Host intelligence

Shodan OSINT integration

Internet-facing hosts, open ports, banners, and DNS from Shodan.

Shodan on a membership account returns full host intelligence for an IP — ports, service banners, CVEs, org, and location — plus DNS records and subdomains for a domain from the Shodan index. Shodan says it crawls the public Internet at least once a week. A host lookup shows the most recent banner per port from the past 30 days.

from $0.10Shodan directly vs on OSINTverse

Capabilities

What this integration is designed to return.

Host lookup with service banners, products, and TLS flags

Open-port inventory, hostnames, ASN/org, and geolocation

CVE tags when Shodan has associated them with the host

Historical banners when the membership key allows history=true

Domain DNS records and subdomain inventory from /dns/domain

Best for

Typical investigation fits.

Internet-facing attack-surface review of a single IP

Finding what a domain looks like on the public internet

Pivoting from a host into WHOIS or breach providers

How the Shodan integration works

What happens between pressing run and reading a result.

1You submit an IP or a domain from the search desk or POST /v1/search.
2An IP query calls Shodan's membership host API, asking for historical banners first and falling back to current-only if history is not on the key.
3A domain query uses the membership DNS domain endpoint — records, tags, and subdomains from the Shodan index.
4SearchIn normalises the host or DNS payload into cards, keeps the raw JSON, and adds IPs, hostnames, and CVEs to the case graph.

Data coverage

What the underlying dataset reaches.

Shodan says it crawls the public Internet at least once a week. Host lookups show the most recent banner for each IP and port from the past 30 days. With history enabled, a lookup can go back up to 90 days and at most 1,000 banners.

Data sources

SearchIn queries Shodan for one IP (host banners) or one domain (DNS records and subdomains). The windows below are what Shodan publishes for those lookups.

Shodan data timeframes

Internet crawl: At least weekly
Host lookup window: 30 days
Published docs: Current docs

Weekly crawl

Public Internet

At least once a week

Shodan says crawlers run continuously and are designed to cover the Internet randomly at least once a week.

Host banners

Past 30 days

Most recent banner per port

An IP lookup shows the latest banner Shodan collected for each port in the past 30 days.

History

Up to 90 days

At most 1,000 banners

When the membership key allows history, the host API can return older banners, capped at 90 days and 1,000 banners.

DNS domain

Indexed domains

Records and subdomains

A domain query reads DNS records and subdomains Shodan has associated with that name.

What a SearchIn query returns

A SearchIn query is one host lookup or one DNS-domain lookup.

An IP query returns ports, service banners, products, org, location, and CVE tags when Shodan has them.

History is requested when the membership key allows it, within Shodan’s 90-day and 1,000-banner cap.

A domain query returns DNS records and subdomains from the Shodan index.

SearchIn does not run on-demand scans, Shodan Monitor, or Shodan Trends.

Supported inputs & pricing

Prices are USD. LeakRadar includes 1,000 credential unlocks in the query price, then $0.50 per extra 1,000. OSINT Industries is $0.60 plus optional premium modules at $1.80. Other integrations are flat per query. Full SearchIn rates are on pricing.

Shodan SearchIn pricing by input type
Input type	Price
Domaindomain	$0.10
IP addressip	$0.10

Why run Shodan through OSINTverse

You can always buy Shodan directly. Here is what changes when the same data comes through SearchIn instead. Full write-up: OSINTverse vs Shodan.

A single $0.10 query returns a host card, ports, banners, and CVEs — no Shodan CLI or credit spreadsheet.

Historical banners are requested when the membership key allows it, then labelled so you can see current vs historical.

IPs, hostnames, and domains drop into the case graph so you can pivot into Whoxy, WhoisXML, or breach providers.

Shodan directly compared with Shodan through OSINTverse SearchIn
	Shodan directly	Through OSINTverse
Getting started	Shodan sells a one-time membership or higher query-credit plans, with an API key bound to that account and a monthly query-credit allotment.	Sign in, top up from $10, and run Shodan the same minute — no vendor contract, seat, or sales call.
What a query costs	Plan, credit pack, or contract pricing set by the vendor and paid up front.	Pay per query from your prepaid balance — Shodan starts at $0.10 for domain lookups, with the exact price shown before you run it.
Failed lookups	Handled under the vendor's own credit and refund policy.	Automatically refunded to your wallet — a search that fails upstream after billing is not charged.
Output format	A vendor-specific response shape you normalise and render yourself.	Normalised result panels plus the raw JSON, returned by the same POST /v1/search contract as every other integration.
Cross-source work	Copy-paste between vendor dashboards to follow a lead into another dataset.	Results join one case graph, so you can pivot an entity into any of the other 16 integrations in a click.
Running it for a team	Per-seat or per-account access, billed and administered per analyst.	One shared team wallet with roles, provider allowlists, enforced MFA, and audit history — no per-seat fee.
Volume work	Script the vendor API yourself, including retries, polling, and rate handling.	Bulk search takes up to 50 queries across selected providers in one submission (max 100 jobs), with per-job status and partial-failure handling.

