Rowan pulled logs from the Axis device itself. The firmware was a decade-old, an embedded OS that had outlived the vendor’s support. It had never been patched—a tiny island of unaddressed vulnerability in a sea of modern systems. The camera’s web interface displayed a handful of recent connections. One IP lingered, appearing in brief pings over the last month, always just long enough to pull a keyframe and vanish.

Shodan is a search engine for internet-connected devices. A query like "Axis Communications" "live view" returns thousands of Axis cameras, including their exact geolocation and open ports. Shodan also flags devices that have the default password enabled.

Another powerful IoT search engine. Query title="Live View" && vendor="Axis" yields results.

If you have ever stumbled across a search query like "intitle live view axis verified" , you have likely brushed up against a niche but significant corner of cybersecurity and the "Internet of Things" (IoT). While it looks like a standard search string, it is actually a "Google dork"—a specialized query used to identify specific vulnerabilities or configurations on the internet.