Shodan for OSINT & Forensics: CLI Commands, Search Filters and Query Recipes

2026-08-09

Shodan is the search engine for internet-connected devices - and one of the most versatile tools for OSINT and digital forensics. This guide walks through the practice in three parts: the CLI commands, the search filters (dorks), and ready-to-use query recipes for real investigative scenarios.

A quick reminder on syntax: filters take the form filtername:value with no space between the filter and its value. Values containing spaces need quotes, and on the command line the whole query needs an extra set of single quotes, e.g. 'ssl.cert.subject.cn:"example.com"'. Filters combine simply by placing them next to each other.

Use responsibly. Shodan indexes banners that devices expose publicly - searching is passive. Active scanning (shodan scan submit) and any follow-up interaction with a host require proper authorization. Everything below is intended for legitimate research, defensive security, and lawful investigations only.

Part 1 - The Shodan CLI

The command-line tool shodan (part of the shodan Python package) covers nearly the full feature set. After pip install shodan, run shodan init <API-KEY> once - then every command is available.

Account and setup

Command	Purpose
`shodan init <key>`	store the API key
`shodan info`	account info, incl. remaining credits
`shodan myip`	print your external IP
`shodan version`	tool version

Lookups

Command	Purpose
`shodan host <ip>`	all information for an IP: open ports, banners, vulnerabilities, last-seen state
`shodan domain <domain>`	all information for a domain: subdomains and DNS records (passive)

shodan host 8.8.8.8
shodan domain example.com --details --save

Search, count, statistics

Command	Purpose
`shodan search <query>`	search the Shodan database
`shodan count <query>`	just the number of matches - without spending query credits
`shodan stats --facets <f> <query>`	faceted census: most common values per property

shodan search --fields ip_str,port,org 'product:nginx country:DE'
shodan count 'ssl.version:tlsv1'
shodan stats --facets org,country port:445

Save and process data

Command	Purpose
`shodan download <file> <query>`	save results as compressed JSON
`shodan parse <file>`	process saved JSON offline
`shodan convert <file> <format>`	convert to another format (e.g. CSV, KML, GeoJSON)

shodan download berlin-nginx 'product:nginx city:"Berlin"'
shodan parse --fields ip_str,port berlin-nginx.json.gz

Monitoring (alerts) and on-demand scans

Command	Purpose
`shodan alert create <name> <net>`	continuously monitor a network
`shodan alert domain <domain>`	alert based on a domain
`shodan alert list / info / remove / clear`	view and manage alerts
`shodan alert triggers / enable / disable`	control notification triggers
`shodan alert export / import`	save / restore the monitoring configuration
`shodan scan submit <ip/net>`	request an active scan (authorization required)
`shodan scan status / list / protocols`	track scans; scannable protocols
`shodan honeyscore <ip>`	honeypot probability (0-1)

A documentation quirk worth knowing: the help text of shodan alert import mistakenly starts with "Export…" in the source (copied from alert export). The function does, however, import a previously exported monitoring configuration.

Streaming and more

Command	Purpose
`shodan stream`	read data in real time (requires the right subscription)
`shodan radar`	real-time map of new findings in the terminal
`shodan trends <query>`	search the historical Shodan database
`shodan data` / `shodan org`	bulk datasets; managing your organization

Part 2 - Search filters (dorks): the reference

Filters take the form filtername:value (no space); values with spaces go in quotes. By default Shodan only searches the banner's data property - everything else is reachable only through the filters below.

Host and network

Filter	Matches
`ip`, `net`	IP address / CIDR range
`hostname`, `domain`	hostname in the banner / domain
`port`	port number of the service
`org`, `isp`, `asn`	organization, provider, AS number
`product`, `version`, `cpe`	detected software, version, CPE identifier
`os`, `device`, `link`	operating system, device type, network link type
`hash`	hash of the `data` property (identical banners)
`has_screenshot`, `has_ssl`, `has_ipv6`, `has_vuln`	yes/no markers
`tag`	automatic Shodan tags (higher plan)

Plus a few meta filters: all (searches all fields), shodan.module (the collecting crawler module), scan (scan ID) and asset.

