Domain → subdomains → IPs → hand off to Netblock Watch. Bootstraps monitoring when you know your domain but not your CIDRs.
Target domainLocal · you supply
Only enumerate domains you are authorized to assess. Shodan’s DNS index covers observed records — subdomains that were never resolved externally will not appear here, and records may lag behind reality. Costs 1 Shodan query credit per Discover.
Domain recordsSourced · Shodan DNS
Subdomain
Type
Value
Last seen
Only A and AAAA records point at IPs you might own or lease. CNAME chains often route through third-party CDNs and SaaS — the ultimate IP is theirs, not yours. MX and TXT are shown for completeness. Shodan pages 100 records at a time; large domains are followed to a safe page limit.
Unique IPs discoveredSourced · Shodan DNS
IP
Seen as
Cloud
Ports
Vulns
Tags
InternetDB is Shodan’s free, keyless lookup: ports, vulns, tags per IP with no credit cost. A “cloud” tag means the IP belongs to a shared provider (AWS, Cloudflare, Google, Azure, Fastly, Akamai…) — you don’t own that IP, and monitoring it will alert on every other tenant’s changes. Cloud IPs are excluded from “Select non-cloud only” for that reason.
Send to Netblock Watch (Tool 50)Local · browser storage
Handoff writes to localStorage.ghost50_netblocks in this browser. Replace overwrites whatever Tool 50 has saved. Append merges with existing entries, deduplicated. Neither sends anything to Shodan or any other server — the write is local, and Tool 50 will pick it up the next time you open its tab.
GHOST — Grounded Handling Of Sourced Threat-intel · DEFEND ALWAYS
Shodan’s DNS coverage is not authoritative. Records the crawler never observed will not appear here. Verify ownership against your IPAM and DNS provider before monitoring or acting on any IP surfaced by this tool.