: Many exposed interfaces present a login page. Attackers use automated tools to test default credentials (like admin/admin or admin/password ).
Shodan also indexes HTML content. WebcamXP often embeds specific JavaScript or title elements: webcamxp 5 shodan search
The response often contains the mjpg stream URL, such as: <img src="http://[IP]:8080/mjpg/video.mjpg"> : Many exposed interfaces present a login page