From the article he linked: If a subsequent probe fails, the system cross-references threat intelligence platforms like Shodan to match the host and falls ba

From the article he linked: If a subsequent probe fails, the system cross-references threat intelligence platforms like Shodan to match the host and falls back to their specific indexing methods. So it uses Shodan, but is not purely a mirror.