API Reference

Streaming API Documentation

The Streaming API is an HTTP-based service that returns a real-time stream of data collected by Shodan. The stream returns the information as a JSON-encoded string using 2 output formats that can be set using the "t" URL parameter:

  • json:Each item is separated by a newline. For example, the Banners stream returns 1 banner per line where the banner contains all of the data that was just collected for a given service on the Internet.
  • sse:Outputs the JSON data using the Server-Sent Events protocol, making it easy to consume directly in the browser.

Each method also supports an optional debug query parameter that adds a JSON object to the stream whenever messages are discarded. This can be helpful when debugging possible connection issues between the Streaming API servers and the client. Add debug=1 to the query URL and then a JSON object as follows gets included in the stream:

{
    "event": "debug",
    "discarded": 41
}
    

The base URL for all of these methods is:
https://stream.shodan.io
  

Data Streams Enterprise

GET/shodan/banners
Banners

This stream provides ALL of the data that Shodan collects. Use this stream if you need access to everything and/ or want to store your own Shodan database locally. If you only care about specific ports, please use the Ports stream.

Request URL
https://stream.shodan.io/shodan/banners?key={YOUR_API_KEY}
      

Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/banners?key={YOUR_API_KEY}"

          
Response
{
    "hash": 1015805840,
    "timestamp": "2021-01-28T04:16:08.387364",
    "hostnames": [
        "177-70-193-184-msltr-cw-1.visaonet.com.br"
    ],
    "org": "L M Tiko Kamide - Sva",
    "data": "SIP/2.0 404 Not Found\r\nFrom: ;tag=root\r\nTo: ;tag=b235f0-b146c1b8-13c4-50029-ec2e4-6c44dfcf-ec2e4\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nVia: SIP/2.0/UDP nm;received=224.238.62.40;rport=26810;branch=foo\r\nSupported: replaces,100rel,timer\r\nAccept: application/sdp\r\nAllow: INVITE,ACK,CANCEL,BYE,OPTIONS,REFER,INFO,NOTIFY,PRACK,MESSAGE\r\nContent-Length: 0\r\n\r\n",
    "port": 5060,
    "transport": "udp",
    "info": "SIP end point; Status: 404 Not Found",
    "isp": "L M Tiko Kamide - Sva",
    "asn": "AS28359",
    "location": {
        "country_code3": null,
        "city": "Jardim Alegre",
        "region_code": "PR",
        "postal_code": null,
        "longitude": -51.7213,
        "country_code": "BR",
        "latitude": -24.2123,
        "country_name": "Brazil",
        "area_code": null,
        "dma_code": null
    },
    "ip": 2974204344,
    "domains": [
        "visaonet.com.br"
    ],
    "ip_str": "177.70.193.184",
    "_id": "45ad6383-1b1d-4c5d-8584-d586fbdefbc3",
    "os": null,
    "_shodan": {
        "crawler": "bf213bc419cc8491376c12af31e32623c1b6f467",
        "options": {},
        "id": "220ef463-756f-4446-a89f-685053da8865",
        "module": "sip",
        "ptr": true
    },
    "opts": {}
}
{
    "hash": 999960243,
    "product": "nginx",
    "http": {
        "robots_hash": null,
        "redirects": [],
        "securitytxt": null,
        "title": "400 The plain HTTP request was sent to HTTPS port",
        "sitemap_hash": null,
        "robots": null,
        "server": "nginx",
        "host": "64.120.103.17",
        "html": "\r\n400 The plain HTTP request was sent to HTTPS port\r\n\r\n

400 Bad Request

\r\n
The plain HTTP request was sent to HTTPS port
\r\n
nginx
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n", "location": "/", "components": {}, "html_hash": 556516568, "sitemap": null, "securitytxt_hash": null }, "timestamp": "2021-01-28T04:16:07.200581", "hostnames": [], "org": "Leaseweb USA", "data": "HTTP/1.1 400 Bad Request\r\nServer: nginx\r\nDate: Thu, 28 Jan 2021 04:16:06 GMT\r\nContent-Type: text/html\r\nContent-Length: 666\r\nConnection: close\r\n\r\n", "port": 443, "transport": "tcp", "isp": "Leaseweb USA", "cpe23": [ "cpe:2.3:a:igor_sysoev:nginx" ], "cpe": [ "cpe:/a:igor_sysoev:nginx" ], "asn": "AS395954", "location": { "country_code3": null, "city": null, "region_code": null, "postal_code": null, "longitude": -97.822, "country_code": "US", "latitude": 37.751, "country_name": "United States", "area_code": null, "dma_code": null }, "ip": 1081632529, "domains": [], "ip_str": "64.120.103.17", "_id": "d4289648-469a-465d-abb7-2c62700a0ce6", "os": null, "_shodan": { "crawler": "6d64feef3c6422575abbbf34b1a2e0d9a29b812d", "options": {}, "id": "03a63049-a9dd-4194-8d99-9e342ade5089", "module": "auto", "ptr": true }, "opts": {} } ...
Request
$ shodan stream

          
Response
109.70.101.126	10443		HTTP/1.1 200 OK\r\nDate: Thu, 28 Jan 2021 04:19:19 GMT\r\nServer: xxxxxxxx-xxxxx\r\nVary: Accept-Encoding\r\nContent-Length: 79\r\nContent-Type: text/html; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Security-Policy: frame-ancestors 'self'\r\nX-XSS-Protection: 1; mode=block\r\nX-UA-Compatible: IE=Edge\r\n\r\n
198.1.94.209	2083	thehovercam.thehovercam.com	HTTP/1.1 401 Access Denied\r\nConnection: close\r\nContent-Type: text/html; charset="utf-8"\r\nDate: Thu, 28 Jan 2021 04:19:45 GMT\r\nSet-Cookie: cprelogin=no; HttpOnly; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; port=2083; secure\r\nSet-Cookie: cpsession=%3aKF7VjeDJlFfsEZ7y%2c19ed6a6b5dfd4383c6c1b334518bb6d7; HttpOnly; path=/; port=2083; secure\r\nSet-Cookie: roundcube_sessid=expired; HttpOnly; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; port=2083; secure\r\nSet-Cookie: Horde=expired; HttpOnly; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/horde; port=2083; secure\r\nSet-Cookie: PPA_ID=expired; HttpOnly; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; port=2083; secure\r\nSet-Cookie: imp_key=expired; HttpOnly; domain=198.1.94.209; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/horde; port=2083; secure\r\nSet-Cookie: key=expired; HttpOnly; domain=198.1.94.209; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/3rdparty/squirrelmail/; port=2083; secure\r\nSet-Cookie: SQMSESSID=expired; HttpOnly; domain=198.1.94.209; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; port=2083; secure\r\nCache-Control: no-cache, must-revalidate\r\nContent-Length: 42455\r\n\r\n
54.208.97.80	80	ec2-54-208-97-80.compute-1.amazonaws.com	HTTP/1.1 401 Unauthorized\r\nServer: nginx/1.10.3 (Ubuntu)\r\nDate: Thu, 28 Jan 2021 04:19:58 GMT\r\nContent-Type: text/html\r\nContent-Length: 606\r\nConnection: keep-alive\r\nWWW-Authenticate: Basic realm="Prometheus server authentication"\r\n\r\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.banners(raw=False, timeout=None):
    print(banner)
          
Response
{
    "hash": 1025854405,
    "product": "nginx",
    "http": {
        "robots_hash": None,
        "redirects": [],
        "securitytxt": None,
        "title": "没有找到站点",
        "sitemap_hash": None,
        "robots": None,
        "server": "nginx",
        "host": "45.32.85.231",
        "html": '\n\n\n\n没有找到站点\n\n\n\n\n\t
\n\t\t
没有找到站点
\n\t\t
\n\t\t\t

您的请求在Web服务器中没有找到对应的站点!

\n\t\t\t

可能原因:

\n\t\t\t
    \n\t\t\t\t
  1. 您没有将此域名或IP绑定到对应站点!
  2. \n\t\t\t\t
  3. 配置文件未生效!
  4. \n\t\t\t
\n\t\t\t

如何解决:

\n\t\t\t
    \n\t\t\t\t
  1. 检查是否已经绑定到对应站点,若确认已绑定,请尝试重载Web服务;
  2. \n\t\t\t\t
  3. 检查端口是否正确;
  4. \n\t\t\t\t
  5. 若您使用了CDN产品,请尝试清除CDN缓存;
  6. \n\t\t\t\t
  7. 普通网站访客,请联系网站管理员;
  8. \n\t\t\t
\n\t\t
\n\t
\n\n\n', "location": "/", "components": {}, "html_hash": 617769728, "sitemap": None, "securitytxt_hash": None, }, "tags": ["cloud"], "timestamp": "2021-01-28T04:23:43.750718", "cloud": {"region": None, "service": None, "provider": "Vultr"}, "hostnames": ["45.32.85.231.vultr.com"], "org": "Choopa, LLC", "data": 'HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Thu,28 Jan 2021 04: 23: 43 GMT\r\nContent-Type: text/html\r\nContent-Length: 1326\r\nLast-Modified: Wed,26 Apr 2017 08: 03: 47 GMT\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: "59005463-52e"\r\nAccept-Ranges: bytes\r\n\r\n', "port": 80, "cpe23": ["cpe:2.3:a:igor_sysoev:nginx"], "isp": "Choopa, LLC", "transport": "tcp", "cpe": ["cpe:/a:igor_sysoev:nginx"], "asn": "AS20473", "location": { "country_code3": None, "city": "Los Angeles", "region_code": "CA", "postal_code": None, "longitude": -118.2606, "country_code": "US", "latitude": 34.0729, "country_name": "United States", "area_code": None, "dma_code": 803, }, "ip": 757093863, "domains": ["vultr.com"], "ip_str": "45.32.85.231", "_id": "1f0c3474-d644-46b0-9981-b65b78ee1122", "os": None, "_shodan": { "crawler": "3ef1c9c3e19275ff8681372c71e65f4535fc5760", "options": {}, "id": "ae1c6bfd-31c5-47e4-8ae0-2e3fc07ef609", "module": "http", "ptr": True, }, "opts": {}, } { "hash": -170658834, "http": { "robots_hash": None, "redirects": [], "securitytxt": None, "title": "401 Unauthorized", "sitemap_hash": None, "robots": None, "server": None, "host": "37.152.229.10", "html": '\n\n 401 Unauthorized\n\n\n

