Shodan

About Shodan

Shodan provides an API for accessing data about devices connected to the internet, including open ports, SSL/TLS versions supported, geographic location, and web technologies in use. It includes a curated DNS database of hostnames likely to run a service, useful for mapping an organization's attack surface, and a Streaming API for subscribing to real-time notifications when new ports, vulnerabilities, or network configuration changes are detected.

The API underlies all of Shodan's own products, including Shodan Monitor, Shodan Maps, and Shodan Images, meaning anything available through those websites can also be accessed directly via the API. A command-line interface is also available, exposing most of the API's functionality without requiring custom scripting. Client libraries are offered in multiple programming languages.

The service is aimed at developers and organizations building tools that require internet-wide device and network intelligence, such as automated reporting, attack surface monitoring, or tracking changes to network configurations over time. Membership, API subscription, and enterprise plans are available, though specific pricing details are not stated on the page.

Key features

• IP information lookup: open ports, SSL/TLS versions, country, and web technologies
• Real-time Streaming API for port, vulnerability, and network configuration changes
• Command-line interface exposing most of the API
• API-first platform that also powers Shodan Monitor and Shodan Images
• Access to full underlying data beyond what the Shodan website displays

Frequently asked questions