Shodan scans you without you noticing

Article by Nacata Security, 22/09/2026

Did you know someone can map your network without sending you a single packet?

Shodan has been doing it for years, and now there is a complete guide to understanding it.

Most people believe their systems are safe if they haven’t done anything unusual. But Shodan indexes banners from across the internet without the target ever noticing.

Groups like APT41 and Volt Typhoon already use it to select victims before launching any attack. MITRE ATT&CK documents it as technique T1596.005, active and real.

Shodan doesn’t hack anything: it just listens to what devices broadcast.

When a server starts up, it announces who it is: its software, its version, sometimes the company’s domain. Shodan traverses every IP address on the planet, collects those announcements, and makes them searchable. You type a filter like port:3389 and within seconds you can see what services an organization has exposed. Without touching anything, without anyone noticing. The result is a recent snapshot, enough to build an attack map.

A result in Shodan is a lead, not a finding.

Here is the trap that catches novice analysts: seeing a list of CVEs and treating it as a real finding. Shodan warns that its associated vulnerabilities are unverified and may contain false positives. Debian and Red Hat patch without changing the announced version number, so an updated server may have been displaying a banner that looks vulnerable for years. Every CVE is a pending task.

Writing a report on an unverified vuln can cost you a client.

Shodan already knows what you haven’t looked at.

If there are services exposed in your infrastructure that shouldn’t be there, Shodan has them indexed before you discover them. The guide published this year explains exactly how to use the tool to find them first, before someone else does.

The legal line is clearer than it seems.

Searching Shodan is passive and legal: you query a third party’s index and the target never sees your request. What changes is when you connect to what you find. Accessing an exposed panel without authorization or running shodan scan against someone else’s infrastructure is unauthorized active access, a crime in most countries. In the United States it falls under the Computer Fraud and Abuse Act.

The free academic account includes what many students pay for without knowing it.

With a university email you get the academic upgrade at no cost: 100 query credits per month, 100 scan credits, access to Maps, Images, and the vuln filter on the web. Most students pay for a subscription without knowing this option exists.

The CLI turns Shodan into a real workflow.

Installing the client via pip and authenticating once opens up essential commands: count to size a search, host for a specific IP, download to save results to disk, and parse to extract fields as CSV. Using download instead of paginating avoids spending query credits twice on the same search.

Learn to read banners before memorizing filters.

Ten well-understood filters and the habit of verifying every banner before drawing any conclusions are worth more than any list of queries downloaded from the internet.

What would you find if you searched your own infrastructure on Shodan right now?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime