What Is Shodan? The Search Engine Indexing Your Infrastructure

Search engines index the internet. You already know that. You know Google crawls websites and makes them findable. You know that anything you publish online is, in principle, discoverable.

What most people do not know is that there is a second kind of search engine. One that does not index websites at all.

It indexes devices.

It indexes every public-facing IP address it can reach, scans the open ports on that address, identifies the services running on those ports, reads the banners those services return, records the software versions, notes the protocols in use – and makes all of that searchable.

It has been doing this continuously since 2009.

It is called Shodan.

What Shodan Actually Is

Shodan was created by John Matherly and launched in 2009. The name is a reference to a fictional AI from the video game System Shock – and the choice of name was deliberate. Shodan sees everything connected to the network. It does not distinguish between what you meant to expose and what you accidentally left open.

The simplest way to understand it is by comparison with Google.

The fundamental difference is what each one is looking for. Google is looking for information people have published. Shodan is looking for devices people have connected – whether they intended them to be findable or not.

What a Banner Is and Why It Matters

When a device or service receives a connection on an open port, it typically responds with what is called a banner. This is a short block of text that identifies the service – its name, version number, sometimes the operating system, sometimes configuration details.

A web server might respond with something like: Apache/2.4.51 (Ubuntu). An SSH server might return its version. A router’s management interface might return the device model and firmware version. An industrial controller might identify itself by manufacturer and protocol.

These banners are useful for legitimate diagnostic purposes. They are also extremely useful for an attacker, because they tell you exactly what software is running – and therefore which known vulnerabilities apply to it.

Shodan collects and stores these banners at scale. Billions of them. Continuously updated.

What Shodan Can Find

The breadth of what Shodan indexes is wider than most people expect. It is not just servers and websites. Here are the categories of device and service that appear in Shodan results every day.

Real Search Examples

Shodan has its own search syntax. Here are examples of the kind of searches that return genuine results. These are not theoretical – searches like these are run thousands of times a day.

That last one is worth dwelling on. Shodan does not just record text banners. For certain services it takes screenshots. If your CCTV management interface is publicly accessible, there may already be a screenshot of it stored in Shodan’s index – possibly showing camera feeds, site names, login pages with the location pre-filled, or device configuration details.

The Scale of the Problem

These numbers matter because they illustrate that Shodan is not scanning occasionally. It is a continuous, automated process running around the clock. The index is updated regularly. If you open a new port today, it will appear in Shodan’s results within days – sometimes hours.

Shodan is also not the only tool of its type. Censys, FOFA, Zoomeye and Greynoise all operate similar infrastructure. An organisation with exposed services is not just visible on one platform – it is visible on several, simultaneously.

Who Uses Shodan?

This is the part of the conversation that makes some people uncomfortable. Shodan is a tool. Like most tools, who uses it and why depends entirely on the person holding it.

The tool itself is neutral. Shodan does not know or care why you are searching. The same query that a penetration tester runs to audit a client is available to anyone with a free account.

This is the uncomfortable truth. The attackers are already using it. The question is whether the defenders are using it too.

Why IoT and Industrial Businesses Are Particularly Exposed

General IT security advice tends to focus on websites, email and endpoints. Patch your servers. Use MFA. Train staff on phishing. This is all valid – but it misses a significant part of the attack surface for organisations operating in IoT, industrial networking, building management and remote monitoring.

The exposure in those sectors comes from a different set of devices entirely.

How Attackers Actually Use Shodan

It is worth being specific about this because it changes how you think about the risk. Attacks on internet-connected infrastructure are not primarily the result of skilled hackers manually probing individual targets. They are automated and opportunistic.

The process looks roughly like this:

1. Search for a specific vulnerability or exposure An attacker becomes aware of a new CVE affecting a specific product – say, a buffer overflow in a particular router firmware version. They search Shodan for all devices running that firmware version globally. Results: thousands of targets, already catalogued, with IP addresses ready.
2. Filter by geography or sector Shodan results can be filtered by country, organisation name, ASN, city. An attacker targeting UK infrastructure, or looking for devices registered to utilities or local authorities, can do that with a single filter.
3. Export the target list Shodan’s API allows bulk export of results. A list of ten thousand vulnerable IP addresses can be downloaded in minutes and fed directly into an automated exploitation tool.
4. Run automated credential testing For services like RDP, VNC, SSH and router management interfaces, automated tools try default and common credential combinations across all targets simultaneously. No manual work required.
5. Access and act A successful authentication to a router management interface, CCTV NVR, or industrial gateway gives the attacker a foothold. From there: data exfiltration, ransomware deployment, persistent access, lateral movement into the wider network – or in industrial cases, direct manipulation of physical processes.

