Shodan InternetDB API
Free Shodan InternetDB API with no key: open ports, hostnames, CVEs and technology tags for any IPv4 address. Fast, cached attack-surface data. Tested example included.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the Shodan InternetDB API?
Shodan InternetDB is a free, key-free API returning a summary of what Shodan knows about an IPv4 address: open ports, resolved hostnames, known CVE identifiers, technology tags and CPE product identifiers. No account or API key is required.
Shodan's main API requires a paid key, but InternetDB is a deliberately open, stripped-down view of the same scan data. It answers one question fast — what is exposed on this IP — and returns a small, cached object rather than the full record. That makes it genuinely usable for attack-surface checks, asset inventory and enrichment at a scale the paid API would price out.
Because the data comes from Shodan's periodic internet-wide scans rather than a live probe, it is a snapshot rather than a real-time port scan: a port closed yesterday may still be listed, and a service that came up this morning will not be. That is also its main advantage — you learn what is exposed on your own infrastructure without sending a single packet to it, which raises no alarms and needs no authorisation.
Quick facts
- Base URL
https://internetdb.shodan.io- Authentication
- No API key and no Shodan account. This is a separate, free service from the main Shodan API, which does require a paid key.
- Rate limit
- Roughly 1 request per second per IP. Responses are heavily cached.
- Pricing
- Free.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the Shodan InternetDB API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Look up exposed ports and CVEs for 8.8.8.8
GET https://internetdb.shodan.io/8.8.8.8
curl 'https://internetdb.shodan.io/8.8.8.8'const res = await fetch("https://internetdb.shodan.io/8.8.8.8");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://internetdb.shodan.io/8.8.8.8", timeout=20)
res.raise_for_status()
print(res.json()){
"cpes": [],
"hostnames": [
"retail-storage.emarketer.com",
"dns.google"
],
"ip": "8.8.8.8",
"ports": [
53,
443
],
"tags": [],
"vulns": []
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
ip | path segment | Required | The IPv4 address to look up. IPv6 is not supported, and the endpoint takes no query parameters. 8.8.8.8 |
Response fields
ipstring- The address queried, echoed back.
portsarray- Open TCP ports observed during Shodan's most recent scan of the address.
hostnamesarray- Hostnames resolving to the address, from reverse DNS and TLS certificates. Can include stale or unrelated entries.
cpesarray- CPE identifiers for software Shodan fingerprinted, naming vendor, product and version.
vulnsarray- CVE identifiers associated with the detected software versions. These are inferred from banners, so they indicate a version known to be vulnerable, not a confirmed exploitable flaw.
tagsarray- Classification tags such as `cloud`, `cdn`, `vpn`, `honeypot` or `self-signed`.
What you can build with the Shodan InternetDB API
- Audit which ports are exposed on your own servers without running a scan
- Enrich a threat intelligence pipeline with passive exposure data
- Check whether a cloud IP is tagged as a known VPN, proxy or hosting range
- Feed an asset inventory with observed services and CPE identifiers
Common errors and how to fix them
404
Shodan has no record for that address.
Fix: Not an error condition — it usually means nothing is exposed, or the address has never been scanned. Treat it as an empty result.
429
Rate limited.
Fix: Keep to roughly one request per second and cache results. The scan data updates on the order of days, so aggressive polling gains nothing.
400
Malformed or non-IPv4 input.
Fix: Only IPv4 literals are accepted — no hostnames, no CIDR ranges and no IPv6.
Shodan InternetDB API — frequently asked questions
Is Shodan InternetDB free?
Yes, it is completely free with no API key and no Shodan account. It is a separate, simplified service from the main Shodan API, which does require a paid subscription.
How current is InternetDB data?
It reflects Shodan's most recent internet-wide scan of that address, which is days rather than seconds old. It is a snapshot, not a live port scan — recently opened services may be missing and recently closed ones may still appear.
Does listing a CVE mean the host is vulnerable?
Not necessarily. The `vulns` array is inferred from service banners and version strings, so it flags software versions publicly associated with those CVEs. Backported patches — common on Linux distributions — leave the banner unchanged, producing false positives.
Is it legal to look up someone else's IP address?
Querying InternetDB sends no traffic to the target at all — you are reading Shodan's existing scan data, which is the point of passive reconnaissance. Acting on what you find against systems you do not own is a separate question, and one you need authorisation for.
Tools that pair with this API
Port Number Lookup
Look up what a TCP or UDP port is used for — search 150+ common well-known and registered ports by number, service name or protocol. Instant and offline.
IP Address Validator
Validate lists of IPv4, IPv6 and CIDR entries with the exact failure reason per line — compressed ::, IPv4-mapped forms and prefixes included. Free.
CIDR to IP Range Converter
Convert CIDR notation like 192.168.1.0/26 into its first and last IP address and total address count. Handles many blocks at once, free and in-browser.
Shodan InternetDB is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.