401 Unauthorized

\n

\n\n\n', "location": "/", "components": {}, "html_hash": -1603531589, "sitemap": None, "securitytxt_hash": None, }, "timestamp": "2021-01-28T04:23:46.822454", "hostnames": [], "org": "Plusnet", "data": 'HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Digest realm="", qop="auth", nonce="903dc1d70fb04c9855ec9cb1c2f3f5a9:60123c50:199b94d5", opaque="0"\r\nContent-Type: text/html\r\nCache-Control: public\r\nPragma: cache\r\nExpires: Thu,28 Jan 2021 04: 23: 44 GMT\r\nDate: Thu,28 Jan 2021 04: 23: 44 GMT\r\nLast-Modified: Thu,08 Nov 2018 16: 22: 35 GMT\r\nAccept-Ranges: bytes\r\nConnection: close\r\n\r\n', "port": 4567, "transport": "tcp", "isp": "Plusnet", "asn": "AS6871", "location": { "country_code3": None, "city": "East Linton", "region_code": "SCT", "postal_code": None, "longitude": -2.6547, "country_code": "GB", "latitude": 55.9875, "country_name": "United Kingdom", "area_code": None, "dma_code": None, }, "ip": 630777098, "domains": [], "ip_str": "37.152.229.10", "_id": "0334876b-68d1-44b4-9cd9-0b0f8b119bd7", "os": None, "_shodan": { "crawler": "3ef1c9c3e19275ff8681372c71e65f4535fc5760", "options": {}, "id": "154e6d4a-263e-4fce-bc65-43138b063379", "module": "http-simple-new", "ptr": True, }, "opts": {}, } ...
GET/shodan/asn/{asn}
Filtered by ASN

This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in devices located in certain ASNs.

Request URL
https://stream.shodan.io/shodan/asn/{asn}?key={YOUR_API_KEY}
      
Parameters
  • asn: [String] Comma-separated list of ASNs; example "3303,32475"
Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/asn/3303,32475?key={YOUR_API_KEY}"

          
Response
{
    "hash": 1574478560,
    "http": {
        "robots_hash": null,
        "redirects": [],
        "securitytxt": null,
        "title": null,
        "sitemap_hash": null,
        "robots": null,
        "server": "LiteSpeed",
        "host": "96.127.186.100",
        "html": "",
        "location": "/",
        "html_hash": 0,
        "sitemap": null,
        "securitytxt_hash": null
    },
    "timestamp": "2021-01-28T04:29:02.206862",
    "hostnames": [
        "ams-pnode1.websitehostserver.net"
    ],
    "org": "SingleHop LLC",
    "data": "HTTP/1.0 301 Moved Permanently\r\nLocation: https://96.127.186.100/\r\nCache-Control: private, no-cache, max-age=0\r\nPragma: no-cache\r\nServer:LiteSpeed\r\nContent-Length: 0\r\nConnection: Close\r\n\r\n",
    "port": 443,
    "transport": "tcp",
    "isp": "SingleHop LLC",
    "asn": "AS32475",
    "location": {
        "country_code3": null,
        "city": null,
        "region_code": null,
        "postal_code": null,
        "longitude": -97.822,
        "country_code": "US",
        "latitude": 37.751,
        "country_name": "United States",
        "area_code": null,
        "dma_code": null
    },
    "ip": 1618983524,
    "domains": [
        "websitehostserver.net"
    ],
    "ip_str": "96.127.186.100",
    "_id": "97533624-bd22-46ce-9395-17ad28b304d6",
    "os": null,
    "_shodan": {
        "crawler": "6d64feef3c6422575abbbf34b1a2e0d9a29b812d",
        "options": {},
        "id": "1dbb01bb-5cd8-46b5-94d0-aee415b8c9ed",
        "module": "auto",
        "ptr": true
    },
    "opts": {}
}
{
    "hash": -1008615971,
    "product": "AkamaiGHost",
    "http": {
        "robots_hash": null,
        "redirects": [],
        "securitytxt": null,
        "title": "Invalid URL",
        "sitemap_hash": null,
        "robots": null,
        "server": "AkamaiGHost",
        "host": "104.66.169.60",
        "html": '...',
        "location": "/",
        "components": {},
        "html_hash": 1470236789,
        "sitemap": null,
        "securitytxt_hash": null,
    },
    "timestamp": "2021-01-28T04:29:01.265871",
    "hostnames": ["a104-66-169-60.deploy.static.akamaitechnologies.com"],
    "org": "Akamai Technologies",
    "data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 04:29:01 GMT\r\nDate: Thu, 28 Jan 2021 04:29:01 GMT\r\nConnection: close\r\n\r\n",
    "port": 80,
    "transport": "tcp",
    "info": "Akamai's HTTP Acceleration & Mirror service",
    "isp": "Akamai Technologies",
    "asn": "AS3303",
    "location": {
        "country_code3": null,
        "city": "Zurich",
        "region_code": "ZH",
        "postal_code": null,
        "longitude": 8.5394,
        "country_code": "CH",
        "latitude": 47.3624,
        "country_name": "Switzerland",
        "area_code": null,
        "dma_code": null,
    },
    "ip": 1749199164,
    "domains": ["akamaitechnologies.com"],
    "ip_str": "104.66.169.60",
    "_id": "93aa0f66-a2fb-44bc-9b04-6488b776b915",
    "os": null,
    "_shodan": {
        "crawler": "530935e60964ee0af497843f10b63adf84a753e3",
        "options": {},
        "id": "81d22eeb-60e5-4937-93af-557fcd7c089e",
        "module": "http",
        "ptr": true,
    },
    "opts": {},
}
...
          
Request
$ shodan stream --asn 3303,32475

          
Response
108.178.33.110	465	nts.newtechservics.net	220-nts.newtechservics.net ESMTP Exim 4.93 #2 Wed, 27 Jan 2021 22:30:46 -0600 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n250-nts.newtechservics.net Hello 224.211.96.163 [224.211.96.163]\r\n250-SIZE 104857600\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-AUTH PLAIN LOGIN\r\n250 HELP\r\n
194.209.127.35	443		HTTP/1.1 400 Bad Request\r\nDate: Thu, 28 Jan 2021 04:30:55 GMT\r\nServer: Apache\r\nContent-Length: 362\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
198.91.83.212	587		220-so7.infinitysrv.com ESMTP Exim 4.93 #2 Wed, 27 Jan 2021 23:30:14 -0500 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n250-so7.infinitysrv.com Hello 224.102.202.156 [224.102.202.156]\r\n250-SIZE 52428800\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-STARTTLS\r\n250 HELP\r\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.asn(asn=['3303', '32475'], raw=False, timeout=None):
    print(banner)
          
