Skip to content
Shodan Book

Shodan Update: March 2026

New

  • New protocols. Gemini (gemini://, TCP/1965, with certificate details), RustDesk remote desktop (port 21116) and Fast Reverse Proxy (frp) servers (TCP/7000).
  • Citrix NetScaler version fingerprinting. About 238 known versions are recognized, with vulnerability tagging on top.
  • fields parameter for the search API. Return only the fields you need, for smaller and faster responses.

Data & Coverage

  • AI services (tagged ai). Open WebUI, NextChat, LM Studio, LiteLLM, LibreChat, KoboldCpp, Dify, BetterChatGPT and AstrBot.
  • More product fingerprints. Weaviate, Keycloak, Juniper Junos, Jaeger, Harbor, Gitea, Cisco Expressway and ArangoDB.
  • Conpot ICS honeypot detection. Detected from its web server and FTP responses.
  • TLS on non-standard ports. Services running TLS on unexpected ports are now detected automatically and collected as HTTPS.
  • More accurate CVE matching. The vulnerability database now stores NVD’s conditional logic, such as “vulnerable only when running on platform X”.