool does, how analysts query it, what access costs, and where it falls short.
What ZoomEye does
Unlike Google or Bing, which index web pages, ZoomEye indexes cyberspace itself. Its scanning infrastructure probes public IP ranges, shakes hands with known TCP and UDP service ports, and records protocol banners (the identifying text services return when contacted). Each host record carries dozens of metadata fields: open ports, banners, device models, software versions, TLS certificate details, favicon hashes, and associated vulnerabilities.
The query language is structured and boolean. Analysts combine filters with && (AND), || (OR), and != (NOT) across filters like app, port, cidr, asn, org, country, and city. Advanced filters differentiate it from peers: vul.cve maps exposures to known vulnerabilities, ssl.jarm and ssl.ja3s support TLS fingerprinting for pivoting on command-and-control infrastructure, and iconhash matches assets by favicon hash in MD5 or MurmurHash3 form. The is_honeypot=false filter excludes researcher decoys; is_bugbounty=true restricts results to verified bug-bounty scope from HackerOne, Bugcrowd, Intigriti, and YesWeHack.
Companion features include On-Demand Scanning (submit IPs or domains and get fresh results), ZoomEyeGPT (turns plain-English incident descriptions into query filters, with MCP agent support), and DarkEye (monitors leak mentions across Telegram channels, forums, and breach repositories). There is also an API with a Python CLI (pip install zoomeye), a Chrome extension, and a data store for bulk datasets.
How analysts use it
Security and intelligence analysts use ZoomEye as a reconnaissance layer before touching a target directly. Common workflows:
- Attack surface mapping: org or asn queries enumerate an organization’s internet-facing assets, exposing forgotten services and shadow IT.
- Vulnerable-software sweeps: app plus vul.cve queries find exposed software versions within hours of a new disclosure.
- Adversary infrastructure pivoting: a JARM fingerprint or favicon hash from a known malicious server is searched across ssl.jarm or iconhash to uncover hidden siblings behind proxies – useful for phishing-site detection too.
- Bug bounty scoping: pre-indexed bounty scope lets analysts filter straight to in-scope targets on major platforms.
For context on the two Western engines analysts pair with ZoomEye, see our Censys vs Shodan: Mapping the Exposed Internet With OSINT comparison.
Access and pricing
ZoomEye runs a hybrid subscription-plus-points model. The tiers below were independently reported by two industry/vendor sources in 2026 and match the official plan structure – prices can change, so confirm on the vendor’s pricing page before purchasing:
- Free Community ($0): 3,000 results per month; enriched fields are frequently paywalled.
- Personal ($190/year): 100,000 monthly results, API access, deeper pagination.
- Professional ($1,090/year): 800,000 monthly results, more metadata fields.
- Business ($10,990/year): 10,000,000 monthly results, higher API rate limits.
- Corporate ($100,000/year): 50,000,000 monthly results for large teams.
Beyond quotas, ZoomEye Points are pay-as-you-go credits: one point equals one exported result, with packs of 10,000 ($10), 220,000 ($200), or 600,000 ($500); paid members get roughly 50% off. API access requires a paid subscription.
Limitations
ZoomEye’s main friction point is paywalling: the free tier suits reconnaissance previews, but serious export volume and any API automation require a paid plan, and competitor analysis confirms the API is closed to free users. Independent vendor analysis found ZoomEye lacks DNS and WHOIS data enrichment, offers fewer attack-surface features than some rivals, and its AI query builder can occasionally generate invalid queries. User reviews add a recurring complaint: the most valuable fields on free accounts display “This data is protected.”
Operationally, no single scanner sees everything: probe distributions, scan frequencies, and regional vantage points all differ, so analysts routinely cross-reference ZoomEye against Shodan or Censys to cover blind spots outside Asia-Pacific. And like ship tracking with free OSINT tools, every finding needs corroboration before being treated as fact.
Sources
- AnyGen: ZoomEye Search Engine Guide, Syntax and Pricing (features, filters, and 2026-verified pricing tables)
- Netlas Blog: Netlas vs ZoomEye: Platforms Comparison (independent vendor engineering analysis: plan tiers, API/CLI access, feature matrix, limitations)