Response
{
    "product": "OpenSSH",
    "hash": -1466980181,
    "timestamp": "2021-01-28T04:32:43.847222",
    "hostnames": ["198.69.174.178.static.wline.lns.sme.cust.swisscom.ch"],
    "ssh": {
        "hassh": "95bb891b9ee1c49ec74906ec70b53766",
        "fingerprint": "93:34:09:e1:83:8c:b9:14:24:f1:47:dc:87:db:d5:13",
        "mac": "hmac-sha2-256",
        "cipher": "aes128-ctr",
        "key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDIU zXYBIxlp9lna4xcY3WZou5L55r9rMgMDBYrDkg3y6V\nGLIQZUFo  nxZFq6Lwvl29G3jTZoFRTnZvuuJiHzM5iAqbVLPwjMglD1VBTGt M9SPL85T/ltBys\n/kBp0aOFmJ50MqBBpmJBoGxSRruIlrdeWrpomT3T4D3VvfE2iTtZr15GREN/829CX0D8cDe5FU8J\nL7FxCiY8jmKjCh3d5PCyflK7xV6vNiueUXVGwTM7SaqggOjIRWpLq x9FtfVSUhlPC61vEdqbwvO\ncmMCpYCX81chG/ARrbGwTKPKZpEpdGUJIsrqYRiNO47Wtqubu4qgwsAxNwfvpuTqRn6F\n",
        "kex": {
            "languages": [""],
            "server_host_key_algorithms": [
                "ssh-rsa",
                "ssh-dss",
                "ecdsa-sha2-nistp256",
                "ssh-ed25519",
            ],
            "encryption_algorithms": [
                "chacha20-poly1305@openssh.com",
                "aes256-gcm@openssh.com",
                "aes128-gcm@openssh.com",
                "aes256-ctr",
                "aes192-ctr",
                "aes128-ctr",
            ],
            "kex_follows": False,
            "unused": 0,
            "kex_algorithms": [
                "curve25519-sha256@libssh.org",
                "ecdh-sha2-nistp256",
                "ecdh-sha2-nistp384",
                "ecdh-sha2-nistp521",
                "diffie-hellman-group-exchange-sha256",
                "diffie-hellman-group-exchange-sha1",
                "diffie-hellman-group14-sha1",
                "diffie-hellman-group1-sha1",
            ],
            "compression_algorithms": ["none", "zlib@openssh.com"],
            "mac_algorithms": [
                "umac-128-etm@openssh.com",
                "hmac-sha2-256-etm@openssh.com",
                "hmac-sha2-512-etm@openssh.com",
                "umac-128@openssh.com",
                "hmac-sha2-256",
                "hmac-sha2-512",
            ],
        },
        "type": "ssh-rsa",
    },
    "org": "Swisscom",
    "data": "SSH-2.0-OpenSSH_6.6.1\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDIU zXYBIxlp9lna4xcY3WZou5L55r9rMgMDBYrDkg3y6V\nGLIQZUFo  nxZFq6Lwvl29G3jTZoFRTnZvuuJiHzM5iAqbVLPwjMglD1VBTGt M9SPL85T/ltBys\n/kBp0aOFmJ50MqBBpmJBoGxSRruIlrdeWrpomT3T4D3VvfE2iTtZr15GREN/829CX0D8cDe5FU8J\nL7FxCiY8jmKjCh3d5PCyflK7xV6vNiueUXVGwTM7SaqggOjIRWpLq x9FtfVSUhlPC61vEdqbwvO\ncmMCpYCX81chG/ARrbGwTKPKZpEpdGUJIsrqYRiNO47Wtqubu4qgwsAxNwfvpuTqRn6F\nFingerprint: 93:34:09:e1:83:8c:b9:14:24:f1:47:dc:87:db:d5:13\n\nKex Algorithms:\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tssh-dss\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes256-gcm@openssh.com\n\taes128-gcm@openssh.com\n\taes256-ctr\n\taes192-ctr\n\taes128-ctr\n\nMAC Algorithms:\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
    "port": 22,
    "cpe23": ["cpe:2.3:a:openbsd:openssh:6.6.1"],
    "info": "protocol 2.0",
    "isp": "Swisscom",
    "transport": "tcp",
    "cpe": ["cpe:/a:openbsd:openssh:6.6.1"],
    "asn": "AS3303",
    "version": "6.6.1",
    "location": {
        "country_code3": None,
        "city": "Rotkreuz",
        "region_code": "ZG",
        "postal_code": None,
        "longitude": 8.4237,
        "country_code": "CH",
        "latitude": 47.1412,
        "country_name": "Switzerland",
        "area_code": None,
        "dma_code": None,
    },
    "ip": 2997765574,
    "domains": ["swisscom.ch"],
    "ip_str": "178.174.69.198",
    "_id": "869b9926-ec14-4f8f-9874-958ac0f594e2",
    "os": None,
    "_shodan": {
        "crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
        "options": {},
        "id": "a25352e1-c6ee-4f16-9644-c5f0123b3c07",
        "module": "ssh",
        "ptr": True,
    },
    "opts": {},
}
{
    "ip": 2999022327,
    "hash": 1615177765,
    "timestamp": "2021-01-28T04:32:31.377469",
    "hostnames": ["247.114.193.178.dynamic.wline.res.cust.swisscom.ch"],
    "org": "Swisscom",
    "data": "NTP\nprotocolversion: 3\nstratum: 3\nleap: 0\nprecision: -19\nrootdelay: 0.0144958496094\nrootdisp: 0.0212249755859\nrefid: 3283747942\nreftime: 3820795962.41\npoll: 0\n\n",
    "port": 123,
    "transport": "udp",
    "isp": "Swisscom",
    "asn": "AS3303",
    "location": {
        "country_code3": None,
        "city": "Bedano",
        "region_code": "TI",
        "postal_code": None,
        "longitude": 8.9194,
        "country_code": "CH",
        "latitude": 46.0512,
        "country_name": "Switzerland",
        "area_code": None,
        "dma_code": None,
    },
    "ntp": {
        "root_delay": 0.014495849609375,
        "clock_offset": -0.16389727592468262,
        "precision": -19,
        "reftime": 1611807162.412037,
        "refid": 3283747942,
        "delay": 0.35701704025268555,
        "leap": 0,
        "version": 3,
        "root_dispersion": 0.0212249755859375,
        "stratum": 3,
        "poll": 0,
        "monlist": None,
    },
    "domains": ["swisscom.ch"],
    "ip_str": "178.193.114.247",
    "_id": "6948a7a3-b461-4085-beea-12a81054f0ea",
    "os": None,
    "_shodan": {
        "crawler": "6f55d367cbfc8dfe8f206264b1aea3853dd5b496",
        "options": {},
        "id": "027c411a-59aa-48ca-a87c-558ad6b39708",
        "module": "ntp",
        "ptr": True,
    },
    "opts": {
        "raw": "1c0300ed000003b60000056fc3ba0466e3bcb83a697b40f3e3bcbcdf04f9b000e3bcbcdf08b73d09e3bcbcdf08e0a83c",
        "ntp": {},
    },
}
...
          
GET/shodan/countries/{countries}
Filtered by Country

This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in devices located in certain countries.

Request URL
https://stream.shodan.io/shodan/countries/{countries}?key={YOUR_API_KEY}
      
Parameters
  • countries: [String] Comma-separated list of countries indicated by their 2 letter code; example "DE,US"
Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/countries/DE,US?key={YOUR_API_KEY}"

          
Response
{
    "hash": -947592388,
    "product": "Apache httpd",
    "http": {
        "robots_hash": null,
        "redirects": [],
        "securitytxt": null,
        "title": null,
        "sitemap_hash": null,
        "robots": null,
        "server": "Apache",
        "host": "50.63.119.180",
        "html": "\n\n\n
pageok
\n\n", "location": "/", "components": {}, "html_hash": -295716025, "sitemap": null, "securitytxt_hash": null }, "timestamp": "2021-01-28T04:37:03.375136", "hostnames": [ "ip-50-63-119-180.ip.secureserver.net" ], "org": "GoDaddy.com, LLC", "data": "HTTP/1.1 200 OK\r\nDate: Thu, 28 Jan 2021 04:36:59 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 26 Apr 2013 01:57:05 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 76\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n", "port": 80, "transport": "tcp", "isp": "GoDaddy.com, LLC", "cpe23": [ "cpe:2.3:a:apache:http_server" ], "cpe": [ "cpe:/a:apache:http_server" ], "asn": "AS26496", "location": { "country_code3": null, "city": null, "region_code": null, "postal_code": null, "longitude": -97.822, "country_code": "US", "latitude": 37.751, "country_name": "United States", "area_code": null, "dma_code": null }, "ip": 843020212, "domains": [ "secureserver.net" ], "ip_str": "50.63.119.180", "_id": "85efede2-0730-422c-9e50-bb78054c6d82", "os": null, "_shodan": { "crawler": "6d64feef3c6422575abbbf34b1a2e0d9a29b812d", "options": {}, "id": "e418aa3b-c938-4124-be79-1ae40eaec50c", "module": "auto", "ptr": true }, "opts": {} } { "hash": 561623480, "tags": [ "cloud" ], "timestamp": "2021-01-28T04:37:05.314514", "hostnames": [ "server-13-249-211-149.blr50.r.cloudfront.net" ], "org": "Amazon CloudFront", "data": "HTTP/1.1 400 Bad Request\r\nServer: CloudFront\r\nDate: Thu, 28 Jan 2021 04:37:05 GMT\r\nContent-Type: text/html\r\nContent-Length: 915\r\nConnection: close\r\nX-Cache: Error from cloudfront\r\nVia: 1.1 b5f6daf006d688b2f5eef74923ab8562.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: BLR50-C3\r\nX-Amz-Cf-Id: jxkyP17GNCKAKARB8a3XpoQBB2yCkyNFv16WnkukSV5z8Sm-vcNBiA==\r\n\r\n\n\nERROR: The request could not be satisfied\n\n

400 ERROR

\n

The request could not be satisfied.

\n
\nBad request.\nWe can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.\n
\nIf you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.\n
\n
\n
\nGenerated by cloudfront (CloudFront)\nRequest ID: jxkyP17GNCKAKARB8a3XpoQBB2yCkyNFv16WnkukSV5z8Sm-vcNBiA==\n
\n
\n
\n", "port": 443, "cloud": { "region": "GLOBAL", "service": "AMAZON", "provider": "Amazon" }, "isp": "Amazon CloudFront", "transport": "tcp", "asn": "AS16509", "location": { "country_code3": null, "city": null, "region_code": null, "postal_code": null, "longitude": -97.822, "country_code": "US", "latitude": 37.751, "country_name": "United States", "area_code": null, "dma_code": null }, "ip": 234476437, "domains": [ "cloudfront.net" ], "ip_str": "13.249.211.149", "_id": "da4400f5-e491-4b6b-a59d-87daa61f5a6f", "os": null, "_shodan": { "crawler": "cdd92e2d835a37d2798fa6c7105171f4d214012f", "options": {}, "id": "fccd014d-c1fb-4ccc-9608-c0f918994cd6", "module": "https", "ptr": true }, "opts": {} } ...
Request
$ shodan stream --countries DE,US

          
Response
104.119.235.104	443	a104-119-235-104.deploy.static.akamaitechnologies.com	HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 04:42:31 GMT\r\nDate: Thu, 28 Jan 2021 04:42:31 GMT\r\nConnection: close\r\n\r\n
94.217.105.167	5060	dslb-094-217-105-167.094.217.pools.vodafone-ip.de	SIP/2.0 404 Not Found\r\nVia: SIP/2.0/UDP nm;branch=foo;rport=26810;received=224.81.229.144\r\nFrom: ;tag=root\r\nTo: ;tag=264F54AE66322F72\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nUser-Agent: FRITZ!OS\r\nContent-Length: 0\r\n\r\n
217.245.253.62	5060	pd9f5fd3e.dip0.t-ipconnect.de	SIP/2.0 404 Not Found\r\nVia: SIP/2.0/UDP nm;branch=foo;rport=26810;received=224.233.255.101\r\nFrom: ;tag=root\r\nTo: ;tag=BE51C3DE7CA9410B\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nUser-Agent: FRITZ!OS\r\nContent-Length: 0\r\n\r\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.countries(countries=['DE', 'US'], raw=False, timeout=None):
    print(banner)
          
