Domain-based Network Monitoring

Shodan Monitor lets you keep track of IPs based on a hostname or domain. This is especially helpful to monitor services that have been deployed to the cloud or environments where the IP is more likely to change over time.

To get started you can either use the website:

Or create the domain-based network monitor via the Shodan CLI:

$ shodan alert domain mydomain.com

You might have noticed that if you enter a domain (ex. shodan.io) then it adds a lot of IPs that don't resolve to that specific domain. This is because Shodan Monitor behaves differently depending on whether you added a specific hostname or whether you added a domain:

• If you add a domain (ex. shodan.io) then Monitor keeps track of all IPs within the zone. I.e. it includes all IPs belonging to subdomains (monitor.shodan.io, account.shodan.io, beta.shodan.io, ...).
• If you add a specific hostname (ex. monitor.shodan.io) then Monitor will only keep track of the IPs that belong to that hostname.

Monitor uses the Shodan DNSDB to discover subdomains that should get monitored. We've curated this data over the past decade and are using it for our monthly hostname-based scans of the Internet. Shodan currently keeps track of a few billion hostnames in DNS DB.

Frequently Asked Questions

How often is the DNS data updated?

Every 3 hours the DNS information is refreshed for monitored hostnames/ domains.

If I monitor a specific hostname that isn't yet in DNS DB will it get added?

No, we don't use information you provide for the purpose of network monitoring to improve our products. Your activity on Shodan doesn't affect how Shodan crawls the Internet.