Neither Shodan nor Censys are likely to be used by some serious cybercriminals — the real big bad guys have had botnets for a while, which can serve the very same purpose yet yield more power. It took Shodan’s creator John Matherly only 5 hours to ping and map all the devices on the whole Internet, and a botnet utilising hundreds of computers would probably do that even faster. But there are a lot of other people who already have tried to misuse Shodan and Censys to play bad tricks and pranks on other people.