Response
{
    "hash": 1811259547,
    "product": "AkamaiGHost",
    "http": {
        "robots_hash": None,
        "redirects": [],
        "securitytxt": None,
        "title": "Invalid URL",
        "sitemap_hash": None,
        "robots": None,
        "server": "AkamaiGHost",
        "host": "104.65.171.116",
        "html": "...",
        "location": "/",
        "components": {},
        "html_hash": 519667384,
        "sitemap": None,
        "securitytxt_hash": None,
    },
    "timestamp": "2021-01-28T04: 48: 43.016220",
    "hostnames": [
        "a104-65-171-116.deploy.static.akamaitechnologies.com"
    ],
    "org": "Akamai Technologies",
    "data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu,28 Jan 2021 04: 48: 42 GMT\r\nDate: Thu,28 Jan 2021 04: 48: 42 GMT\r\nConnection: close\r\n\r\n",
    "port": 80,
    "transport": "tcp",
    "info": "Akamai's HTTP Acceleration & Mirror service",
    "isp": "Akamai Technologies",
    "asn": "AS16625",
    "location": {
        "country_code3": None,
        "city": "Seattle",
        "region_code": "WA",
        "postal_code": None,
        "longitude": -122.3412,
        "country_code": "US",
        "latitude": 47.6032,
        "country_name": "United States",
        "area_code": None,
        "dma_code": 819,
    },
    "ip": 1749134196,
    "domains": [
        "akamaitechnologies.com"
    ],
    "ip_str": "104.65.171.116",
    "_id": "55628ae0-4e44-4718-b54a-b111def82a1f",
    "os": None,
    "_shodan": {
        "crawler": "7c8a517854004745d56289900cdd23806e84f988",
        "options": {},
        "id": "62879cde-6746-4e74-92b9-4ae6bd262042",
        "module": "http",
        "ptr": True,
    },
    "opts": {},
}
{
    "hash": -1235910801,
    "timestamp": "2021-01-28T04: 48: 43.598569",
    "hostnames": [
        "dynamic-095-115-022-014.95.115.pool.telefonica.de"
    ],
    "org": "O2 Deutschland",
    "data": "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n",
    "port": 8089,
    "transport": "tcp",
    "isp": "O2 Deutschland",
    "asn": "AS6805",
    "location": {
        "country_code3": None,
        "city": "Munich",
        "region_code": "BY",
        "postal_code": None,
        "longitude": 11.5816,
        "country_code": "DE",
        "latitude": 48.1441,
        "country_name": "Germany",
        "area_code": None,
        "dma_code": None,
    },
    "ip": 1601377806,
    "domains": [
        "telefonica.de"
    ],
    "ip_str": "95.115.22.14",
    "_id": "07296d34-6421-45d9-9c39-a2f8054829b0",
    "os": None,
    "_shodan": {
        "crawler": "a63b71ce4b8ab943fe83502b265dc615867966e1",
        "options": {},
        "id": "46e37486-bf21-49b2-bd78-3e43693ff1f5",
        "module": "https-simple-new",
        "ptr": True,
    },
    "opts": {},
}
...
          
GET/shodan/ports/{ports}
Filtered by Ports

Only returns banner data for the list of specified ports. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in a specific list of ports.

Request URL
https://stream.shodan.io/shodan/ports/{ports}?key={YOUR_API_KEY}
      
Parameters
  • ports: [String] Comma-separated list of ports; example "22,443"
Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/ports/22,443?key={YOUR_API_KEY}"

          
Response
{
    "hash": 1592590585,
    "product": "AkamaiGHost",
    "http": {
        "robots_hash": null,
        "redirects": [],
        "securitytxt": null,
        "title": "Invalid URL",
        "sitemap_hash": null,
        "robots": null,
        "server": "AkamaiGHost",
        "host": "23.8.80.84",
        "html": "\nInvalid URL\n\n

Invalid URL

\nThe requested URL \"[no URL]\", is invalid.

