In 2021, a security team auditing a university campus found no live cameras on Shodan. However, running inurl:axis+cgi+mjpg+motion+jpeg+better on Google returned 17 internal Axis 210A cameras whose web interfaces had been crawled five years earlier during a temporary network misconfiguration.
Why were these missed by Shodan? The cameras were behind NAT and hadn't sent a packet to the public internet in years. But Google’s crawler had cached their title tags and anchor text during a two-hour window of exposure. The keyword better appeared in an old departmental homepage linking to "Building 4 North entrance – better angle." inurl+axis+cgi+mjpg+motion+jpeg+better
The team used the cached URL structure (/axis-cgi/mjpg/video.cgi?camera=3) to write a script that attempted connection via the university’s VPN. Three cameras were still active and unauthenticated, providing a live feed of a nuclear engineering lab. The vulnerability was fixed within 48 hours. In 2021, a security team auditing a university
You can evolve inurl:axis+cgi+mjpg+motion+jpeg+better into more powerful variants. Finds cameras with low compression (higher quality) and
inurl:"axis-cgi/mjpg/video.cgi" (intext:"compression=20" OR intext:"compression=10") AND inurl:"motion=on"
Finds cameras with low compression (higher quality) and motion detection active.