Skip to content
Shodan Book

Shodan Update: July 2026

New

  • Search your monitored assets in Shodan Monitor. Search across your monitored assets from inside Monitor and export the matching IPs.
  • Spot technology changes. The new cpe23_hash and http.components_hash fields change whenever a host’s technology stack changes, so changes are easy to see.
  • New protocols. ClickHouse native protocol (TCP/9000) and Windows CE Remote Display (CERDISP, TCP/987), which is also covered by ICS scanning.

Data & Coverage

  • More than 30 new AI/ML detections. Including Agno, Arize Phoenix, ClearML, Dagster, FastGPT, Helicone, Kubeflow, Label Studio, Langfuse, LangSmith, Letta, OpenHands, Promptfoo, RAGFlow, Ray, Streamlit, SuperAGI and Hermes Agent. SillyTavern, Big-AGI and AIClient2API are now tagged ai.
  • Enterprise products. SAP NetWeaver, GoAnywhere MFT, Apache Pulsar and AnyDesk are now identified.
  • Ransomware context. The ransomware_campaign field is now kept on verified vulnerabilities.
  • International page titles. HTTP titles with non-ASCII characters are now processed correctly.