Shodan Update: August 2026

New

The new shodan.io. The redesigned website is now the main site. Highlights:
- redesigned Host page with color-coded CVE tags and a collapsible CVE list;
- interactive world maps you can click to narrow a search by region;
- an updated Advanced Search;
- a redesigned Download page;
- a sticky History view;
- a faster raw-data viewer;
- a rebuilt, shareable report image with a top-10 chart and city breakdowns;
- a much better mobile layout.
AI category on the Explore page. Browse exposed Ollama, LiteLLM, ComfyUI, Flowise, Langfuse, LibreChat, MLflow, llama.cpp, LocalAI and more.
Shodan Trends 3.x.
- CSV export of Explore charts.
- A new Tags category that shows how common tags like cloud, cdn and self-signed are.
- Cleaner rankings that merge product name variants.
- Long-running searches that no longer time out.
Model Context Protocol (MCP) detection. MCP servers are identified and tagged mcp.

More detail in certificate-expiry alerts. Network alert emails for expired SSL certificates now include the certificate details.

New protocols. KCodes NetUSB (TCP/33344) and Reolink Baichuan, the Reolink camera protocol (TCP/9000).
New malware tag. About 21 RATs, stealers and botnets moved from the c2 tag to a new malware tag, including AsyncRAT, DcRat, Quasar, ShadowPad and Vidar. If you have saved tag:c2 searches, review them.