{"schema_version":"newruntime-reader-dossiers-v1","type":"reader_dossier","id":"reader:shodan","slug":"shodan","name":"Shodan","kind":"scanner","kind_label":"Scanners & probes","operator":{"name":"Shodan","url":"https://www.shodan.io/"},"docs_url":null,"robots_tokens":[],"purpose":"Search engine for Internet-connected devices; its crawlers continuously query hosts and collect service banners for the Shodan index.","feeds":["security_scan","research"],"respects_robots":"unknown","robots_note":"No published opt-out or robots.txt policy found; scanner hosts reportedly use *.shodan.io hostnames (e.g. census.shodan.io).","verification":{"method":"reverse_dns","url":null},"why_it_matters":{"text":"Infrastructure scanning, not readership; exclude from audience counts.","kind":"new_runtime_interpretation"},"confidence":"medium","researched_at":"2026-10-23","sources":["https://help.shodan.io/the-basics/what-is-shodan","https://www.netify.ai/resources/hostnames/census.shodan.io"],"icon_url":"https://newruntime.com/readers/icons/shodan.png","matching":{"aliases":["shodan"],"rule":"Reduce each agent_days label to a token: for labels starting with Mozilla/ take the product after 'compatible;', else a versioned crawler token such as 'FooBot/1.0' (a truncated 'Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile' prefix logged before 23 Oct 2026 is PetalBot; anything else is unidentified-android, unidentified-linux-chrome or unidentified-browser); otherwise take the text before the first '/', '(' or ';' and drop a trailing ' token probe'. Lowercase it. A dossier owns the tokens in its aliases."},"observed_baseline":{"as_of":"2026-10-23T08:01:01.990Z","window_first_day":"2026-07-23","window_last_day":"2026-10-23","observed_days":93,"note":"Refreshed daily in production from the live aggregates (dated by as_of). For current numbers aggregate live_sources.history agent_days by matching.aliases.","total_requests":4,"first_seen":"2026-07-29T14:59:38.620Z","last_seen":"2026-10-21T17:26:36.457Z","days_active":4,"recency":"returning","categories":["scanner"],"label_variants":1,"journeys":null},"identity_note":"A family name is what a client claims in its user agent. It is verified only when its request came from the operator's published IP ranges or passed forward-confirmed reverse DNS, as reported per family in /crawler-journeys.json. Anyone can claim any name.","privacy":{"scope":"family-level aggregates only","ip_addresses":"not_output","raw_user_agents":"not_output (labels are sanitized; URLs inside them are redacted)","visitor_ids":"not_output","query_strings":"not_output"},"live_sources":{"history":"https://newruntime.com/bot-traffic-history.json","latest":"https://newruntime.com/bot-traffic-latest.json","machine_consumption":"https://newruntime.com/machine-consumption.json","crawler_journeys":"https://newruntime.com/crawler-journeys.json"},"routes":{"html":"https://newruntime.com/readers/shodan/","markdown":"https://newruntime.com/readers/shodan.md","json":"https://newruntime.com/readers/shodan.json","index":"https://newruntime.com/readers.json","index_html":"https://newruntime.com/readers/"}}