01 · Product name
Shodan
Search engine for devices and services on the public internet.
Published by Shodan.
In short
Shodan indexes banners from internet-connected devices — what a host says when you reach a port, not a copy of the web page behind it. Practitioners use it to find exposed services by product, port, organization, or geography. A free account can search; filters, credits, monitoring, and the API open up on paid plans.
Product pricing strategy
02
Free and paid
Shodan is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
Shodan has a free account with limited queries and filters. A paid membership adds filters, credits, monitoring, and API volume. Pricing changes, so confirm it on shodan.io.
Utility and features
03
John Matherly’s Shodan is the search box most infrastructure questions start in. It collects service banners across the public IPv4 internet and lets you query them: a product name, a port, an ASN, a TLS field, a screenshot in newer views. The result is a host that answered, not a vulnerability report.
- What it indexes. Service banners, some screenshots, and metadata such as port, transport, organization, and location derived from the scan. It is not a crawl of every URL on a site.
- How you query. Keywords plus filters: port, org, product, country, asn, and certificate fields. The CLI and API take the same ideas off the website.
- What you pay for. Query credits, locked filters, exports, monitoring, and higher API limits. The website search is the free on-ramp.
The free tier is enough to learn the query language and to check a single lead. Membership removes the tightest limits and adds filters that make organization-wide questions practical. There is also a CLI, a Python library, and an API. Shodan Monitor and image search are separate parts of the product. Do not confuse a banner hit with proof that a device is vulnerable or that you are allowed to probe it further.
- 1
Create a free account so results are not stuck behind the anonymous limit.
- 2
Search a product or a hostname you are allowed to look up, then read the banner before you trust the label.
- 3
Add one filter at a time — port, org, or country — and note which filters your plan actually includes.
- 4
Move to the API or CLI only after the web query is right. Export the hosts you can defend, not a wishlist of targets.
Caveats
04
You are searching Shodan’s earlier scans, not opening the port yourself. A missing host can mean Shodan has not scanned it, the banner changed, or the host is gone. A present host can be a honeypot or a banner that no longer matches the software.
A free account can search, with tighter query and filter limits than a paid membership. The API, Monitor, and image search are separate parts of the product. None of them authorize a follow-up scan, login, or exploit. Read the banner, then stop at the edge of your scope.
Screenshots
05
Potential use cases
06
- Start with a product name and version from an advisory you already have, plus the organization or netblock you are responsible for. Search Shodan for that banner. You get hosts, ports, and the banner text Shodan stored, with a timestamp, not a vulnerability confirmation. Pivot the same address into Censys before you brief it. A banner can be stale, and a hit outside your scope is not permission to probe the host.
- Take one hostname from a log you are allowed to analyze. Look it up, then read the port list and the banner rather than the green label. The output is Shodan’s last observation of that host. Compare it with VirusTotal if the question is reputation rather than exposure. Do not treat a screenshot in the result as proof of what the service does today.
- When the question is ‘what of ours speaks this protocol,’ add one filter at a time: port, then org or ASN, and note which filters the plan you are on actually includes. Export only the hosts you can defend. Hand the list to the asset owner. Query credits and locked filters are plan limits; this listing does not invent the current numbers. Confirm them on shodan.io.
Hard cases
The case where the first result is easy to over-read.
The advisory does not match the banner
An advisory names a product version. Shodan returns hosts whose banner contains the product name and a different version, or only the vendor string. That is a lead for the owner of those hosts, not a list of vulnerable machines. Record the banner and the timestamp, check the same IP in Censys, and send the owner the raw banner. Do not upgrade the claim from ‘banner mentions this product’ to ‘this CVE is present.’
Questions
Is Shodan free?
Shodan has a free account with limited queries and filters. A paid membership adds filters, credits, monitoring, and API volume. Pricing changes, so confirm it on shodan.io.
Is Shodan the same as scanning a target yourself?
No. You are searching Shodan’s prior scan data. That does not authorize a follow-up scan, exploit, or login against the host.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Shodan search
https://www.shodan.io/Documentation
Shodan developer API
https://developer.shodan.io/apiDocumentation
Shodan Python library
https://github.com/achillean/shodan