Skip to content
Shodan Book

Shodan Update: October 2026

New

  • Post-quantum TLS detection. The new ssl.kex_groups field and pqc tag show which servers support post-quantum key exchange (X25519MLKEM768, ML-KEM).
  • Cipher suite data for hostname-based scans. The new ssl.ciphers field lists the ciphers a server accepts for each TLS version. Example: ssl.ciphers.name:RC4-SHA.
  • TCP/UDP stack fingerprints. New tcp.fp and udp.fp fields.
  • New protocols and parsers.
    • Language Server Protocol (lsp tag);
    • MPLS LDP (TCP/646);
    • Cisco SD-WAN vdaemon (TCP/23456);
    • Nokia CIMD2 SMS gateways (TCP/9971);
    • structured sip and l2tp fields;
    • beanstalkd (TCP/11300).
  • GitHub Advisories. GitHub Advisory Database (GHSA) data is now linked to CVEs in the vulnerability database.

Improved

  • Much better product identification.
    • About 20 million TR-069 home gateways are now identified by vendor.
    • DNS servers are identified from their version responses (BIND, PowerDNS, dnsmasq, Unbound, Knot, Microsoft DNS and others).
    • More IKE/VPN servers are identified.
    • RDP banners now report the Windows build.
    • Web technology detection now works on pages with non-ASCII text, which affected about 14% of HTTP banners.
  • Cleaner honeypot handling. Every service on a known honeypot IP is now tagged honeypot, and honeypots no longer pollute tags such as ics, iot or database.
  • Faster, more reliable API.
    • /dns/resolve and /dns/reverse handle large batches without timing out.
    • Downloading or paging beyond 10,000 results is more reliable.
    • Search is faster thanks to better caching.
    • Errors are clearer: 400 for bad queries, 503 for timeouts.
    • Domain lookups only use a query credit when they succeed and aren’t cached.
  • Fewer false “new service” alerts. Shodan Monitor checks an IP’s history before flagging a port as new.
  • Deeper domain monitoring. Shodan Monitor discovers up to 100,000 subdomains for large domains, faster than before.

Data & Coverage

  • New detections.
    • License plate reader cameras (alpr tag): Genetec, Nedap, Selea, Tattile and others.
    • WireGuard management UIs (vpn tag): wg-easy, Firezone, NetBird and others.
    • NVIDIA DCGM GPU exporters.
    • AI pentest tools Cairn and Strix.
  • More end-of-life tagging. eol-product now covers PHP, nginx and CouchDB.
  • More complete HTTPS and InternetDB data. HTTPS sites that require SNI and slow TLS hosts now return banners instead of being dropped. InternetDB data is fresher.