What every integration inherits

One wallet, no subscriptions

Top up prepaid USD from $10 and spend it a query at a time across all 17 integrations. No monthly fee, no seat count — and the balance never expires.

Failed searches are refunded

If an upstream provider errors or times out after the charge, the search is marked refunded and the money goes back to your wallet automatically.

One API for every source

The same POST /v1/search contract and x-api-key header work for every integration, so adding a source to your automation is a one-word change.

Cases and pivot graph

Results land in a named case you can reopen. Entities become graph nodes you can pivot from into any other integration without retyping.

Team wallets and controls

Share one balance with roles, provider allowlists, enforced MFA, and audit history — instead of buying a vendor seat for every analyst.

Exports built in

Download any result as JSON, CSV, or PDF, and export the case graph as PNG, SVG, entities CSV, or graph JSON.

Good to know

Constraints worth reading before you spend a query.

This integration uses host lookup and DNS domain — it does not run on-demand internet scans or manage Shodan alerts.

A host with no public services, or a domain Shodan has not indexed, returns no data — the lookup still bills because Shodan answered.

CVE tags and banners reflect what Shodan last observed in its 30-day host window, not a live authenticated assessment.

Going direct still makes sense at sustained high volume on a single source. Shodan sells a one-time membership or higher query-credit plans, with an API key bound to that account and a monthly query-credit allotment. Through SearchIn you trade that commitment for per-query pricing across 17 integrations.

Access via SearchIn UI

Run the integration without leaving the dashboard.

Open SearchIn and choose IP or Domain.
Select Shodan as the provider.
Review the host card and services, or the DNS records and subdomains.

What you'll see

·Host card with ports, org, location, and CVEs
·Filterable service banners
·DNS record table and subdomain list

Open with this integration

Access via API

Authenticate with x-api-key, then create a search job.

Use POST /v1/search with provider shodan. Poll GET /v1/search/{id} when status is running (FaceCheck).

curl -X POST "https://apiv1.osintverse.com/v1/search" \
  -H "Content-Type: application/json" \
  -H "x-api-key: ov_your_api_key" \
  -d '{"provider":"shodan","input_type":"ip","query":"8.8.8.8"}'

Create API key Full API docs

Sample queries

8.8.8.8

Host banners and ports

domain

example.com

DNS records + subdomains

Investigations that use Shodan

OSINT Industries Predicta Search LeakRadar LeakOSINTbot DeHashed Snusbase Whoxy WhoisXML SecurityTrails Hunter.io BuiltWith Blockchair IPQualityScore Facecheck.id Picarta.ai GeoSeer

FAQ

Shodan on OSINTverse, answered

How do I use Shodan in SearchIn?

Open SearchIn and choose IP or Domain. Select Shodan as the provider. Review the host card and services, or the DNS records and subdomains.

How do I call Shodan from the OSINTverse API?

Authenticate with an x-api-key header, then POST /v1/search with provider "shodan" and a supported input_type (domain, ip). Poll GET /v1/search/{id} if the job returns running.

What does Shodan cost on SearchIn?

Domain: $0.10. IP address: $0.10. You see the price before every run, and there is no subscription.

Why use OSINTverse instead of Shodan directly?

Shodan sells a one-time membership or higher query-credit plans, with an API key bound to that account and a monthly query-credit allotment. On OSINTverse you pay per query from one prepaid USD wallet with no subscription, failed searches are refunded automatically, results are normalised into a case graph you can pivot into other sources, and the same POST /v1/search contract reaches every integration. A single $0.10 query returns a host card, ports, banners, and CVEs — no Shodan CLI or credit spreadsheet. Historical banners are requested when the membership key allows it, then labelled so you can see current vs historical. IPs, hostnames, and domains drop into the case graph so you can pivot into Whoxy, WhoisXML, or breach providers.

What are the limits of Shodan on SearchIn?

This integration uses host lookup and DNS domain — it does not run on-demand internet scans or manage Shodan alerts. A host with no public services, or a domain Shodan has not indexed, returns no data — the lookup still bills because Shodan answered. CVE tags and banners reflect what Shodan last observed in its 30-day host window, not a live authenticated assessment.

Run Shodan alongside every other source

One login, one prepaid wallet, and the price shown before every lookup.

Run Shodan See pricing

Free account, no card
Credits never expire
Refund unused balance in 7 days