[nsagent]

From the article he linked:

  If a subsequent probe fails, the system cross-references threat intelligence platforms like Shodan to match the host and falls back to their specific indexing methods.

So it uses Shodan, but is not purely a mirror.