ZoomEye review

ZoomEye is a cyberspace search engine from Knownsec for finding public-facing systems and the details they expose. It indexes public IP addresses, domains, and internet-connected devices; it is not a search engine for website text. The point is to search what an internet-connected asset appears to be running, not what its owner has written online.

You can query indexed assets with Boolean operators and filters for services, software, location, fingerprints, and honeypots. ZoomEye also correlates detected software versions with Knownsec vulnerability intelligence and CVE records, and offers on-demand IP and domain scans. Its broader toolkit includes bug bounty attack-surface monitoring, an API, and ZoomEyeGPT, which uses DeepSeek to turn natural-language requests into search syntax and help interpret results.

That makes ZoomEye a tool for exposure research and security work, not a substitute for confirming an asset’s current state. Search results describe indexed observations; the published feature details do not specify how quickly every result is refreshed.

The useful part is the range of ways to narrow an asset search. Boolean queries plus filters for service, software, location, fingerprints, and honeypots give security teams more than a basic IP lookup. The vulnerability mapping can add context by relating detected software versions to Knownsec intelligence and CVE records, while facets such as port, product, or country help organize scan data.

• ZoomEyeGPT can translate natural-language queries into search syntax and help interpret results, which may lower the barrier for less familiar users. It uses DeepSeek, according to the published feature details.
• Bug bounty radar monitors and scans attack surfaces tied to external bounty programs.
• On-demand IP and domain scans complement the indexed search function.
• The REST API supports pagination, automated workflows, and local response caching.

That mix makes ZoomEye worth exploring for teams mapping their own internet-facing assets or researching exposure. The benefit is visibility, not proof that a system is vulnerable or still exposed. A Reddit discussion of internet-wide search tools makes the same dual-use point: blue teams can use the information for awareness, while attackers can also use it to find targets. Treat results as leads to verify, not as a complete security assessment.

The free plan is small enough to constrain recurring research. The available pricing information, checked November 7, 2026, lists a $0 monthly Free plan with a maximum of 3,000 results per month, five result pages, five ZoomEyeGPT results per day, an API limit of 0.5 requests per second, and five subscription targets. The pricing data is marked low confidence, so confirm the current terms before building a workflow around those limits.

Paid-plan prices and annual pricing were not provided, and trial details are not published on the vendor's site. That leaves a practical gap: we can’t judge what a regular user pays to raise the caps or whether the upgrade is worthwhile. The free allowance may suit occasional exploration, but API automation or broad, repeated searches could run into its result, page, target, or rate limits.

There is also no basis here to compare ZoomEye’s coverage or freshness with competing databases. One commenter on r/hacking said Shodan had stronger filtering and more features; that is one user’s view, not a measured comparison. Teams should validate the results they need before switching research workflows.

The published pricing snapshot lists one plan: Free at $0 per month. It includes up to 3,000 results per month, five result pages, five ZoomEyeGPT results per day, an API rate limit of 0.5 requests per second, and five subscription targets. Those caps may be enough to explore exposed assets, but they constrain recurring searches and automated workflows.

There is no published paid tier in the published data, so we can’t calculate the jump between tiers or say what higher limits cost. No add-ons are listed. Annual pricing and paid-plan billing details are also not published; the snapshot says the free plan is monthly. Treat the pricing information as low confidence, not a complete rate card. Before building a workflow around ZoomEye, confirm current prices and limits with the vendor—especially if you need more API throughput, results, or subscription targets.

Switching to ZoomEye makes most sense when the job is finding exposed IP addresses, domains, devices, and related system details. It is a cyberspace search engine, not a website-text search tool, so it is not a like-for-like replacement for a general web search product. The REST API supports pagination and local response caching, which may help teams build workflows around its results; the published information does not specify export formats or a migration tool.

If you leave, plan to check which searches, subscriptions, and API-driven processes depend on ZoomEye, then verify whether your replacement can cover them. The available information does not describe an account-data export path or what happens to stored results when an account closes. We also have no Reddit posts or comments in the published sources, so we can’t responsibly claim what tends to make users leave. Confirm export and retention details with ZoomEye before switching either way.