Overview

About

The Datapedia describes all the metadata that Shodan crawlers gather. It is the reference document for all information about top-level properties that are available on the banner. These top-level properties contain service-specific information that provide deeper insights into the configuration and deployment of a device. Most information that Shodan collects for these services is optional which means you need to check for the existence of a property in your code before using it.

Properties

General Properties

Property Name	Type	Description	Required
asn	string
cpe	array of string	CPE information in the old, deprecated format.
cpe23	array of string	CPE information in the 2.3 format.
data	string		Yes
device	string
devicetype	string
domains	array of string		Yes
hash	integer	Numeric hash of the "data" property which is helpful for finding other IPs with the exact same information.	Yes
hostnames	array of string	Hostnames for the IP based on the PTR/ reverse DNS information.	Yes
html	string	This property is deprecated. Use "http.html" instead.
ip	integer	Numeric IP address which can be more efficient for storing/ indexing.
ip_str	string	String representation of the IP address. This is most likely what you want to use.
info	string
ipv6	string
isp	string
link	string
mac	object<string, MacAddressInfo>
opts	object	Stores experimental data before it has been finalized into a top-level property.
org	string	Name of the organization that manages the IP
os	string	Operating system
platform	string
port	integer		Yes
product	string	Name of the software that powers the service.
tags	array of Tag
timestamp	string	Date and time that the banner was collected in UTC time.	Yes
title	string	This property is deprecated. Use "http.title" instead.
transport	string		Yes
uptime	integer
vendor	string
version	string
vulns	object<string, Vulnerability>

MacAddressInfo

Property Name	Type	Required
assignment	string	Yes
date	string
org	string	Yes

Tag

A tag is a string that can have one of the following values.

Value	Type
ai	string
c2	string
cdn	string
cloud	string
compromised	string
cryptocurrency	string
database	string
devops	string
doublepulsar	string
eol-os	string
eol-product	string
honeypot	string
ics	string
iot	string
malware	string
medical	string
onion	string
open-dir	string
proxy	string
self-signed	string
scanner	string
ssh-bad-key	string
starttls	string
tor	string
videogame	string
vpn	string

Vulnerability

Property Name	Type	Required
cvss	number
cvss_version	number
epss	number
kev	boolean
ranking_epss	number
references	array of string	Yes
summary	string	Yes
verified	boolean	Yes

↑ TopSearch Queries

SearchApache web servers
product:apache

SearchServices running on port 22
port:22

SearchWeb servers on port 80 or 443
HTTP port:80,443

SearchServices running in the 198.20.0.0/16 network range
net:198.20.0.0/16

SearchSSH services running on port 80
ssh port:80

SearchServices that are vulnerable to Eternalblue
vuln:ms17-010

↑ TopExample

{
    "_shodan": {
        "id": "7383056c-d513-4b43-8734-b82d897888e6",
        "options": {},
        "ptr": true,
        "module": "dns-udp",
        "crawler": "9d8ac08f91f51fa9017965712c8fdabb4211dee4"
    },
    "hash": -553166942,
    "os": null,
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    },
    "ip": 134744072,
    "isp": "Google",
    "port": 53,
    "hostnames": [
        "dns.google"
    ],
    "location": {
        "city": null,
        "region_code": null,
        "area_code": null,
        "longitude": -97.822,
        "country_code3": null,
        "country_name": "United States",
        "postal_code": null,
        "dma_code": null,
        "country_code": "US",
        "latitude": 37.751
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": null,
        "software": null
    },
    "timestamp": "2021-01-28T07:21:33.444507",
    "domains": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "asn": "AS15169",
    "transport": "udp",
    "ip_str": "8.8.8.8"
}