Location

Filter	Matches
`country`, `state`, `region`, `city`, `postal`	country / state / region / city / postal code
`geo`	latitude, longitude, optional radius in km

HTTP

Filter	Matches
`http.title`, `http.html`	page title / HTML body
`http.status`	HTTP status code
`http.component`, `http.component_category`	detected web technology / category
`http.favicon.hash`	favicon hash (fingerprint)
`http.waf`	detected web application firewall
`http.securitytxt`	contents of `security.txt`
`http.html_hash`, `http.title_hash`, `http.dom_hash`, `http.headers_hash`, `http.server_hash`, `http.robots_hash`	hashes of individual HTTP parts (pivoting/dedup)

SSL/TLS

Filter	Matches
`ssl`, `ssl.version`, `ssl.alpn`	certificate text, TLS version(s), ALPN protocols
`ssl.jarm`, `ssl.ja3s`	TLS-stack fingerprints (JARM, JA3S)
`ssl.cert.subject.cn`, `ssl.cert.issuer.cn`	Common Name of subject / issuer
`ssl.cert.serial`, `ssl.cert.fingerprint`	serial, fingerprint (exact certificate)
`ssl.cert.expired`, `ssl.cert.alg`, `ssl.cert.extension`	expired?, signature algorithm, extensions
`ssl.cert.pubkey.bits`, `ssl.cert.pubkey.type`	public-key length and type
`ssl.cipher.name`, `ssl.cipher.bits`, `ssl.cipher.version`	negotiated cipher suite
`ssl.chain_count`	certificate chain length

Screenshots and cloud

Filter	Matches
`screenshot.hash`, `screenshot.label`	screenshot hash / ML label (e.g. `ics`, `login`)
`cloud.provider`, `cloud.region`, `cloud.service`	cloud provider / region / service

Tracking pixels and web markers - strong for attribution: linking different sites via the same ID.

Filter	Matches
`google_analytics`, `google_tag_manager`, `google_ads`	Google tracking IDs in the page source
`meta_pixel`, `tiktok_pixel`, `x_pixel`	Meta, TikTok and X pixel IDs

Protocol-specific

Filter	Matches
`ssh.hassh`, `ssh.type`	SSH HASSH fingerprint, host-key type
`snmp.name`, `snmp.location`, `snmp.contact`	SNMP system fields
`ntp.ip`, `ntp.port`, `ntp.more`, `ntp.ip_count`	NTP monlist data
`telnet.option`, `telnet.do`/`dont`/`will`/`wont`	negotiated Telnet options
`bitcoin.ip`, `bitcoin.port`, `bitcoin.version`, `bitcoin.ip_count`	Bitcoin node characteristics

Vulnerabilities, category and time

Filter	Matches
`vuln`, `has_vuln`	CVE / "has a vulnerability" (higher plan)
`category`	crawl category, e.g. `ics`, `malware`
`before`, `after`	time window in `dd/mm/yyyy` format

Part 3 - Query recipes: combining filters

Knowing the individual filters is one thing - combining them into precise, repeatable queries is where the real investigative value lives. The recipes below are starting points for OSINT and forensic work.

Infrastructure pivoting

The strongest OSINT use of Shodan is pivoting: starting from one artifact and finding related infrastructure.

Find every host serving the same favicon. A favicon hash is a compact fingerprint that often reveals a whole fleet of related servers, even across different IPs and domains.

http.favicon.hash:-1234567890

Pivot on a TLS certificate Common Name. Useful for mapping infrastructure tied to a domain or organization.

ssl.cert.subject.cn:"example.com"

Group hosts by JARM fingerprint. JARM clusters servers with identical TLS-stack behavior - handy for spotting matching C2 or panel infrastructure.

ssl.jarm:<jarm-hash>

Scope everything an organization or ASN exposes.

org:"Target Organization"
asn:AS15169

Find hosts by hostname. hostname matches the name carried in the banner - useful for surfacing sub-domains and forgotten hosts belonging to a domain.

hostname:example.com

Pivot more precisely on the certificate. The Common Name can be ambiguous; the serial and SHA-256 fingerprint identify one specific certificate - and the issuer CN finds everything signed by the same (often internal) CA.

ssl.cert.fingerprint:<sha256-fingerprint>
ssl.cert.serial:<serial>
ssl.cert.issuer.cn:"Internal CA"

Group identical banners or screenshots. hash is the hash of the data property - hosts with an identical banner share it; screenshot.hash does the same for screenshots.

hash:-1937681632
screenshot.hash:<image-hash>

Exposed and misconfigured services

Databases reachable from the internet.

product:MongoDB
product:Elasticsearch port:9200
product:"Redis" port:6379

Remote-access surfaces.

port:3389 has_screenshot:true
product:OpenSSH port:22

Web panels and login pages by title.

http.title:"Login" country:DE
http.title:"Index of /"

Web technology and content fingerprinting

Detected HTTP components and page content let you re-find technologies, campaigns or reused markers across many hosts.

