Shodan Alternatives: Search Engines and a Scan of Your Own Ports

Pick a preset and the scanner runs a TCP connect scan against the resolved IP:

• Common (17 ports): 21, 22, 23, 25, 53, 80, 110, 143, 443, 445, 3306, 3389, 5432, 6379, 8080, 8443, 27017.
• Web (8): 80, 443, 8080, 8443, 8000, 3000, 4000, 5000.
• Mail (7): 25, 110, 143, 465, 587, 993, 995.
• Database (7): 3306, 5432, 6379, 27017, 1433, 5984, 9200.

Open ports get a banner grab tuned per service: SSH and FTP greetings are read, SMTP gets EHLO, HTTP gets a HEAD request, Redis gets INFO. Product and version are parsed from the banner, matched against a CVE catalogue, and risky exposures are called out, such as Redis or MongoDB answering without authentication, Elasticsearch without a security plugin, or SMTP allowing VRFY/EXPN user enumeration. UDP is not scanned, and there is no custom port list.

Scan only hosts you own or have permission to test.

• It is a search engine. You can search its index for exposed services across the whole internet, not just your own hosts. We cannot search at all.
• Coverage. Shodan's weekly crawl sees your IP ranges without you asking, on far more ports than our four presets.
• Shodan Monitor. Watches your network ranges and sends notifications when something unexpected appears: 16 IPs on the $49 one-time Membership, 5,120 on the $69/month Freelancer plan.
• Vulnerability filter. The vuln search filter is available from the Small Business plan ($359/month).
• API. Every account gets a free API plan; API plans are limited to one request per second, with query and scan credits per month.

1. Run the scanner above on each public IP or hostname you run. It shows what answers now, including services you opened yesterday.
2. Look the same IPs up in Shodan. Anything Shodan lists that the scanner does not was either open when Shodan last crawled or sits outside our preset port groups; anything new in our scan may not be in Shodan yet.
3. Close what should not be public with a firewall allowlist, not by moving the service to a non-standard port.
4. After sign-up, add port monitors for the services that must stay up, so you hear about it when they stop answering.

Related checks: ping, traceroute, SSL checker for anything on 443, and technology detection for web stacks.

If you want what Shodan does, an index of the whole internet you can search, these are the closest alternatives. Prices are from each vendor's own pricing page, checked on 20 October 2026.

• Censys. Indexes hosts, services, domains and certificates. A free account gives basic visibility into standard ports and services. The paid tiers (Core, Adversary Investigation, Security Operations) are sold through sales, API access is included in all of them, and credit packages for platform actions start at $100.
• ZoomEye. A search engine for internet-connected devices. The free account allows 3,000 results a month and 5 result pages; API access on the free tier is paid for with ZoomEye points. Paid plans are billed yearly: Personal at $190 and Professional at $1,090, both shown as discounts from higher list prices. Extra results can be bought as points, from $10 for 10,000.
• Criminal IP. Asset search with IP risk scoring, open ports and CVE data. An account without a subscription uses a free membership with a small number of credits. Starter costs $99 a month, or $1,069 billed annually, with 10,000 IP lookups a month and access to all APIs.

All three, like Shodan, show you what was found when their scanners last passed. The tool above answers a narrower question, what your host exposes right now. For domain-centric data (DNS and WHOIS history) see our SecurityTrails page.