\nReference #9.4ede3717.1611810347.6c0f8ec\n\n", "location": "/", "components": {}, "html_hash": 1809591553, "sitemap": null, "securitytxt_hash": null }, "timestamp": "2021-01-28T05:05:47.864200", "ssl": { "chain_sha256": [ "555a575d447769003b96bc6b6849ffecc710831ccf648082dbcb0a6e81f0037f", "14363822517e2989b087d0c9a42eef134a774bd0b2a0664d455af784bc08f4d0", "68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b", "d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4" ], "jarm": "2ad2ad0002ad2ad22c42d42d00000061cdb625ec378ec3fce160d347caef64", "chain": [ "-----BEGIN CERTIFICATE-----\nMIIRUTCCEDmgAwIBAgIRALPwTVpNEm50s5rtf/RAIEkwDQYJKoZIhvcNAQELBQAw\ngYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJERTETMBEGA1UEBxMKV2lsbWluZ3Rv\nbjEkMCIGA1UEChMbQ29ycG9yYXRpb24gU2VydmljZSBDb21wYW55MS8wLQYDVQQD\nEyZUcnVzdGVkIFNlY3VyZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgNTAeFw0yMTAx\nMTUwMDAwMDBaFw0yMjAyMTUyMzU5NTlaMIHNMQswCQYDVQQGEwJERTEOMAwGA1UE\nERMFNTEzNjgxHDAaBgNVBAgTE05vcmRyaGVpbi1XZXN0ZmFsZW4xEzARBgNVBAcT\nCkxldmVya3VzZW4xHzAdBgNVBAkTFkthaXNlci1XaWxoZWxtLUFsbGVlIDExETAP\nBgNVBAoTCEJheWVyIEFHMSUwIwYDVQQLExxCYXllciBCdXNpbmVzcyBTZXJ2aWNl\ncyBHbWJIMSAwHgYDVQQDExdwZnQuYmF5ZXJjcm9wc2NpZW5jZS51czCCASIwDQYJ\nKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuvlyHol6d+XOLgyI72qKzS3WDpfHM\nJ9eCiq7rI4fHipV7I6RvDhs798U0UycK4w+v7DpNeXfr3hp894gkPcTNPjmbSErJ\n5bEcBv+RSEESm1jlIYAtqLBjXgBA9U+MZbaKQWJ7YDtH3FkoCy/bNCQOxdMBV1yZ\ndjgVTDkOi8E+kOTJxq3gBXVAES7eEWMSuVPA83LbzQin6ceidxcw6z0XglFLvAy7\nk3IyCyRiWWF0p5nYY/Rl2hibggA92QYhcMKnvf6kgV9MHLCwx0GXeDYdEsyGAIN3\nm03e0RjtW2UOqSC9z+iQnr0KLak2Z9GoB3G17vL18CjYQYmOdlR1Af8CAwEAAaOC\nDW8wgg1rMB8GA1UdIwQYMBaAFPK7Ve78j8/QPxRoGpV+eQ6rFzD0MB0GA1UdDgQW\nBBS1flKkmb2EwtVxtskDDgInFOKkxDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/\nBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwSwYDVR0gBEQwQjA2\nBgsrBgEEAbIxAQICCDAnMCUGCCsGAQUFBwIBFhlodHRwczovL2Nwcy51c2VydHJ1\nc3QuY29tMAgGBmeBDAECAjBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3JsLnVz\nZXJ0cnVzdC5jb20vVHJ1c3RlZFNlY3VyZUNlcnRpZmljYXRlQXV0aG9yaXR5NS5j\ncmwwgYIGCCsGAQUFBwEBBHYwdDBLBggrBgEFBQcwAoY/aHR0cDovL2NydC51c2Vy\ndHJ1c3QuY29tL1RydXN0ZWRTZWN1cmVDZXJ0aWZpY2F0ZUF1dGhvcml0eTUuY3J0\nMCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMIIBAwYKKwYB\nBAHWeQIEAgSB9ASB8QDvAHUARqVV63X6kSAwtaKJafTzfREsQXS+/Um4havy/HD+\nbUcAAAF3BQIGoAAABAMARjBEAiBacIci5y5rHCvYBpZfgJYa5cnFsMa5/trVAM+/\nLOpD+QIgVqDXtTaNPwhp7EsXc85UJ/4Y3fGEZSOA5QwqAIsva8kAdgDfpV6raIJP\nH2yt7rhfTj5a6s2iEqRqXo47EsAgRFwqcwAAAXcFAgbHAAAEAwBHMEUCIFOxIiQV\n9pHAsBaRIKFJhaAde4Sw+VnjSl4ZZ6I9ZOEJAiEAkouFkWT/y6YdRsgoqf+mab9Z\ncY5jAXu2qeXMM8Ih6OYwggq/BgNVHREEggq2MIIKsoIXcGZ0LmJheWVyY3JvcHNj\naWVuY2UudXOCFWFkbWluLmhvdC1wb3RhdG9lcy5jYYIRYWdyby5iYXllci1jYS5j\nb22CGGFsdW1uaS55b3V0aGFnc3VtbWl0LmNvbYIQYXBpLmJheWVyd2ViLmNvbYIZ\nYXBwcG9ydGZvbGlvLmJheWVyLmNvbS5icoIUYXByZW5kZWNvbi5iYXllci5jb22C\nGGNyb3BzY2llbmNlLmJheWVyLmNvbS5hcoIVZW5tb3ZpbWllbnRvLmJheWVyLmVz\nghNmb2N1cy5iYXllci1hZ3JpLmZyghdncmFudHM0dHJhaXRzLmJheWVyLmNvbYIT\naW1hZ2ViYW5rLmJheWVyLmNvbYIaaW5mby5jcm9wc2NpZW5jZS5iYXllci5jb22C\nD2xlYXBzLmJheWVyLmNvbYIRbWF2ZXJpY2suYmF5ZXIudXOCI21kbXdlYnNlcnZp\nY2UuY3JvcHNjaWVuY2UuYmF5ZXIuY29tghdtZWxhbmdlc3B1YmxpYy5iYXllci5m\ncoIbbW9iaWxlYXBpLmJhY2tlZGJ5YmF5ZXIuY29tgidtb2JpbGVhcGkuZW52aXJv\nbm1lbnRhbHNjaWVuY2UuYmF5ZXIudXOCHG5ld3NsZXR0ZXIueW91dGhhZ3N1bW1p\ndC5jb22CDW5wcy5iYXllci5jb22CFnBoeXRvYmFjLmJheWVyLWFncmkuZnKCG3Bo\neXRvcHJvZ3Jlc3MuYmF5ZXItYWdyaS5mcoIvcGxhdGZvcm1hZHlzdHJ5YnVjeWpu\nYS5jcm9wc2NpZW5jZS5iYXllci5jb20ucGyCE3BvbnRvcy5iYXllci5jb20uYnKC\nJnBwbWxvZ2luLmVudmlyb25tZW50YWxzY2llbmNlLmJheWVyLnVzgh5wcm9kMi5j\ncm9wc2NpZW5jZS5iYXllci5jb20ucHmCHnByb2QyLmNyb3BzY2llbmNlLmJheWVy\nLmNvbS51eYITcHJvdGVjbWFpcy5iYXllci5mcoIYcHJvdmVlZG9yZXMuYmF5ZXIu\nY29tLm14ghZwdWJsaWNoZWFsdGguYmF5ZXIuY29tghlwdWJsaWNoZWFsdGhtYWcu\nYmF5ZXIuY29tghZzdGFnZS5hcGkuYmF5ZXJ3ZWIuY29tgh1zdGFnZS5iYXllcmNy\nb3BzY2llbmNlLmNvbS5hcoIdc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20uY2+C\nHXN0YWdlLmJheWVyY3JvcHNjaWVuY2UuY29tLmVjgh1zdGFnZS5iYXllcmNyb3Bz\nY2llbmNlLmNvbS5weYIdc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20udmWCF3N0\nYWdlLmJlamEuYmF5ZXJ3ZWIuY29tghhzdGFnZS5iaWNhbmFkYS5iYXllci5jb22C\nHHN0YWdlLmNpcmN1bG8xMy5iYXllci5jb20ubXiCHnN0YWdlLmNyb3BzY2llbmNl\nLmJheWVyLmNvbS5hcoIec3RhZ2UuY3JvcHNjaWVuY2UuYmF5ZXIuY29tLmJvgh5z\ndGFnZS5jcm9wc2NpZW5jZS5iYXllci5jb20ucHmCHnN0YWdlLmNyb3BzY2llbmNl\nLmJheWVyLmNvbS51eYISc3RhZ2UuZmVlZGFiZWUuY29tgilzdGFnZS5tZG13ZWJz\nZXJ2aWNlLmNyb3BzY2llbmNlLmJheWVyLmNvbYIcc3RhZ2UubWljdWx0aXZvLmJh\neWVyLmNvbS5teIIYc3RhZ2UubWlwb3J0YWwuYmF5ZXIuY29tgiFzdGFnZS5tb2Jp\nbGVhcGkuYmFja2VkYnliYXllci5jb22CHnN0YWdlLnByb3ZlZWRvcmVzLmJheWVy\nLmNvbS5teIIbc3RhZ2Uuc2FsdWRhbWJpZW50YWwuY29tLm14giVzdGFnZS5zZWVk\ndGFnLmJheWVyY3JvcHNjaWVuY2UudXMuY29tgixzdGFnZS5zdGV3YXJkc2hpcG10\nZy5iYXllcmNyb3BzY2llbmNlLnVzLmNvbYIQc3RhcmRsLmJheWVyLmNvbYISc3Rh\ncmRscWEuYmF5ZXIuY29tghBzdGFycWEuYmF5ZXIuY29tgiJzdGV3YXJkc2hpcC5i\nYXllcmNyb3BzY2llbmNldXMuY29tgiZzdGV3YXJkc2hpcG10Zy5iYXllcmNyb3Bz\nY2llbmNlLnVzLmNvbYIbc3prb2xlbmlhLmFncm8uYmF5ZXIuY29tLnBsgil0ZXN0\nLmJjc2ZpZWxkYmlkcy5iYXllcmNyb3BzY2llbmNlLnVzLmNvbYIjdGVzdC5kaWdp\ndGFsLW1hcmtldGluZy5jcy5iYXllci5jb22CF3Rlc3QuaW50LmFncmFyLmJheWVy\nLmRlghx0ZXN0Lm5ldC5teWJheWVyc2VydmljZXMuY29tghV0ZXN0LnBmdC5iYXll\ncndlYi5jb22CDXd3dy5iYXlkaXIuY2yCEXd3dy5iYXllci1hZ3JpLmZyght3d3cu\nYmF5ZXJjcm9wc2NpZW5jZS5jb20uYXKCFHd3dy5iYXllcnRvb2xib3guY29tghB3\nd3cuYmF5ZXhwZXJ0LmN6ghB3d3cuYmF5ZXhwZXJ0LnNrghB3d3cuYmF5cHJvZml0\nLmN6ghB3d3cuYmF5cHJvZml0LnNrgih3d3cuYmNzZmllbGRiaWRzLmJheWVyY3Jv\ncHNjaWVuY2UudXMuY29tgiZ3d3cuYnVsa3JlcGFjay5iYXllcmNyb3BzY2llbmNl\nLnVzLmNvbYIWd3d3LmNvbHR1cmFlY3VsdHVyYS5pdIIYd3d3LmNvdm9pdHVyYWdl\nLmJheWVyLmZyghh3d3cuY3JvcHNjaWVuY2UuYmF5ZXIuY2yCHHd3dy5jcm9wc2Np\nZW5jZS5iYXllci5jb20ucHmCHHd3dy5jcm9wc2NpZW5jZS5iYXllci5jb20udXmC\nGHd3dy5jcm9wc2NpZW5jZS5iYXllci5yb4IYd3d3LmNyb3BzY2llbmNlLmJheWVy\nLnNrgg93d3cuY3NhdmF6YXMuaHWCInd3dy5kaWdpdGFsLW1hcmtldGluZy5jcy5i\nYXllci5jb22CJnd3dy5rYXRhbG9ncmFzdGl0ZWxuYXphc2h0aXRhLmJheWVyLmJn\nghV3d3cubW9tZW50b3MuYmF5ZXIubXiCHnd3dy5tb25pdG9yYWdnaW9jb2NjaW5p\nZ2xpYS5pdIIYd3d3Lm1vbm9ncmFmaWFzLmJheWVyLm14ghZ3d3cubXliYXllcmFj\nY291bnQuY29tghd3d3cubXliYXllcnNlcnZpY2VzLmNvbYIed3d3LnByb3RlY2Np\nb25hbWJpZW50YWwuY29tLmFyghx3d3cucHJvdmVlZG9yZXMuYmF5ZXIuY29tLm14\ngh13d3cucHVibGljaGVhbHRobWFnLmJheWVyLmNvbYIWd3d3LnNtYXJ0YWdyby5i\nYXllci5lY4Ihd3d3LnN0YWdlLmJheWVyY3JvcHNjaWVuY2UuY29tLmFygiF3d3cu\nc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20udXmCFnd3dy50YXJpbS5iYXllci5j\nb20udHKCGnd3dy54bi0taDFhcGVoMWMueG4tLXAxYWNmMA0GCSqGSIb3DQEBCwUA\nA4IBAQA2mZ24FH7gy30Qjilz+YfzA+F2cmVUR+oPQZQ7iE+cWaMy3iDp8KCIlYx0\neaPVk7dggAA9smSwklA/K6+iKN1D6746CWQ5GByQX+5Wzm+rWqslhPj1izU4H+6R\nBqyX/QQ8lMcFYVcFSH6zTqPC5N7SOh9e60Kgps5kDTAWFYOhNcnZHT3eMobq90qY\n6RT26wWIUvIQjbnETAKO8mJYO/WwVJcRBXWP05uY/THV5MpHFx4xn2Tzc5KrZxJO\naTR2X2bzdgNAYKxk0j/duzulekB32vnPfYL5J9oatvkv28aiczOcZjq+UzyrWSjO\nfVvWpv/iYwvgQ3gOxP5FkRI2masF\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIGEjCCA/qgAwIBAgIRAPeCIneztajhC2LD+k4K+RwwDQYJKoZIhvcNAQEMBQAw\ngYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK\nZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD\nVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0\nMDkxMDAwMDAwMFoXDTI0MDkwOTIzNTk1OVowgYYxCzAJBgNVBAYTAlVTMQswCQYD\nVQQIEwJERTETMBEGA1UEBxMKV2lsbWluZ3RvbjEkMCIGA1UEChMbQ29ycG9yYXRp\nb24gU2VydmljZSBDb21wYW55MS8wLQYDVQQDEyZUcnVzdGVkIFNlY3VyZSBDZXJ0\naWZpY2F0ZSBBdXRob3JpdHkgNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\nggEBAI0GNgsj2QI1JOdYk8aNg/0JtkcQDJ8oVyVm1qosht+fd7UJuxnE+cfbrEiV\nheNHkCTUSAgHNYPAtMvTRpTW5SoXp5ywE9vstT+QEyTCh9hXe/Ix+9rHKaYiRV+H\nvfJapC9UmXHFP0V/eQPMRcS6kFjY/kLgGkpy/NmBblvAfw+BIqW7u1l+lxkJ9qOu\nSzcetveuGLsuekM9cc0bzChx5W3lc0kAbX/1KKiaByk/oMf3qHFkDf9q2KfrpY9A\n/KE4hgLdTC5hKrQrehazl7b+Epmx8G2MvsK28Vl7m1QD35vxtKHHiuDNOQdF5Ct4\nJtXfi2Kuzi1Q6bEVQymayy1DjwcCAwEAAaOCAXUwggFxMB8GA1UdIwQYMBaAFFN5\nv1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBTyu1Xu/I/P0D8UaBqVfnkOqxcw\n9DAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAU\nBggrBgEFBQcDAQYIKwYBBQUHAwIwIgYDVR0gBBswGTANBgsrBgEEAbIxAQICCDAI\nBgZngQwBAgIwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu\nY29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsG\nAQUFBwEBBGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29t\nL1VTRVJUcnVzdFJTQUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8v\nb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBDAUAA4ICAQAGsUdhGf+feSte\n4SOKj+2XtTfw4uo5t21lm1kXoRPM/ObB8yzzuVscvwnZ8Dn8PXjQXlP3ycqtc91X\ng4i63y48TUjsrK1/d6IvWAuzMN7tkEzVbBVFWlZz9jxYMmeGhrZ5HFOIjYJRRduQ\n4jTYZFjX+cm5b8baZuS43nRqsYGARFYlsxIzUGSOITM6W0QZ7s15p6Nh7nRMGR/g\nm2qShUIzj2RDEz2XXDDTsVT9NnN7b2WhbBMmsXRxY7ERL/oZ6sZLzz7g0tdP/fOx\ngeY+CWp891EqIxQLd5HYdIyGXesILMu8EaX9zMY76kbahJ0HKL//f0+S2SKDaYe7\n6APSyu1jqjfEUeaBSlPlvP5pXbygHjr/gQDVPyFzre6+Di+qZSIvcWuqo/jV2jJk\nIxd1rieFcsdkepYyAPC5GxNzHg0eWG9N669bnSxpvVDvmEl6ztbp7gxM3ciisBQz\nOLApig0V1N+0+YUXUq5f/0lenGZ9cqN3cs0/8ClTp1p3o84ErzFhjWQCIaBTODTS\nhYvB1+z6Hf2ljqD50KHs/80KO4mQBsPZjod8rQQa2KP0W3yvCBR6Z7ZUKTGGB0FV\nQ29vl2FmGkHV80dWIIgWzkU6ajnQXygkTr46jKxNXqT+G5+FaY79d0Vpf9XNg+m1\nKw/4P1yG/5xtH6HrU2uqz3qOmM4yWg==\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIFgTCCBGmgAwIBAgIQOXJEOvkit1HX02wQ3TE1lTANBgkqhkiG9w0BAQwFADB7\nMQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD\nVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE\nAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDMxMjAwMDAwMFoXDTI4\nMTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5\nMRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO\nZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0\naG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sI\ns9CsVw127c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnG\nvDoZtF+mvX2do2NCtnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQ\nIjy8/hPwhxR79uQfjtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfb\nIWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0\ntyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97E\nxwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNV\nicQNwZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5\nD9kCnusSTJV882sFqV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJ\nWBp/kjbmUZIO8yZ9HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ\n5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzG\nKAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaOB8jCB7zAfBgNVHSMEGDAWgBSg\nEQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rID\nZsswDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAG\nBgRVHSAAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29t\nL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggr\nBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUA\nA4IBAQAYh1HcdCE9nIrgJ7cz0C7M7PDmy14R3iJvm3WOnnL+5Nb+qh+cli3vA0p+\nrvSNb3I8QzvAP+u431yqqcau8vzY7qN7Q/aGNnwU4M309z/+3ri0ivCRlv79Q2R+\n/czSAaF9ffgZGclCKxO/WIu6pKJmBHaIkU4MiRTOok3JMrO66BQavHHxW/BBC5gA\nCiIDEOUMsfnNkjcZ7Tvx5Dq2+UUTJnWvu6rvP3t3O9LEApE9GQDTF1w52z97GA1F\nzZOFli9d31kWTz9RvdVFGD/tSo7oBmF0Ixa1DVBzJ0RHfxBdiSprhTEUxOipakyA\nvGp4z7h/jnZymQyd/teRCBaho1+V\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb\nMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow\nGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj\nYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL\nMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE\nBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM\nGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua\nBtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe\n3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4\nYgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR\nrOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm\nez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU\noBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF\nMAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v\nQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t\nb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF\nAAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q\nGE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz\nRt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2\nG9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi\nl2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3\nsmPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==\n-----END CERTIFICATE-----\n" ], "dhparams": null, "versions": [ "TLSv1", "-SSLv2", "-SSLv3", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "acceptable_cas": [], "tlsext": [ { "id": 65281, "name": "renegotiation_info" }, { "id": 11, "name": "ec_point_formats" }, { "id": 35, "name": "session_ticket" } ], "ja3s": "e35df3e00ca4ef31d42b34bebaa2f86e", "cert": { "sig_alg": "sha256WithRSAEncryption", "issued": "20210115000000Z", "expires": "20220215235959Z", "expired": false, "version": 2, "extensions": [ { "data": "0\\x16\\x80\\x14\\xf2\\xbbU\\xee\\xfc\\x8f\\xcf\\xd0?\\x14h\\x1a\\x95~y\\x0e\\xab\\x170\\xf4", "name": "authorityKeyIdentifier" }, { "data": "\\x04\\x14\\xb5~R\\xa4\\x99\\xbd\\x84\\xc2\\xd5q\\xb6\\xc9\\x03\\x0e\\x02\\'\\x14\\xe2\\xa4\\xc4", "name": "subjectKeyIdentifier" }, { "critical": true, "data": "\\x03\\x02\\x05\\xa0", "name": "keyUsage" }, { "critical": true, "data": "0\\x00", "name": "basicConstraints" }, { "data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02", "name": "extendedKeyUsage" }, { "data": "0B06\\x06\\x0b+\\x06\\x01\\x04\\x01\\xb21\\x01\\x02\\x02\\x080\\'0%\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x19https://cps.usertrust.com0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x02", "name": "certificatePolicies" }, { "data": "0G0E\\xa0C\\xa0A\\x86?http://crl.usertrust.com/TrustedSecureCertificateAuthority5.crl", "name": "crlDistributionPoints" }, { "data": "0t0K\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86?http://crt.usertrust.com/TrustedSecureCertificateAuthority5.crt0%\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x19http://ocsp.usertrust.com", "name": "authorityInfoAccess" }, { "data": "\\x04\\x81\\xf1\\x00\\xef\\x00u\\x00F\\xa5U\\xebu\\xfa\\x91 0\\xb5\\xa2\\x89i\\xf4\\xf3}\\x11,At\\xbe\\xfdI\\xb8\\x85\\xab\\xf2\\xfcp\\xfemG\\x00\\x00\\x01w\\x05\\x02\\x06\\xa0\\x00\\x00\\x04\\x03\\x00F0D\\x02 Zp\\x87\"\\xe7.k\\x1c+\\xd8\\x06\\x96_\\x80\\x96\\x1a\\xe5\\xc9\\xc5\\xb0\\xc6\\xb9\\xfe\\xda\\xd5\\x00\\xcf\\xbf,\\xeaC\\xf9\\x02 V\\xa0\\xd7\\xb56\\x8d?