Shodan is turning 13 years old later this year and throughout that time we've kept an archive of all information we've ever seen. The regular search engine only shows recent information but we provide various methods for accessing Shodan's historical data:
- IP information page
- Command-line interface
- API
- Shodan Trends
The main Shodan website lets you view historical information for an IP using the History tab:
And then when you click on it you'll see a timeline of open ports:
Grey ports means that the port isn't currently open while blue ports means that the port is currently open. You can click on the hash:... links to find more services that have identical service information which is useful for tracking a service across dynamic IPs or otherwise pivoting off the service data.
The Shodan CLI has a command to lookup IP information called shodan host.
There are 2 options that are helpful for grabbing historical information:
- The
--historyflag ensures the CLI grabs the history of the IP. - The
--saveflag saves the resulting information in a file with a name ofIP.json.gz
For example, the following command will grab the history for the IP 34.252.247.49 and store the resulting data in the file 34.252.247.49.json.gz:
shodan host --history --save 34.252.247.49
Both the website and the CLI are entirely powered by the Shodan API if you want to access the historical data programmatically from within your own scripts (ex. creating a gif from the historical screenshots). If you're using the official Python library for Shodan then it's as simple as adding a history=True parameter to your IP lookups.
Finally, if you want to track large-scale changes across the Internet then we recommend checking out Shodan Trends. It lets you search across the history of the Internet to explore how technologies have changed over time. For example, the below chart shows how Vue.js adoption has increased over the past few years:
