Shodan
Internet-facing hosts, open ports, banners, and DNS from a Shodan membership account.
Shodan on a membership account returns full host intelligence for an IP — ports, service banners, CVEs, org, and location — plus DNS records and subdomains for a domain from the Shodan index.
Capabilities
- Host lookup with service banners, products, and TLS flags
- Open-port inventory, hostnames, ASN/org, and geolocation
- CVE tags when Shodan has associated them with the host
- Historical banners when the membership key allows
history=true - Domain DNS records and subdomain inventory from
/dns/domain
What you get back
- Host card with ports, org, location, and CVEs
- Filterable service banners
- DNS record table and subdomain list
UI workflow
Open SearchIn and choose IP or Domain.
Select Shodan as the provider.
Review the host card and services, or the DNS records and subdomains.
Sample queries
| Input type | Query | Notes |
|---|---|---|
ip | 8.8.8.8 | Host banners and ports |
domain | example.com | DNS records + subdomains |
Pricing
domain $0.10 · ip $0.10
Best for
- Internet-facing attack-surface review of a single IP
- Finding what a domain looks like on the public internet
- Pivoting from a host into WHOIS or breach providers
How it works & why through OSINTverse
How the request runs
- 1You submit an IP or a domain from the search desk or POST /v1/search.
- 2An IP query calls Shodan's membership host API, asking for historical banners first and falling back to current-only if history is not on the key.
- 3A domain query uses the membership DNS domain endpoint — records, tags, and subdomains from the Shodan index.
- 4SearchIn normalises the host or DNS payload into cards, keeps the raw JSON, and adds IPs, hostnames, and CVEs to the investigation graph.
Coverage. Shodan's internet-wide banner index: services Shodan has seen on public IPs, plus DNS records and subdomains it has associated with a domain.
Why route Shodan through OSINTverse
- ·A single $0.10 query returns a host card, ports, banners, and CVEs — no Shodan CLI or credit spreadsheet.
- ·Historical banners are requested when the membership key allows it, then labelled so you can see current vs historical.
- ·IPs, hostnames, and domains drop into the investigation graph so you can pivot into Whoxy, WhoisXML, or breach providers.
| Shodan directly | Through OSINTverse | |
|---|---|---|
| Getting started | Shodan sells a one-time membership or higher query-credit plans, with an API key bound to that account and a monthly query-credit allotment. | Sign in, top up from $10, and run Shodan the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — Shodan starts at $0.10 for domain lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one investigation graph, so you can pivot an entity into any of the other 13 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |
One wallet, no subscriptions
Top up prepaid USD from $10 and spend it a query at a time across all 14 integrations. No monthly fee, no seat count — and the balance never expires.
Failed searches are refunded
If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
One API for every source
The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
Investigations and pivot graph
Results land in a named investigation you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
Team wallets and controls
Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
Exports built in
Download any result as JSON, CSV, or PDF, and export the investigation graph as PNG, SVG, entities CSV, or graph JSON.
Good to know
- This integration uses host lookup and DNS domain — it does not run on-demand internet scans or manage Shodan alerts.
- A host with no public services, or a domain Shodan has not indexed, returns no data and is refunded.
- CVE tags and banners reflect what Shodan last observed, not a live authenticated assessment.
API example
$0.10 per query. Live runs charge the active workspace wallet — the same rates as the dashboard.
DNS records
3
Membership DNS index
Subdomains
2
From Shodan DNS
Tags
ipv6
example.com
curl -X POST "https://apiv1.osintverse.com/v1/search" \ -H "Content-Type: application/json" \ -H "x-api-key: ov_your_api_key" \ -d '{"provider":"shodan","input_type":"domain","query":"example.com"}'Invalid provider + input_type pairs return HTTP 422. Confirm combinations with GET /v1/providers or the pricing matrix.
Run this in the SearchIn UI or create an API key. Full HTTP reference: search workflow. Marketing overview: Shodan integration.