\\x08i\\xecK\\x17s\\xceT\\'\\xfe\\x18\\xdd\\xf1\\x84e#\\x80\\xe5\\x0c*\\x00\\x8b/k\\xc9\\x00v\\x00\\xdf\\xa5^\\xabh\\x82O\\x1fl\\xad\\xee\\xb8_N>Z\\xea\\xcd\\xa2\\x12\\xa4j^\\x8e;\\x12\\xc0 D\\\\*s\\x00\\x00\\x01w\\x05\\x02\\x06\\xc7\\x00\\x00\\x04\\x03\\x00G0E\\x02 S\\xb1\"$\\x15\\xf6\\x91\\xc0\\xb0\\x16\\x91 \\xa1I\\x85\\xa0\\x1d{\\x84\\xb0\\xf9Y\\xe3J^\\x19g\\xa2=d\\xe1\\t\\x02!\\x00\\x92\\x8b\\x85\\x91d\\xff\\xcb\\xa6\\x1dF\\xc8(\\xa9\\xff\\xa6i\\xbfYq\\x8ec\\x01{\\xb6\\xa9\\xe5\\xcc3\\xc2!\\xe8\\xe6", "name": "ct_precert_scts" }, { "data": "0\\x82\\n\\xb2\\x82\\x17pft.bayercropscience.us\\x82\\x15admin.hot-potatoes.ca\\x82\\x11agro.bayer-ca.com\\x82\\x18alumni.youthagsummit.com\\x82\\x10api.bayerweb.com\\x82\\x19appportfolio.bayer.com.br\\x82\\x14aprendecon.bayer.com\\x82\\x18cropscience.bayer.com.ar\\x82\\x15enmovimiento.bayer.es\\x82\\x13focus.bayer-agri.fr\\x82\\x17grants4traits.bayer.com\\x82\\x13imagebank.bayer.com\\x82\\x1ainfo.cropscience.bayer.com\\x82\\x0fleaps.bayer.com\\x82\\x11maverick.bayer.us\\x82#mdmwebservice.cropscience.bayer.com\\x82\\x17melangespublic.bayer.fr\\x82\\x1bmobileapi.backedbybayer.com\\x82\\'mobileapi.environmentalscience.bayer.us\\x82\\x1cnewsletter.youthagsummit.com\\x82\\rnps.bayer.com\\x82\\x16phytobac.bayer-agri.fr\\x82\\x1bphytoprogress.bayer-agri.fr\\x82/platformadystrybucyjna.cropscience.bayer.com.pl\\x82\\x13pontos.bayer.com.br\\x82&ppmlogin.environmentalscience.bayer.us\\x82\\x1eprod2.cropscience.bayer.com.py\\x82\\x1eprod2.cropscience.bayer.com.uy\\x82\\x13protecmais.bayer.fr\\x82\\x18proveedores.bayer.com.mx\\x82\\x16publichealth.bayer.com\\x82\\x19publichealthmag.bayer.com\\x82\\x16stage.api.bayerweb.com\\x82\\x1dstage.bayercropscience.com.ar\\x82\\x1dstage.bayercropscience.com.co\\x82\\x1dstage.bayercropscience.com.ec\\x82\\x1dstage.bayercropscience.com.py\\x82\\x1dstage.bayercropscience.com.ve\\x82\\x17stage.beja.bayerweb.com\\x82\\x18stage.bicanada.bayer.com\\x82\\x1cstage.circulo13.bayer.com.mx\\x82\\x1estage.cropscience.bayer.com.ar\\x82\\x1estage.cropscience.bayer.com.bo\\x82\\x1estage.cropscience.bayer.com.py\\x82\\x1estage.cropscience.bayer.com.uy\\x82\\x12stage.feedabee.com\\x82)stage.mdmwebservice.cropscience.bayer.com\\x82\\x1cstage.micultivo.bayer.com.mx\\x82\\x18stage.miportal.bayer.com\\x82!stage.mobileapi.backedbybayer.com\\x82\\x1estage.proveedores.bayer.com.mx\\x82\\x1bstage.saludambiental.com.mx\\x82%stage.seedtag.bayercropscience.us.com\\x82,stage.stewardshipmtg.bayercropscience.us.com\\x82\\x10stardl.bayer.com\\x82\\x12stardlqa.bayer.com\\x82\\x10starqa.bayer.com\\x82\"stewardship.bayercropscienceus.com\\x82&stewardshipmtg.bayercropscience.us.com\\x82\\x1bszkolenia.agro.bayer.com.pl\\x82)test.bcsfieldbids.bayercropscience.us.com\\x82#test.digital-marketing.cs.bayer.com\\x82\\x17test.int.agrar.bayer.de\\x82\\x1ctest.net.mybayerservices.com\\x82\\x15test.pft.bayerweb.com\\x82\\rwww.baydir.cl\\x82\\x11www.bayer-agri.fr\\x82\\x1bwww.bayercropscience.com.ar\\x82\\x14www.bayertoolbox.com\\x82\\x10www.bayexpert.cz\\x82\\x10www.bayexpert.sk\\x82\\x10www.bayprofit.cz\\x82\\x10www.bayprofit.sk\\x82(www.bcsfieldbids.bayercropscience.us.com\\x82&www.bulkrepack.bayercropscience.us.com\\x82\\x16www.colturaecultura.it\\x82\\x18www.covoiturage.bayer.fr\\x82\\x18www.cropscience.bayer.cl\\x82\\x1cwww.cropscience.bayer.com.py\\x82\\x1cwww.cropscience.bayer.com.uy\\x82\\x18www.cropscience.bayer.ro\\x82\\x18www.cropscience.bayer.sk\\x82\\x0fwww.csavazas.hu\\x82\"www.digital-marketing.cs.bayer.com\\x82&www.katalograstitelnazashtita.bayer.bg\\x82\\x15www.momentos.bayer.mx\\x82\\x1ewww.monitoraggiococciniglia.it\\x82\\x18www.monografias.bayer.mx\\x82\\x16www.mybayeraccount.com\\x82\\x17www.mybayerservices.com\\x82\\x1ewww.proteccionambiental.com.ar\\x82\\x1cwww.proveedores.bayer.com.mx\\x82\\x1dwww.publichealthmag.bayer.com\\x82\\x16www.smartagro.bayer.ec\\x82!www.stage.bayercropscience.com.ar\\x82!www.stage.bayercropscience.com.uy\\x82\\x16www.tarim.bayer.com.tr\\x82\\x1awww.xn--h1apeh1c.xn--p1acf", "name": "subjectAltName" } ], "fingerprint": { "sha256": "555a575d447769003b96bc6b6849ffecc710831ccf648082dbcb0a6e81f0037f", "sha1": "39c0a00060c1a0df4b9dea017c8d87950fe0250a" }, "serial": 2.3917953139147504e+38, "subject": { "C": "DE", "CN": "pft.bayercropscience.us", "L": "Leverkusen", "O": "Bayer AG", "ST": "Nordrhein-Westfalen", "street": "Kaiser-Wilhelm-Allee 1", "postalCode": "51368", "OU": "Bayer Business Services GmbH" }, "pubkey": { "type": "rsa", "bits": 2048 }, "issuer": { "C": "US", "L": "Wilmington", "CN": "Trusted Secure Certificate Authority 5", "O": "Corporation Service Company", "ST": "DE" } }, "cipher": { "version": "TLSv1/SSLv3", "bits": 256, "name": "ECDHE-RSA-AES256-GCM-SHA384" }, "trust": { "revoked": false, "browser": { "mozilla": true, "apple": true, "microsoft": true } }, "alpn": [ "http/1.1", "http/1.0" ], "ocsp": {} }, "hostnames": [ "a23-8-80-84.deploy.static.akamaitechnologies.com" ], "org": "Akamai Technologies", "data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 05:05:47 GMT\r\nDate: Thu, 28 Jan 2021 05:05:47 GMT\r\nConnection: close\r\n\r\n", "port": 443, "transport": "tcp", "info": "Akamai's HTTP Acceleration & Mirror service", "isp": "Akamai Technologies", "asn": "AS16625", "location": { "country_code3": null, "city": "Adelaide", "region_code": "SA", "postal_code": null, "longitude": 138.6005, "country_code": "AU", "latitude": -34.9274, "country_name": "Australia", "area_code": null, "dma_code": null }, "ip": 386420820, "domains": [ "akamaitechnologies.com" ], "ip_str": "23.8.80.84", "_id": "95d23749-3a9f-40fb-aa32-5e64fe763da7", "os": null, "_shodan": { "crawler": "91597136eb9b132d7cc954511e0d9cbe7ce2e377", "options": {}, "id": "7d720834-91ea-42dc-8b41-0100933116f1", "module": "https", "ptr": true }, "opts": { "vulns": [], "heartbleed": "2021/01/28 05:06:04 23.8.80.84:443 - SAFE\n" } } { "hash": -1180342095, "product": "Microsoft IIS httpd", "http": { "robots_hash": null, "redirects": [], "securitytxt": null, "title": "Object moved", "sitemap_hash": null, "robots": null, "server": "Microsoft-IIS/10.0", "host": "104.208.220.204", "html": "Object moved\r\n

