Shodan InternetDB API

Free Shodan InternetDB API with no key: open ports, hostnames, CVEs and technology tags for any IPv4 address. Fast, cached attack-surface data. Tested example included.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 21 Aug 2026

What is the Shodan InternetDB API?

Shodan InternetDB is a free, key-free API returning a summary of what Shodan knows about an IPv4 address: open ports, resolved hostnames, known CVE identifiers, technology tags and CPE product identifiers. No account or API key is required.

Shodan's main API requires a paid key, but InternetDB is a deliberately open, stripped-down view of the same scan data. It answers one question fast — what is exposed on this IP — and returns a small, cached object rather than the full record. That makes it genuinely usable for attack-surface checks, asset inventory and enrichment at a scale the paid API would price out.

Because the data comes from Shodan's periodic internet-wide scans rather than a live probe, it is a snapshot rather than a real-time port scan: a port closed yesterday may still be listed, and a service that came up this morning will not be. That is also its main advantage — you learn what is exposed on your own infrastructure without sending a single packet to it, which raises no alarms and needs no authorisation.

Quick facts

Base URL: https://internetdb.shodan.io
Authentication: No API key and no Shodan account. This is a separate, free service from the main Shodan API, which does require a paid key.
Rate limit: Roughly 1 request per second per IP. Responses are heavily cached.
Pricing: Free.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Shodan InternetDB API

Every request below was executed against the live API on 21 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Look up exposed ports and CVEs for 8.8.8.8

GET https://internetdb.shodan.io/8.8.8.8

curl

curl 'https://internetdb.shodan.io/8.8.8.8'

JavaScript (fetch)

const res = await fetch("https://internetdb.shodan.io/8.8.8.8");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://internetdb.shodan.io/8.8.8.8", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

{
  "cpes": [],
  "hostnames": [
    "retail-storage.emarketer.com",
    "dns.google"
  ],
  "ip": "8.8.8.8",
  "ports": [
    53,
    443
  ],
  "tags": [],
  "vulns": []
}

Parameters

Parameter	Type	Required	Description
`ip`	path segment	Required	The IPv4 address to look up. IPv6 is not supported, and the endpoint takes no query parameters. `8.8.8.8`

Response fields

ipstring: The address queried, echoed back.
portsarray: Open TCP ports observed during Shodan's most recent scan of the address.
hostnamesarray: Hostnames resolving to the address, from reverse DNS and TLS certificates. Can include stale or unrelated entries.
cpesarray: CPE identifiers for software Shodan fingerprinted, naming vendor, product and version.
vulnsarray: CVE identifiers associated with the detected software versions. These are inferred from banners, so they indicate a version known to be vulnerable, not a confirmed exploitable flaw.
tagsarray: Classification tags such as `cloud`, `cdn`, `vpn`, `honeypot` or `self-signed`.

What you can build with the Shodan InternetDB API

Audit which ports are exposed on your own servers without running a scan
Enrich a threat intelligence pipeline with passive exposure data
Check whether a cloud IP is tagged as a known VPN, proxy or hosting range
Feed an asset inventory with observed services and CPE identifiers

Common errors and how to fix them

404

Shodan has no record for that address.

Fix: Not an error condition — it usually means nothing is exposed, or the address has never been scanned. Treat it as an empty result.

429

Rate limited.

Fix: Keep to roughly one request per second and cache results. The scan data updates on the order of days, so aggressive polling gains nothing.

400

Malformed or non-IPv4 input.

Fix: Only IPv4 literals are accepted — no hostnames, no CIDR ranges and no IPv6.

Shodan InternetDB API — frequently asked questions

Is Shodan InternetDB free?

Yes, it is completely free with no API key and no Shodan account. It is a separate, simplified service from the main Shodan API, which does require a paid subscription.

How current is InternetDB data?

It reflects Shodan's most recent internet-wide scan of that address, which is days rather than seconds old. It is a snapshot, not a live port scan — recently opened services may be missing and recently closed ones may still appear.

Does listing a CVE mean the host is vulnerable?

Not necessarily. The `vulns` array is inferred from service banners and version strings, so it flags software versions publicly associated with those CVEs. Backported patches — common on Linux distributions — leave the banner unchanged, producing false positives.

Is it legal to look up someone else's IP address?

Querying InternetDB sends no traffic to the target at all — you are reading Shodan's existing scan data, which is the point of passive reconnaissance. Acting on what you find against systems you do not own is a separate question, and one you need authorisation for.

Tools that pair with this API

Port Number Lookup

Look up what a TCP or UDP port is used for — search 150+ common well-known and registered ports by number, service name or protocol. Instant and offline.

IP Address Validator

Validate lists of IPv4, IPv6 and CIDR entries with the exact failure reason per line — compressed ::, IPv4-mapped forms and prefixes included. Free.

CIDR to IP Range Converter

Convert CIDR notation like 192.168.1.0/26 into its first and last IP address and total address count. Handles many blocks at once, free and in-browser.

Alternatives to Shodan InternetDB API

If Shodan InternetDB does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
SSL Labs	Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.	No key	No	19 Aug 2026
Stop Forum Spam	Free Stop Forum Spam API with no key: check an IP address, email or username against a community database of forum spam reports, with confidence score and Tor exit flag.	No key	Yes	21 Aug 2026

All Security & Auth APIs

Shodan InternetDB is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 21 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.