What is Shodan?
Shodan is a search engine for Internet-connected devices rather than web pages. It crawls the Internet every week and records the services that answer on each IP address, so you can search for servers, routers, webcams, industrial control systems and other exposed devices by product, port, location, organisation and more. Shodan calls itself the first search engine for Internet-connected devices and says it has more than 3 million registered users.
Security teams use it to see what their own networks expose to the Internet, researchers use it to measure how widely a product or vulnerable version is deployed, and journalists use it to understand infrastructure. Alongside the search engine there is Shodan Monitor for alerts on your own IP ranges, Shodan Maps and Images, browser extensions, and a developer API that every account can use on a free plan.
Main Features
- Search engine for devices and services, not web pages
- Weekly crawl of the whole Internet with IP enrichment
- Filters for product, port, country, organisation, vulnerability and more (some filters need a paid plan)
- Shodan Monitor: alerts when something unexpected appears on your own network ranges
- Developer API, with a free API plan on every account
- Shodan Maps and Images for viewing results geographically and visually
- Chrome and Firefox extensions for a quick look at any website's host
- Enterprise bulk data feed and on-demand scanning for large organisations
How to Get Started with Shodan
- Go to shodan.io and create a free account.
- Type a search such as a product name, a port or an organisation, and add filters to narrow the results.
- Open a result to see the host's open ports, banners, location and any known vulnerabilities.
- Add your own IP ranges to Shodan Monitor, or copy your API key to use Shodan from scripts and other tools.
Shodan Pricing
A free Shodan account lets you search with limited results and includes a free API plan. The Shodan Membership is a one-time payment of $49 for a lifetime upgrade (100 query credits and 100 scan credits a month, 16 monitored IPs). Monthly API plans are Freelancer at $69 a month, Small Business at $359 a month and Corporate at $1,099 a month, with more query credits, scan credits, monitored IPs and filters at each step. Enterprise access to the full data feed is priced on request.
Who Should Use It?
- Security teams checking what their organisation exposes to the Internet
- Vulnerability researchers measuring how widely a product or version is deployed
- Threat intelligence analysts tracking infrastructure
- Journalists and academics studying Internet-connected devices
- Developers who want IP and device data inside their own tools
Shodan Alternatives
- Censys: an Internet intelligence platform that maps hosts, services, certificates and domains for security teams.
- SpiderFoot: an open source tool that automates OSINT collection and can pull Shodan data into a wider scan.
- DNSDumpster: a free domain research tool that maps the hosts and DNS records behind a domain.
Frequently Asked Questions
Is Shodan free?
Shodan has a free account that lets you search with limited results and use a free API plan. More results, filters and monitoring need the one-time $49 Membership or a monthly API plan starting at $69 a month.
Is it legal to use Shodan?
Shodan indexes information that devices publicly broadcast, and searching it is widely used for research and defence. Accessing or attacking a system you find without permission is a separate act and is illegal in most countries, so use Shodan to find and fix exposure, not to break in.
What is the difference between Shodan and Google?
Google indexes the content of web pages. Shodan indexes the services and banners that devices return when contacted on their ports, so it finds things like servers, cameras and industrial systems that have no web page at all.