If you leave something on the internet long enough, someone will hack it.

The reality is that many device manufacturers make it far too easy by using default passwords that are widely documented, allowing anyone to log in as “admin” and snoop around. Often, there’s no password at all.

Enter “Shodan Safari,” a popular part-game, part-expression of catharsis, where hackers tweet and share their worst finds on Shodan, a search engine for exposed devices and databases popular with security researchers. Almost anything that connects to the internet gets scraped and tagged in Shodan’s vast search engine — including what the device does and internet ports are open, which helps Shodan understand what the device is. If a particular port is open, it could be a webcam. If certain header comes back, it’s backend might be viewable in the browser.

Think of Shodan Safari as internet dumpster diving.

From cameras to routers, hospital CT scanners to airport explosive detector units, you’d be amazed — and depressed — at what you can find exposed on the open internet.

Like a toilet, or prized pot plant, or — as we see below — someone’s actual goat.

The reality is that Shodan scares people — and it should. It’s a window into the world of absolute insecurity. It’s not just exposed devices but databases — storing anything from two-factor codes to your voter records, and where you’re going to the gym tonight. But devices take up the bulk of what’s out there. Exposed CCTV cameras, license plate readers, sex toys, and smart home appliances. If it’s out there and exposed, it’s probably on Shodan.

If there’s ever a lesson to device makers, not everything has to be connected to the internet.

Here’s some of the worst things we’ve found so far. (And here’s where to send your best finds.)

Shodan Safari, where hackers heckle the worst devices put on the internet ac unit

An office air conditioning controller. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet airport

A weather station monitor at an airport in Alabama. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet bank

A web-based financial system at a co-operative credit bank in India. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet beef

For some reason, a beef factory. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet bells

An electric music carillon near St. Louis. used for making church bell melodies. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet biogas

A bio-gas production and refinery plant in Italy. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet birb

A bird. Just a bird. (Screenshot: Shodan via @Joshbal4)

 

Shodan Safari, where hackers heckle the worst devices put on the internet brewery

A brewery in Los Angeles. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet cinema

The back end of a cinema’s projector system. Many simply run Windows. (Screenshot: Shodan via @tacticalmaid)

 

Shodan Safari, where hackers heckle the worst devices put on the internet engine room

The engine room of a Dutch fishing boat. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet explosives

An explosive residue detector at Heathrow Airport’s Terminal 3. (Screenshot: TechCrunch)

 

Shodan Safari, where hackers heckle the worst devices put on the internet fishtank

A fish tank water control and temperature monitor. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet flowers

A climate control system for a flower store in Colorado Springs. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet tesla

The web interface for a Tesla PowerPack. (Screenshot: Shodan via @xd4rker)

 

Shodan Safari, where hackers heckle the worst devices put on the internet instagram

An Instagram auto-follow bot.(Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet pharmacy

A terminal used by a pharmacist. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet phils bbq

A controller for video displays and speakers at a Phil’s BBQ restaurant in Texas. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet printingpress

A Kodak Lotem printing press. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet rickroll

Someone’s already hacked lawn sprinkler system. Yes, that’s Rick Astley. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet sulfur

A sulfur dioxide detector. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet therapy

An internet-connected knee recovery machine. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet windows xp

Somehow, a really old version of Windows XP still in existence. (Screenshot: Shodan)

 

Shodan Safari, where hackers heckle the worst devices put on the internet workout

Someone’s workout machine. (Screenshot: Shodan)