Search by the web technology in use. Shodan detects CMSs, frameworks and libraries automatically; the related http.component_category groups whole categories.

http.component:"WordPress"
http.component:"jQuery" country:DE

Find pages carrying a specific marker in the HTML. http.html searches the HTML body - ideal for tracking a tracking ID, a template fragment or a reused string across many hosts. http.status narrows further by response code.

http.html:"ua-000000-1"
http.html:"Powered by AcmeCMS" http.status:200

Detect web application firewalls.

http.waf:Cloudflare

Certificates and TLS hygiene

Expired certificates on a network you own. A fast way to surface neglected assets.

ssl.cert.expired:true net:203.0.113.0/24

Outdated TLS versions still in use. Note Shodan's value for TLS 1.0 is tlsv1 (not tlsv1.0); accepted values are sslv2, sslv3, tlsv1, tlsv1.1, tlsv1.2, tlsv1.3.

ssl.version:tlsv1 country:DE

For the cipher layer there is also ssl.cipher.name (the exact cipher-suite name) - useful for surfacing outdated or weak suites.

Geographic and organizational scoping

These filters narrow any query to a place, an organization or a platform - usually combined with a service filter.

country:DE city:"Berlin"
geo:"52.52,13.40,50"
postal:"10115" product:nginx
org:"Deutsche Telekom AG" os:"Windows"
asn:AS3320 isp:"Vodafone"

geo takes latitude, longitude and an optional radius in kilometers; os, isp and device narrow further by platform, provider and device type.

Vulnerability-oriented triage

These filters generally require a paid or academic Shodan account.

Hosts flagged with known vulnerabilities.

has_vuln:true org:"Target Organization"

A specific CVE across a region.

vuln:CVE-2014-0160 country:DE

Shodan tags

Shodan labels banners automatically with tags. They are a fast entry point - and an effective noise filter.

tag:vpn country:DE
tag:database -tag:honeypot
tag:self-signed
tag:eol-os
tag:compromised

-tag:honeypot is especially handy: it excludes suspected honeypots (the honeypot tag is mutually exclusive with real device tags such as ics). The tag vocabulary is data-driven - list the values currently in use with shodan stats --facets tag <query>. Common values: vpn, cloud, self-signed, starttls, cdn, eol-os, eol-product, scanner, database, iot, compromised.

Industrial control systems (ICS)

ICS exposure is high-impact and worth a dedicated recipe set.

category:ics
product:Modbus
screenshot.label:ics country:DE

Time-boxing results

Narrow a query to a window - useful when correlating with an incident timeline. Dates use dd/mm/yyyy.

product:nginx after:01/01/2025 before:01/07/2025

Putting it together

The recipes above are starting points. Chaining constraints is what produces a short, high-signal result set instead of noise:

product:nginx country:DE port:443 ssl.cert.expired:true

Two practical habits:

Run shodan count <query> first - it returns the number of matches without spending query credits, so you can refine before pulling results.
Save large result sets with shodan download, then process them offline with shodan parse to avoid re-spending credits on the same search.

One important caveat: by default Shodan only searches the banner's data property. Everything else - organization, location, port, certificate fields - is only reachable through the filters shown here. And because Shodan's filter set is account-tier dependent and evolves over time, the authoritative, current list is always available from the API endpoint https://api.shodan.io/shodan/host/search/filters?key=YOUR_API_KEY.

Sources

Shodan Help Center - Search Query Fundamentals: help.shodan.io/the-basics/search-query-fundamentals
Shodan Developer - REST API / Search Filters: developer.shodan.io/api
Shodan Help Center - Command-Line Interface: help.shodan.io/command-line-interface
Shodan - Filter Reference (authoritative filter list): shodan.io/search/filters
Shodan Help Center - Generating Statistics (facets): help.shodan.io/command-line-interface/3-stats
shodan-python - CLI source (reference for the commands): github.com/achillean/shodan-python
Shodan Developer documentation: developer.shodan.io

Fact status: 2026-08-09. CLI commands verified against the shodan-python source; filter set based on the official Filter Reference. The binding, current filter list is tier-dependent and retrievable via the shodan/host/search/filters API endpoint.