Requests reach Shodan through your Ghost Worker, which injects the API key server-side. The key never enters this page.
Ghost Worker URL
1Region
Scope is built from this dropdown, never typed. Typing a bare state code into a Shodan query makes it a banner text search, not a location filter.
CISA Region
Members are scoped with region:. Shodan documents both state: and region: as location filters, but only region: resolves US state codes in practice — verified against this account on 2026-08-11. state: is not used anywhere in this tool. Re-run Verify location filter if results ever look nationally-sized.
2Device
Pick the match mode deliberately. Shodan's product: field is an exact-string match against its own fingerprint catalogue — software it does not fingerprint returns a legitimate zero even when thousands of hosts are visible.
Match mode
Search term
Common ports
City (optional)
ASN (optional)
Org-name keyword (optional)
Raw extra filters (optional)
Org keyword is not a sector taxonomy — it matches the organisation name via org:"…", which is netblock registration. CIDR scoping is deliberately absent: a netblock does not belong to a region, so pairing them would produce a figure that looks regional and is not. Use Tool 50 for netblocks.
3Run
One query per region member, paced at 1.1s to stay inside Shodan's rate limit. The /shodan/host/count endpoint returns totals and facets without consuming query credits.
4Results
5Findings
Individual hosts Shodan has on record, with the location it assigns them. This stage uses /shodan/host/search, which returns host records and does consume query credits — one per member, per page. The roll-up above stays free; this is the part you pay for.
Hosts per member
Filter rows (IP, org, city, product)
Shodan's city, region and coordinates are IP geolocation, resolved from the netblock — not a street address and not the device's physical site. For a carrier or hosting netblock it commonly resolves to the provider's registered city, which can be a different state from the equipment. Treat it as a lead, confirm against your own IPAM before notifying anyone.
6Notification targets
Groups the findings above by inferred owner so one notification covers every exposed host that party operates, rather than one message per IP. Attribution is tiered and every row states which tier it came from — that distinction is the difference between contacting an operator and contacting their upstream carrier.
Three signals, in descending confidence. CERT — a TLS certificate subject names who requested it; the strongest identification available without contacting anyone. RDNS — reverse DNS names who the address was delegated to; carrier-owned rDNS is discarded rather than counted. REG — netblock registration only, which for a small operator behind a carrier identifies the carrier. A REG row is not an owner: it is an abuse desk that may be able to forward.
Before notifying: an abuse contact is a routing address, not a verified owner, and RDAP data is self-reported by the registrant and often stale. Confirm the party operates the asset before describing a vulnerability to them — a misdirected notification discloses someone else’s exposure to a third party.
7Facet receipts
Top organisations and products reported by Shodan per member, summed across the region. These are the top 5 per member only — a partial view, not a ranked census. Org strings are netblock registration, which is who provides connectivity, not necessarily who operates the device.
Organisations
Products
8Query audit
Every query this tool sent, verbatim. Paste any one into Shodan and you get the same number. If a figure here cannot be reproduced, it should not be briefed.