# Shodan

Internet-facing hosts, open ports, banners, and DNS from a Shodan membership account.

URL: https://osintverse.com/docs/providers/shodan

Shodan on a membership account returns full host intelligence for an IP — ports, service banners, CVEs, org, and location — plus DNS records and subdomains for a domain from the Shodan index.

## Capabilities

* Host lookup with service banners, products, and TLS flags
* Open-port inventory, hostnames, ASN/org, and geolocation
* CVE tags when Shodan has associated them with the host
* Historical banners when the membership key allows `history=true`
* Domain DNS records and subdomain inventory from `/dns/domain`

## Data

Shodan says it [crawls the entire Internet every week](https://www.shodan.io/). Its [data timeframes](https://help.shodan.io/mastery/data_timeline) say a host lookup shows the most recent banner per IP and port from the past **30 days**. With history enabled, that lookup can go back up to **90 days** and at most **1,000** banners. A domain query on SearchIn reads DNS records and subdomains from the Shodan index. SearchIn does not run on-demand scans, Monitor, or Trends.

## What you get back

* Host card with ports, org, location, and CVEs
* Filterable service banners
* DNS record table and subdomain list

## UI workflow

Open SearchIn and choose IP or Domain.

Select Shodan as the provider.

Review the host card and services, or the DNS records and subdomains.

## Sample queries

| Input type | Query         | Notes                    |
| ---------- | ------------- | ------------------------ |
| `ip`       | `8.8.8.8`     | Host banners and ports   |
| `domain`   | `example.com` | DNS records + subdomains |

## Pricing

`domain` **$0.10** · `ip` **$0.10**

## Best for

* Internet-facing attack-surface review of a single IP
* Finding what a domain looks like on the public internet
* Pivoting from a host into WHOIS or breach providers

## How it works & why through OSINTverse

### How the request runs

1. You submit an IP or a domain from the search desk or POST /v1/search.
2. An IP query calls Shodan's membership host API, asking for historical banners first and falling back to current-only if history is not on the key.
3. A domain query uses the membership DNS domain endpoint — records, tags, and subdomains from the Shodan index.
4. SearchIn normalises the host or DNS payload into cards, keeps the raw JSON, and adds IPs, hostnames, and CVEs to the case graph.

**Coverage.** Shodan says it crawls the public Internet at least once a week. Host lookups show the most recent banner for each IP and port from the past 30 days. With history enabled, a lookup can go back up to 90 days and at most 1,000 banners.

### Why route Shodan through OSINTverse

- A single $0.10 query returns a host card, ports, banners, and CVEs — no Shodan CLI or credit spreadsheet.
- Historical banners are requested when the membership key allows it, then labelled so you can see current vs historical.
- IPs, hostnames, and domains drop into the case graph so you can pivot into Whoxy, WhoisXML, or breach providers.

|  | Shodan directly | Through OSINTverse |
| --- | --- | --- |
| Getting started | Shodan sells a one-time membership or higher query-credit plans, with an API key bound to that account and a monthly query-credit allotment. | Sign in, top up from $10, and run Shodan the same minute — no vendor contract, seat, or sales call. |
| What a query costs | Plan, credit pack, or contract pricing set by the vendor and paid up front. | Pay per query from your prepaid balance — Shodan starts at $0.10 for domain lookups, with the exact price shown before you run it. |
| Failed lookups | Handled under the vendor's own credit and refund policy. | Automatically refunded to your wallet — a search that fails upstream after billing is not charged. |
| Output format | A vendor-specific response shape you normalise and render yourself. | Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration. |
| Cross-source work | Copy-paste between vendor dashboards to follow a lead into another dataset. | Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click. |
| Running it for a team | Per-seat or per-account access, billed and administered per analyst. | One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee. |
| Volume work | Script the vendor API yourself, including retries, polling, and rate handling. | Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling. |

- **One wallet, no subscriptions.** Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.
- **Failed searches are refunded.** If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.
- **One API for every source.** The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.
- **Cases and pivot graph.** Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.
- **Team wallets and controls.** Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.
- **Exports built in.** Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.

### Good to know

- This integration uses host lookup and DNS domain — it does not run on-demand internet scans or manage Shodan alerts.
- A host with no public services, or a domain Shodan has not indexed, returns no data — the lookup still bills because Shodan answered.
- CVE tags and banners reflect what Shodan last observed in its 30-day host window, not a live authenticated assessment.

## API example

Try `shodan` free with mock data in the API sandbox: https://osintverse.com/developers/sandbox

> Invalid `provider` + `input_type` pairs return HTTP 422. Confirm combinations with [GET /v1/providers](https://osintverse.com/docs/api/overview) or the [pricing matrix](https://osintverse.com/docs/pricing).

Run this in the [SearchIn UI](https://osintverse.com/searchin/search) or create an [API key](https://osintverse.com/dashboard/api). Full HTTP reference: [search workflow](https://osintverse.com/docs/api/search). Marketing overview: [Shodan integration](https://osintverse.com/integrations/shodan).