#3448·bbot

Cloudflare challenges BBOT's HTTP engine on one Shodan endpoint

Author: TsybonCreated Sep 18, 2026Updated Sep 18, 2026

https://api.shodan.io/shodan/host/search returns HTTP 403 with a "Just a moment..." interstitial through helpers.request() (blasthttp), while https://api.shodan.io/shodan/host/{ip} through the same engine returns 200. A full browser header set does not help, so the trigger appears to be the TLS fingerprint rather than anything in the request. httpx reaches the same URL with the same key and gets 200.

The module uses httpx for that one call and degrades gracefully when it is absent. If a second HTTP client inside a module is unwelcome, the alternative is for blasthttp to offer a browser-like TLS profile.

Source: blacklanternsecurity/bbot