Shodan constantly crawls the Internet and uses different timeframes to present the data depending on the website/ API that is used:
The main search engine (API /shodan/host/search, and /shodan/host/count) and IP lookups (API /shodan/host/{ip}) use a 30 day timeframe to present the data. I.e. they will show the most recent banner for an IP and port that was collected the past 30 days. This includes the websites: www.shodan.io, maps.shodan.io and images.shodan.io. Note that Shodan crawls the Internet at least once a week.
The historical IP lookups feature of the API provides data going back up to 90 days. Note that it returns at most 1,000 banners so if the IP has been frequently rescanned during the 90 days then the API will only return the most recent 1,000 banners.
The
historyflag for IP lookups used to be based on a database that stored the full history for every IP on the Internet. That meant that it could return data going back to potentially 2009 when Shodan first started collecting data. For several reasons we had to change the way that feature worked and decided to offer a 90 day timeframe instead, combined with Shodan Trends for long-term views of the data.
Shodan Trends is the only website and API that looks at multiple years of data. Trends has indexed data going back until 2017 and provides an interface to query for aggregate information. We also offer bulk data files for enterprise use cases that require historical access to all the raw data.
Shodan Monitor has its own timeframe different from the others as assets are rescanned multiple times per day. As a result, the Shodan Monitor dashboard only looks at data from the past 48 hours.