The key point is step one. The attacker does not start with your organisation in mind. They start with a vulnerability in mind and work outwards. Your router or camera or controller appears in the results not because you were targeted, but because it was findable.

Should Your Business Check Shodan?

Yes. Unreservedly.

Checking what Shodan knows about your own IP ranges is one of the most useful things you can do in thirty minutes of security work. It costs nothing – a free Shodan account is sufficient for basic searches. And it gives you an attacker’s-eye view of your own infrastructure.

Here is what to do.

Step One: Find Your Public IP Addresses

List every public IP address your organisation uses. This includes your office broadband, any fixed IP SIM cards in routers or devices, any cloud servers or VPS instances, VPN gateway addresses, and any hosted services. If you are not sure what public IPs you have, your ISP and SIM provider can tell you.

Step Two: Search Shodan

Go to shodan.io. Create a free account. Search for each IP address individually. You can also search by your organisation name if Shodan has it registered against your IP ranges.

For each result, note:

• Which ports are open
• Which services Shodan has identified on those ports
• What software versions are reported
• Whether any known CVEs are flagged against those versions
• Whether Shodan has taken any screenshots of accessible interfaces
• Whether any services are accessible without authentication

Step Three: Act on What You Find

For each finding, ask: should this port be publicly accessible at all? If the answer is no, close it. If the answer is yes, ask: is this service properly authenticated, running current software, and configured securely? If any of those answers is no, fix it.

Common quick wins:

• Close management ports (HTTP/HTTPS admin interfaces) that do not need to be public – use VPN for remote management instead
• Change default credentials on every device that still has them
• Update firmware on routers, cameras and gateways – particularly anything with a publicly listed CVE
• Move MQTT brokers behind authentication or onto private network segments
• Disable Telnet – there is no legitimate reason for it on a modern deployment
• Restrict RDP and VNC to VPN access only

The Limitation of a One-Off Check

Searching Shodan once is useful. It tells you what your exposure looks like today. But your infrastructure changes. Firmware updates open new ports. New devices get deployed. A contractor opens a port for remote access and forgets to close it. A new VPN server comes online. A SIM card gets swapped and a new fixed IP is assigned.

Each of those changes creates a new potential exposure. And Shodan – along with every other scanning tool – will find it.

This is where a one-off Shodan check hits its limit. The value is not in knowing what your exposure looks like once. The value is in knowing the moment it changes.

Professional exposure monitoring platforms – Tenable, Qualys, Censys Attack Surface Management – solve this with continuous automated scanning and alerting. They cost hundreds to thousands of pounds per month.

There is a more accessible alternative. You can build a self-hosted monitoring platform on a VPS for less than £5 per month that watches your public IP addresses, scans for new open ports, tracks SSL certificate expiry, and runs vulnerability assessments against your own infrastructure on a schedule. When something changes, you get an alert.

Shodan and the Wider Threat Landscape

Shodan does not create the vulnerabilities it finds. Exposed Telnet ports, default credentials, unpatched firmware – these exist independently of whether Shodan indexes them. Shodan simply makes them findable efficiently. Removing a device from Shodan’s index – which is possible to request – does not make the device secure. It just makes it marginally harder to find via one specific tool.

Security through obscurity is not security. An attacker with a port scanner and a list of IP ranges can replicate much of what Shodan provides without using Shodan at all. The tool is an accelerant, not the underlying cause.

This matters because the correct response to Shodan is not to try to hide from it. The correct response is to make sure that what it finds about your infrastructure is as boring as possible. Closed ports. Current firmware. No default credentials. Services behind VPN rather than directly exposed. An attacker who finds your IP in Shodan and sees nothing interesting will move on to the next target.

A Note on Legality

Using Shodan to check your own infrastructure is legal and encouraged. Using it to search for vulnerabilities in systems you do not own, or using information from Shodan to access systems without authorisation, is not. In the UK, the Computer Misuse Act 1990 covers unauthorised access to computer material and carries serious penalties.

This applies to penetration testers and security researchers too. Testing infrastructure without explicit written authorisation from the owner is illegal regardless of your intentions or how publicly accessible the target appears to be.

Summary: What to Do This Week

• Create a free Shodan account at shodan.io
• List every public IP address your organisation uses
• Search each IP in Shodan and review the results carefully
• Close any management ports that do not need to be publicly accessible
• Change default credentials on every device
• Update firmware on any device with a known CVE flagged in Shodan results
• Move remote access services (RDP, VNC, router admin) behind VPN
• Set up continuous monitoring so you know when your exposure changes

That last point is the one most organisations skip. A one-off check gives you a snapshot. Continuous monitoring gives you awareness. The infrastructure that gets compromised is usually not the infrastructure anyone was watching.

Related reading

• ThingsBoard for SCADA
• SCADA remote access
• private vs public IP