Shodan

We offer a free and simple API endpoint to grab all the hostnames for a domain based on the certificate transparency logs: https://ctl.shodan.io/

Sample Python code available in the Shodan book: https://book.shodan.io/developer-apis/certificate-transparency/

For convenience, we offer an API around the CT Logs: https://ctl.shodan.io/

It has an API endpoint that returns the subdomains for a domain based on the CT Logs. Ex: https://ctl.shodan.io/api/v1/domain/microsoft.com/hostnames

To learn more: https://book.shodan.io/developer-apis/certificate-transparency/

Need to lookup a ton of IPs quickly? Check out our InternetDB API: https://internetdb.shodan.io

New release of Shodan Terminal (0.12.0): adds the ability to view screenshots in the search results and IP information page: https://terminal.shodan.io

Our vulnerability lookup API now also supports EUVD! We've updated https://cvedb.shodan.io to allow lookups by EUVD-ID and return EUVD information for CVEs when available

More than 100,000 web servers still support SSL version 2 (deprecated in 2011): https://www.shodan.io/search?query=ssl.version%3Asslv2 The most popular versions are TLS 1.2 and TLS 1.3: https://www.shodan.io/search/facet?query=port%3A443&facet=ssl.version

New release of Shodan Terminal (0.13.1) that includes various quality of life improvements (ex. automatic detection of API keys if the Shodan CLI is configured) and shows account status information (ex. how many IPs are monitored) if you're getting close to the usage limit. Now also available as an .msi package: https://terminal.shodan.io/

Shodan identifies open directory listings, tags them ("open-dir") and lets you search their contents by file extension using the "open_dir.extension" filter or hash ("open_dir.hash"): https://www.shodan.io/search?query=open_dir.extension%3Aexe

The banner also includes the parsed information from the directory listing: https://datapedia.shodan.io/property/open_dir.html

Use the webhook notifier to programmatically get notified when a new port on your IP/ network gets exposed to the Internet: https://book.shodan.io/websites/monitor/notifiers/webhook/

We've improved support for the dark, outrun and cyberpunk themes in Shodan Trends! You can set the theme from your account page at https://account.shodan.io/settings

Shodan Trends now supports searches by IPv6 network ranges using the "net" filter: https://trends.shodan.io

Add " asset:all" to any search query to see if any of your monitored assets are in the results. Or use the filter by itself to browse the information that Shodan has collected for your assets: https://www.shodan.io/search?query=asset%3Aall

To configure network monitoring visit https://monitor.shodan.io

Hundreds of Moltbot (previously named Clawdbot) gateway services exposed to the Internet: https://www.shodan.io/search?query=http.favicon.hash%3A-805544463

Want to get notified if you're exposing Clawdbot/ OpenClaw? Enable the "ai" trigger for your assets in Shodan Monitor: https://monitor.shodan.io

Added a Whois tab to the IP information page: https://www.shodan.io/host/1.1.1.1/whois

More than 10,000 OpenClaw/ Clawdbot deployments exposed to the Internet: https://shodan.io/search/report?query=product%3Aopenclaw

Configure https://monitor.shodan.io to get notified if your IP is exposing it to the Internet

We added a new "fields" parameter to the search method of the API. Helpful if you only want to download specific properties instead of the full banner: https://book.shodan.io/changelog/2026-03-05/

Want to quickly check if any of your monitored assets match a search query? Add "asset:all" to your query to filter results by what you've configured in Shodan Monitor (https://monitor.shodan.io)

Updated the list of datasets that are available via the Bulk Data API: https://book.shodan.io/enterprise/bulk-data-files/

@bosh@infosec.exchange @GossiTheDog@cyberplace.social yup, feels refreshing! we used to have these sorts of exchanges on twitter but it's rapidly devolved into a deranged pool of toxicity and engagement farming