Requests reach Shodan through your Ghost Worker, which injects the API key server-side. The key never enters this page.
Ghost Worker URL
1Region
Scope is built from this dropdown, never typed. Typing a bare state code into a Shodan query makes it a banner text search, not a location filter.
CISA Region
Location filter token
2Device
Pick the match mode deliberately. Shodan's product: field is an exact-string match against its own fingerprint catalogue — software it does not fingerprint returns a legitimate zero even when thousands of hosts are visible.
Match mode
Search term
Common ports
City (optional)
ASN (optional)
Org-name keyword (optional)
Raw extra filters (optional)
Org keyword is not a sector taxonomy — it matches the organisation name via org:"…", which is netblock registration. CIDR scoping is deliberately absent: a netblock does not belong to a region, so pairing them would produce a figure that looks regional and is not. Use Tool 50 for netblocks.
3Run
One query per region member, paced at 1.1s to stay inside Shodan's rate limit. The /shodan/host/count endpoint returns totals and facets without consuming query credits.
4Results
5Findings
Individual hosts Shodan has on record, with the location it assigns them. This stage uses /shodan/host/search, which returns host records and does consume query credits — one per member, per page. The roll-up above stays free; this is the part you pay for.
Hosts per member (max 100)
Filter rows (IP, org, city, product)
Shodan's city, region and coordinates are IP geolocation, resolved from the netblock — not a street address and not the device's physical site. For a carrier or hosting netblock it commonly resolves to the provider's registered city, which can be a different state from the equipment. Treat it as a lead, confirm against your own IPAM before notifying anyone.
6Facet receipts
Top organisations and products reported by Shodan per member, summed across the region. These are the top 5 per member only — a partial view, not a ranked census. Org strings are netblock registration, which is who provides connectivity, not necessarily who operates the device.
Organisations
Products
7Query audit
Every query this tool sent, verbatim. Paste any one into Shodan and you get the same number. If a figure here cannot be reproduced, it should not be briefed.