Overview

About

The Datapedia describes all the metadata that Shodan crawlers gather. It is the reference document for all information about top-level properties that are available on the banner. These top-level properties contain service-specific information that provide deeper insights into the configuration and deployment of a device. Most information that Shodan collects for these services is optional which means you need to check for the existence of a property in your code before using it.

Properties

General Properties

Property Name	Type	Description	Required
asn	string
cpe	array of string	CPE information in the old, deprecated format.
cpe23	array of string	CPE information in the 2.3 format.
cpe23_hash	integer	Numeric hash of the "cpe23" property which is helpful for finding other IPs that were fingerprinted as running the exact same software.
data	string		Yes
device	string
devicetype	string
domains	array of string		Yes
hash	integer	Numeric hash of the "data" property which is helpful for finding other IPs with the exact same information.	Yes
hostnames	array of string	Hostnames for the IP based on the PTR/ reverse DNS information.	Yes
html	string	This property is deprecated. Use "http.html" instead.
ip	integer	Numeric IP address which can be more efficient for storing/ indexing.
ip_str	string	String representation of the IP address. This is most likely what you want to use.
info	string
ipv6	string
isp	string
link	string
mac	object<string, MacAddressInfo>
opts	object	Stores experimental data before it has been finalized into a top-level property.
org	string	Name of the organization that manages the IP
os	string	Operating system
platform	string
port	integer		Yes
product	string	Name of the software that powers the service.
tags	array of Tag
timestamp	string	Date and time that the banner was collected in UTC time.	Yes
title	string	This property is deprecated. Use "http.title" instead.
transport	string		Yes
uptime	integer
vendor	string
version	string
vulns	object<string, Vulnerability>

MacAddressInfo

Property Name	Type	Required
assignment	string	Yes
date	string
org	string	Yes

Tag

A tag is a string that can have one of the following values.

Value	Type	Description
ai	string	The service is the web interface or API of an AI/ ML tool (ex. Ollama, vLLM, ComfyUI, Open WebUI, LiteLLM). Every MCP server is also tagged as "ai".
c2	string	The service is the command & control server of an offensive security/ red team framework (ex. Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel).
cdn	string	The IP belongs to a content delivery network (CDN).
cloud	string	The service is related to cloud storage/ hosting software.
compromised	string	The service shows signs of having been compromised by an attacker. For example, a database containing a ransom note, a Docker host running known malicious or cryptomining containers, or a website whose title says it was "hacked by" someone.
cryptocurrency	string	The service is a cryptocurrency node that responded to its blockchain protocol (ex. Bitcoin, Ethereum, Monero, Litecoin).
database	string	The service is a database that was identified either by its native protocol (ex. MySQL, PostgreSQL, MongoDB) or its HTTP interface (ex. Elastic, InfluxDB, ClickHouse).
devops	string	The service is DevOps or infrastructure tooling (ex. Docker, Kubernetes, HashiCorp Vault/ Consul, SaltStack, Harbor).
doublepulsar	string	The Windows computer is vulnerable to MS17-010 (EternalBlue) and responded to the DoublePulsar SMB backdoor check, which means it has been infected with the DoublePulsar implant. Learn more
eol-os	string	The operating system version (ex. Windows, Ubuntu, Linux kernel) has reached its end-of-life date and is no longer supported by the vendor. Learn more
eol-product	string	The product version (ex. MySQL, nginx, PHP, Elasticsearch, Grafana) has reached its end-of-life date and is no longer supported by the vendor. Learn more
honeypot	string	The service matches the fingerprint of a known honeypot (ex. Conpot, Dionaea, Cowrie, Elastichoney) and is most likely not a real device.
ics	string	The service speaks an industrial control system (ICS) protocol (ex. Modbus, Siemens S7, BACnet, DNP3, EtherNet/IP).
iot	string	The service is an Internet of Things (IoT)/ embedded device such as a smart plug, camera or smart TV.
lsp	string	The service is a Language Server Protocol (LSP) server that completed the "initialize" handshake. Learn more
malware	string	Determined by the Shodan Malware Hunter software that pretends to be an infected WindowsXP computer and sends the callback to every IP on the Internet. If the other IP responds then we know that it is a command & control server. Learn more
mcp	string	The service is a Model Context Protocol (MCP) server that exposes tools/ resources to AI agents. Learn more
medical	string	The service is a medical device or system that responded to protocol used in a medical environment (ex. DICOM protocol).
onion	string	The SSL/ TLS certificate was issued for a Tor hidden service (.onion) hostname.
open-dir	string	The website is an open directory listing that exposes the files on the server. The files are listed in the "open_dir" property.
proxy	string	The service is a proxy server (ex. it requested proxy authentication or is a Fast Reverse Proxy server).
self-signed	string	The SSL/ TLS certificate is self-signed (the issuer is the same as the subject).
scanner	string	The IP has been observed scanning the Internet.
ssh-bad-key	string	The SSH host key is a known compromised or hardcoded vendor key that is shared across many devices. Learn more
starttls	string	The service (ex. SMTP, IMAP, POP3, FTP, XMPP) supports upgrading the connection to TLS using STARTTLS.
tor	string	The service is a Tor relay. Learn more
videogame	string	The service is a video game server (ex. Minecraft, Steam).
vpn	string	The service is a VPN server (ex. OpenVPN, IKE/ IPsec, PPTP or an SSL VPN portal).

Vulnerability

Property Name	Type	Required
cvss	number
cvss_version	number
epss	number
kev	boolean
ranking_epss	number
references	array of string	Yes
summary	string	Yes
verified	boolean	Yes

↑ TopSearch Queries

SearchApache web servers
product:apache

SearchServices running on port 22
port:22

SearchWeb servers on port 80 or 443
HTTP port:80,443

SearchServices running in the 198.20.0.0/16 network range
net:198.20.0.0/16

SearchSSH services running on port 80
ssh port:80

SearchServices that are vulnerable to Eternalblue
vuln:ms17-010

↑ TopExample

{
    "_shodan": {
        "id": "7383056c-d513-4b43-8734-b82d897888e6",
        "options": {},
        "ptr": true,
        "module": "dns-udp",
        "crawler": "9d8ac08f91f51fa9017965712c8fdabb4211dee4"
    },
    "hash": -553166942,
    "os": null,
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    },
    "ip": 134744072,
    "isp": "Google",
    "port": 53,
    "hostnames": [
        "dns.google"
    ],
    "location": {
        "city": null,
        "region_code": null,
        "area_code": null,
        "longitude": -97.822,
        "country_code3": null,
        "country_name": "United States",
        "postal_code": null,
        "dma_code": null,
        "country_code": "US",
        "latitude": 37.751
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": null,
        "software": null
    },
    "timestamp": "2021-01-28T07:21:33.444507",
    "domains": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "asn": "AS15169",
    "transport": "udp",
    "ip_str": "8.8.8.8"
}