Overview

About

The Datapedia describes all the metadata that Shodan crawlers gather. It is the reference document for all information about top-level properties that are available on the banner. These top-level properties contain service-specific information that provide deeper insights into the configuration and deployment of a device. Most information that Shodan collects for these services is optional which means you need to check for the existence of a property in your code before using it.

Properties

General Properties

Property Name Type Description Required
asn string
cpe array of string CPE information in the old, deprecated format.
cpe23 array of string CPE information in the 2.3 format.
data string Yes
device string
devicetype string
domains array of string Yes
hash integer Numeric hash of the "data" property which is helpful for finding other IPs with the exact same information. Yes
hostnames array of string Hostnames for the IP based on the PTR/ reverse DNS information. Yes
html string This property is deprecated. Use "http.html" instead.
ip integer Numeric IP address which can be more efficient for storing/ indexing.
ip_str string String representation of the IP address. This is most likely what you want to use.
info string
ipv6 string
isp string
link string
mac object<string, MacAddressInfo>
opts object Stores experimental data before it has been finalized into a top-level property.
org string Name of the organization that manages the IP
os string Operating system
platform string
port integer Yes
product string Name of the software that powers the service.
tags array of Tag
timestamp string Date and time that the banner was collected in UTC time. Yes
title string This property is deprecated. Use "http.title" instead.
transport string Yes
uptime integer
vendor string
version string
vulns object<string, Vulnerability>

MacAddressInfo

Property Name Type Description Required
assignment string Yes
date string
org string Yes

Tag

A tag is a string that can have one of the following values.

Value Type
c2 string
cdn string
cloud string
compromised string
cryptocurrency string
database string
devops string
doublepulsar string
eol-os string
eol-product string
honeypot string
ics string
iot string
malware string
medical string
onion string
proxy string
self-signed string
scanner string
ssh-bad-key string
starttls string
tor string
videogame string
vpn string

Vulnerability

Property Name Type Description Required
cvss number
references array of string Yes
summary string Yes
verified boolean Yes


↑ TopSearch Queries
SearchApache web servers
product:apache
SearchServices running on port 22
port:22
SearchWeb servers on port 80 or 443
HTTP port:80,443
SearchServices running in the 198.20.0.0/16 network range
net:198.20.0.0/16
SearchSSH services running on port 80
ssh port:80
SearchServices that are vulnerable to Eternalblue
vuln:ms17-010

↑ TopExample
{
    "_shodan": {
        "id": "7383056c-d513-4b43-8734-b82d897888e6",
        "options": {},
        "ptr": true,
        "module": "dns-udp",
        "crawler": "9d8ac08f91f51fa9017965712c8fdabb4211dee4"
    },
    "hash": -553166942,
    "os": null,
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    },
    "ip": 134744072,
    "isp": "Google",
    "port": 53,
    "hostnames": [
        "dns.google"
    ],
    "location": {
        "city": null,
        "region_code": null,
        "area_code": null,
        "longitude": -97.822,
        "country_code3": null,
        "country_name": "United States",
        "postal_code": null,
        "dma_code": null,
        "country_code": "US",
        "latitude": 37.751
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": null,
        "software": null
    },
    "timestamp": "2021-01-28T07:21:33.444507",
    "domains": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "asn": "AS15169",
    "transport": "udp",
    "ip_str": "8.8.8.8"
}