Shodan Cheat Sheet

Shodan is a search engine for internet-connected devices, not web pages. It keeps scanning the internet and records what each open port answers with. This cheat sheet is built around the most useful thing you can do with it: see what the internet already knows about your own IPs and domains, before someone else does.

How a Shodan search works

Shodan stores a banner for every service it finds: the service’s own response (the data field), plus the IP, port, organisation and location. A plain keyword only searches the data field. To search anything else you use a filter, written as filter:value with no space after the colon. Put values that contain spaces in quotes, and combine filters by listing them.

A plain keyword searches the service response. No filter, so no query credit on the first page:

nginx

One filter narrows it to a single property:

port:3389

Quote any value that has a space in it:

org:"Example Corp"

Combine filters to AND them together:

hostname:example.com port:22

Put a minus in front of a filter to exclude matches:

hostname:example.com -port:443

Free account vs Membership

Shodan counts query credits. Your first page of results for a plain keyword is free. Using any filter, or asking for page 2 or later, costs one credit, and one credit returns 100 results. Credits renew at the start of each month.

• Free account: keyword searches and first pages. Filtered searches need credits, so in practice it’s for trying things out.
• Membership, $49 once (not a subscription): 100 query credits and 100 scan credits a month, monitoring for 16 IPs, 20 pages of results, and every filter except vuln and tag. This is the one most people buy.
• Paid API plans start at $69/month. The vuln filter needs Small Business ($359/month), and tag needs Corporate ($1,099/month).

Prices and limits are from Shodan’s own plan page, checked on the date in the chip above.

Check yourself first (free, no account)

Shodan’s InternetDB is a free lookup for non-commercial use that needs no account or API key. It returns the open ports, hostnames, CPEs, tags and known CVEs Shodan has recorded for one IP, and it updates once a week. With no IP it checks the address you’re calling from, which is your home or office public IP:

$ curl https://internetdb.shodan.io/

Look up one specific public IP you own:

$ curl https://internetdb.shodan.io/203.0.113.10

An empty list of ports is the answer you want for a home connection. Anything listed there is reachable from the internet, so check you meant it to be.

Filters for auditing your own footprint

Everything Shodan has seen on one IP:

ip:203.0.113.10

A whole range you own, in CIDR notation:

net:203.0.113.0/24

Any service whose hostname is on your domain:

hostname:example.com

Certificates issued for your domain, which catches forgotten hosts on other networks:

ssl.cert.subject.cn:example.com

Expired certificates still being served for your domain:

ssl.cert.subject.cn:example.com ssl.cert.expired:true

Remote Desktop exposed on your range. It almost never should be:

net:203.0.113.0/24 port:3389

Telnet on your range. Clear-text logins, so close it:

net:203.0.113.0/24 port:23

Databases answering on the open internet:

net:203.0.113.0/24 product:"MongoDB"

Which SSH versions you are running, to spot old ones:

net:203.0.113.0/24 product:"OpenSSH"

Web pages titled like a default install or an admin panel:

hostname:example.com http.title:"Index of"

Your organisation by the name your ISP or cloud gives it:

org:"Example Corp"

Other filters worth knowing: port, product, version, os, country, city, asn, http.status, http.favicon.hash and has_screenshot. The full list is on Shodan’s filter reference page.

The Shodan CLI

The command-line tool uses the same searches and credits as the website. Install it, then initialise it with your own API key from your Shodan account page. Keep the key out of scripts, screenshots and chats.

Install the CLI and Python library:

$ pip install shodan

Store your API key locally, once:

$ shodan init YOUR_API_KEY

Show your current public IP:

$ shodan myip

Everything Shodan knows about one IP:

$ shodan host 203.0.113.10

Count matches without downloading results:

$ shodan count "hostname:example.com"

List results with only the fields you care about:

$ shodan search --fields ip_str,port,org "net:203.0.113.0/24"

Summarise which ports are open across your range:

$ shodan stats --facets port "net:203.0.113.0/24"

Get told when something new appears

Instead of re-running searches, let Shodan watch your addresses. The easy way is Shodan Monitor in the web app; Membership covers 16 IPs. The same thing from the CLI is a network alert:

Create an alert for your IP or range:

$ shodan alert create "Home" 203.0.113.10

Check it exists:

$ shodan alert list

Stream new findings for all your alerts into a folder, one file per day:

$ shodan stream --alert=all --datadir=~/shodan-data/

NyxSearch yourself first. It’s a lot less embarrassing when you’re the one who finds the open RDP port.

Go deeper

• Shodan: the library entry.
• Nmap cheat sheet: scan your own network from the inside to compare with what Shodan sees from outside.
• Lab 00: set up a lab to practise on safely.
• Shodan filter reference and Shodan Help Center: the official docs this sheet was checked against.

Written from Shodan’s own documentation and plan page, checked on 26 Sep 2026. If a filter or price has changed, tell me and I will fix it.