Object moved to here.

\r\n\r\n", "location": "/", "components": {}, "html_hash": -1401938847, "sitemap": null, "securitytxt_hash": null }, "tags": [ "cloud" ], "timestamp": "2021-01-28T05:06:00.832166", "ssl": { "chain_sha256": [ "9e9296f5bdfafaa18ded4e605b4bde781d7e6ed3120ea3c7f4d6a2a2ad82c926", "04eeea8e50b4775b3c24797262917ee50002ec4c75b56cdf3ee1c18cfca5ba52", "16af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb" ], "jarm": "2ad2ad0000000000002ad2ad2ad2ad0f0dcb2ae084f34cae790be1eab88c30", "chain": [ "-----BEGIN CERTIFICATE-----\nMIIHyTCCBbGgAwIBAgITawAAR4RWz3h/fZyp4QAAAABHhDANBgkqhkiG9w0BAQsF\nADBPMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u\nMSAwHgYDVQQDExdNaWNyb3NvZnQgUlNBIFRMUyBDQSAwMTAeFw0yMDEwMDExODA1\nNDlaFw0yMTEwMDExODA1NDlaMCgxJjAkBgNVBAMTHXBvZHMuZWRvZy5vZmZpY2Vh\ncHBzLmxpdmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyxtb\njXVQXjqmR22C+arRPNFo2geQs1RXh5r3XwRc6n5+rW34dpPMOHJ+n37JL32IN4KT\nq8DLiI63K41Z3KX5+AkxWg+PvlYWQZe0TmYYTTXiWkIcLWoEjwZknT8A5PQ4cmqh\nn/WWwAh7pNesKLveJIUp7t29JUG2xDVNL7OOqk0/C/tLcEhbe3XqresGMesWZ6Ka\nxm19rRSwRUnz6wlfsn1Qg+pPXkMrPyQUDwbS8LBWDeZDLInFFIA8G/J0Rkwk9Wnt\nxhnOXsEr14PXyWxP/mEb3fMXSTKiZBkm/MifyKyTaftFP6QU7v3syfRC9pj/OOUr\nUzCRt8EOYkRPyd9lsQIDAQABo4IDwzCCA78wggEFBgorBgEEAdZ5AgQCBIH2BIHz\nAPEAdwD2XJQv0XcwIhRUGAgwlFaO400TGTO/3wwvIAvMTvFk4wAAAXTlYLMIAAAE\nAwBIMEYCIQDhMKCTjFF/NWefgai00VKkTuFewZYqx6hp+KEW0UCsugIhAMO0nsg7\nvRWO+tslhGaqwQp6QZhw+YzoKDU0zZ10ZHzpAHYARJRlLrDuzq/EQAfYqP4owNrm\ngr7YyzG1P9MzlrW2gagAAAF05WCzBwAABAMARzBFAiEAiCCq6PTFY/YQ79qIxBrP\nUd+94xuM83qS5WlhDzNrngACIDOdkaZ+lekAK3MIPR9qAwgu+86nxe01r+lXc2C6\nGsIeMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwEwCgYIKwYBBQUHAwIwPgYJ\nKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYWG\njkGHwphQAgFkAgElMIGHBggrBgEFBQcBAQR7MHkwUwYIKwYBBQUHMAKGR2h0dHA6\nLy93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMFJTQSUy\nMFRMUyUyMENBJTIwMDEuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29j\nc3AuY29tMB0GA1UdDgQWBBS6YxlUnWNuzh6qN4Z396dACGJKfjALBgNVHQ8EBAMC\nBLAwSQYDVR0RBEIwQIIdcG9kcy5lZG9nLm9mZmljZWFwcHMubGl2ZS5jb22CHyou\ncG9kcy5lZG9nLm9mZmljZWFwcHMubGl2ZS5jb20wgbAGA1UdHwSBqDCBpTCBoqCB\nn6CBnIZNaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwv\nTWljcm9zb2Z0JTIwUlNBJTIwVExTJTIwQ0ElMjAwMS5jcmyGS2h0dHA6Ly9jcmwu\nbWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBSU0ElMjBU\nTFMlMjBDQSUyMDAxLmNybDBXBgNVHSAEUDBOMEIGCSsGAQQBgjcqATA1MDMGCCsG\nAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMw\nCAYGZ4EMAQIBMB8GA1UdIwQYMBaAFLV2DDARzseSQk1Mx1wsyKkM6AtkMB0GA1Ud\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAgEAi7Hk\nhCBIqlXo1RKiz4zrhuFjduHehfcM+DJAPyWX5yqu6rkVykMDK9q8eGg6LDJ4BsZC\nPR2RaUy8UbMTiJSD6LpZd9p3EwupxYA4p8wuz8SHahKpy0Ou0Kv0cv/ge6NwE6XB\n/yv62Wmrhr0ZYe3Opcaus0xTn8ToxO3lQpa2xgdH30oVzVNQw/sGdPlO2dxUfggC\ngHhZH9lFM0JKlJj63mYw8/nNzfO0rbJic38EPESdV8O7KW+5TRKBOVW4fNlCveXa\nqyfP3COfbjtCMIcxRxi1YpQ2QvG4G7UaegShpfcfDDNFO6teV6x8Ft208wjSkiEQ\nzTiEkmPmBQo8QZsy5fJRkuVFzAqBmCgKnd2dhP67IQqzpx9I5iKg8YCo0dRniJt+\nBJn/NPZWYkBtWVJQL5y5RhH40FcGKwa3D6uNfqIm2JQInPOKxXoEzvtxyuuvXhOb\n9tLOOjijwnEz0Flz6yBRivIB37Kv0+e6uTs/MYsT/GVLGAlpKgpuK4SGoPDPOr1i\nmi+AiLXHDuTmMGVOtSEMXNr5l0on6coEUFpBf3TmYud2ZJ3JZdGbsreES4qQwDhp\nRQDUobsFXHYq4wmXyvMPICH7JYlm4aiYTGwN/HKpDfTke1h/Mw5dW/cxUHWCS+cs\nvmvOoX+Uqrupd8sFyF5Alhzt3wfofG+lqREYmYQ=\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIFWjCCBEKgAwIBAgIQDxSWXyAgaZlP1ceseIlB4jANBgkqhkiG9w0BAQsFADBa\nMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJl\nclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTIw\nMDcyMTIzMDAwMFoXDTI0MTAwODA3MDAwMFowTzELMAkGA1UEBhMCVVMxHjAcBgNV\nBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEgMB4GA1UEAxMXTWljcm9zb2Z0IFJT\nQSBUTFMgQ0EgMDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCqYnfP\nmmOyBoTzkDb0mfMUUavqlQo7Rgb9EUEf/lsGWMk4bgj8T0RIzTqk970eouKVuL5R\nIMW/snBjXXgMQ8ApzWRJCZbar879BV8rKpHoAW4uGJssnNABf2n17j9TiFy6BWy+\nIhVnFILyLNK+W2M3zK9gheiWa2uACKhuvgCca5Vw/OQYErEdG7LBEzFnMzTmJcli\nW1iCdXby/vI/OxbfqkKD4zJtm45DJvC9Dh+hpzqvLMiK5uo/+aXSJY+SqhoIEpz+\nrErHw+uAlKuHFtEjSeeku8eR3+Z5ND9BSqc6JtLqb0bjOHPm5dSRrgt4nnil75bj\nc9j3lWXpBb9PXP9Sp/nPCK+nTQmZwHGjUnqlO9ebAVQD47ZisFonnDAmjrZNVqEX\nF3p7laEHrFMxttYuD81BdOzxAbL9Rb/8MeFGQjE2Qx65qgVfhH+RsYuuD9dUw/3w\nZAhq05yO6nk07AM9c+AbNtRoEcdZcLCHfMDcbkXKNs5DJncCqXAN6LhXVERCw/us\nG2MmCMLSIx9/kwt8bwhUmitOXc6fpT7SmFvRAtvxg84wUkg4Y/Gx++0j0z6StSeN\n0EJz150jaHG6WV4HUqaWTb98Tm90IgXAU4AW2GBOlzFPiU5IY9jt+eXC2Q6yC/Zp\nTL1LAcnL3Qa/OgLrHN0wiw1KFGD51WRPQ0Sh7QIDAQABo4IBJTCCASEwHQYDVR0O\nBBYEFLV2DDARzseSQk1Mx1wsyKkM6AtkMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoI\nVDaGezq1BE3wMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYI\nKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADA0BggrBgEFBQcBAQQoMCYwJAYI\nKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+g\nLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDAq\nBgNVHSAEIzAhMAgGBmeBDAECATAIBgZngQwBAgIwCwYJKwYBBAGCNyoBMA0GCSqG\nSIb3DQEBCwUAA4IBAQCfK76SZ1vae4qt6P+dTQUO7bYNFUHR5hXcA2D59CJWnEj5\nna7aKzyowKvQupW4yMH9fGNxtsh6iJswRqOOfZYC4/giBO/gNsBvwr8uDW7t1nYo\nDYGHPpvnpxCM2mYfQFHq576/TmeYu1RZY29C4w8xYBlkAA8mDJfRhMCmehk7cN5F\nJtyWRj2cZj/hOoI45TYDBChXpOlLZKIYiG1giY16vhCRi6zmPzEwv+tk156N6cGS\nVm44jTQ/rs1sa0JSYjzUaYngoFdZC4OfxnIkQvUIA4TOFmPzNPEFdjcZsgbeEz4T\ncGHTBPK4R28F44qIMCtHRV55VMX53ev6P3hRddJb\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ\nRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD\nVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX\nDTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y\nZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy\nVHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr\nmD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr\nIZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK\nmpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu\nXmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy\ndc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye\njl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1\nBE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3\nDQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92\n9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx\njkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0\nEpn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz\nksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS\nR9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp\n-----END CERTIFICATE-----\n" ], "dhparams": null, "versions": [ "-TLSv1", "-SSLv2", "-SSLv3", "-TLSv1.1", "TLSv1.2", "-TLSv1.3" ], "acceptable_cas": [], "tlsext": [ { "id": 5, "name": "status_request" }, { "id": 65281, "name": "renegotiation_info" } ], "ja3s": "1d9c3e8c45ab7a2112263449a3ad9ece", "cert": { "sig_alg": "sha256WithRSAEncryption", "issued": "20201001180549Z", "expires": "20211001180549Z", "expired": false, "version": 2, "extensions": [ { "data": "\\x04\\x81\\xf3\\x00\\xf1\\x00w\\x00\\xf6\\\\\\x94/\\xd1w0\"\\x14T\\x18\\x080\\x94V\\x8e\\xe3M\\x13\\x193\\xbf\\xdf\\x0c/ \\x0b\\xccN\\xf1d\\xe3\\x00\\x00\\x01t\\xe5`\\xb3\\x08\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xe10\\xa0\\x93\\x8cQ\\x7f5g\\x9f\\x81\\xa8\\xb4\\xd1R\\xa4N\\xe1^\\xc1\\x96*\\xc7\\xa8i\\xf8\\xa1\\x16\\xd1@\\xac\\xba\\x02!\\x00\\xc3\\xb4\\x9e\\xc8;\\xbd\\x15\\x8e\\xfa\\xdb%\\x84f\\xaa\\xc1\\nzA\\x98p\\xf9\\x8c\\xe8(54\\xcd\\x9dtd|\\xe9\\x00v\\x00D\\x94e.\\xb0\\xee\\xce\\xaf\\xc4@\\x07\\xd8\\xa8\\xfe(\\xc0\\xda\\xe6\\x82\\xbe\\xd8\\xcb1\\xb5?\\xd33\\x96\\xb5\\xb6\\x81\\xa8\\x00\\x00\\x01t\\xe5`\\xb3\\x07\\x00\\x00\\x04\\x03\\x00G0E\\x02!\\x00\\x88 \\xaa\\xe8\\xf4\\xc5c\\xf6\\x10\\xef\\xda\\x88\\xc4\\x1a\\xcfQ\\xdf\\xbd\\xe3\\x1b\\x8c\\xf3z\\x92\\xe5ia\\x0f3k\\x9e\\x00\\x02 3\\x9d\\x91\\xa6~\\x95\\xe9\\x00+s\\x08=\\x1fj\\x03\\x08.\\xfb\\xce\\xa7\\xc5\\xed5\\xaf\\xe9Ws`\\xba\\x1a\\xc2\\x1e", "name": "ct_precert_scts" }, { "data": "0\\x180\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x010\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02", "name": "UNDEF" }, { "data": "0/\\x06\\'+\\x06\\x01\\x04\\x01\\x827\\x15\\x08\\x87\\xda\\x86u\\x83\\xee\\xd9\\x01\\x82\\xc9\\x85\\x1b\\x81\\xb5\\x9ea\\x85\\xf4\\xeb`\\x81]\\x85\\x86\\x8eA\\x87\\xc2\\x98P\\x02\\x01d\\x02\\x01%", "name": "UNDEF" }, { "data": "0y0S\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86Ghttp://www.microsoft.com/pki/mscorp/Microsoft%20RSA%20TLS%20CA%2001.crt0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x16http://ocsp.msocsp.com", "name": "authorityInfoAccess" }, { "data": "\\x04\\x14\\xbac\\x19T\\x9dcn\\xce\\x1e\\xaa7\\x86w\\xf7\\xa7@\\x08bJ~", "name": "subjectKeyIdentifier" }, { "data": "\\x03\\x02\\x04\\xb0", "name": "keyUsage" }, { "data": "0@\\x82\\x1dpods.edog.officeapps.live.com\\x82\\x1f*.pods.edog.officeapps.live.com", "name": "subjectAltName" }, { "data": "0\\x81\\xa50\\x81\\xa2\\xa0\\x81\\x9f\\xa0\\x81\\x9c\\x86Mhttp://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20RSA%20TLS%20CA%2001.crl\\x86Khttp://crl.microsoft.com/pki/mscorp/crl/Microsoft%20RSA%20TLS%20CA%2001.crl", "name": "crlDistributionPoints" }, { "data": "0N0B\\x06\\t+\\x06\\x01\\x04\\x01\\x827*\\x010503\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\'http://www.microsoft.com/pki/mscorp/cps0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01", "name": "certificatePolicies" }, { "data": "0\\x16\\x80\\x14\\xb5v\\x0c0\\x11\\xce\\xc7\\x92BML\\xc7\\\\,\\xc8\\xa9\\x0c\\xe8\\x0bd", "name": "authorityKeyIdentifier" }, { "data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02", "name": "extendedKeyUsage" } ], "fingerprint": { "sha256": "9e9296f5bdfafaa18ded4e605b4bde781d7e6ed3120ea3c7f4d6a2a2ad82c926", "sha1": "9fa0354d790576aa30f02f21b16612fbb8773b21" }, "serial": 2.3861798313051083e+45, "subject": { "CN": "pods.edog.officeapps.live.com" }, "pubkey": { "type": "rsa", "bits": 2048 }, "issuer": { "C": "US", "CN": "Microsoft RSA TLS CA 01", "O": "Microsoft Corporation" } }, "cipher": { "version": "TLSv1/SSLv3", "bits": 256, "name": "ECDHE-RSA-AES256-GCM-SHA384" }, "trust": { "revoked": false, "browser": { "mozilla": true, "apple": true, "microsoft": true } }, "alpn": [], "ocsp": {} }, "cloud": { "region": "useast2", "service": null, "provider": "Azure" }, "hostnames": [], "org": "Microsoft Azure", "data": "HTTP/1.1 302 Found\r\nCache-Control: private\r\nContent-Type: text/html; charset=utf-8\r\nLocation: http://www.office.com/\r\nServer: Microsoft-IIS/10.0\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: si, esid, X-EndSession, X-CorrelationID, X-OfficeFE, X-NewKey, X-OfficeCluster, Pid, SlideWidth, SlideHeight, ErrorCode, ErrorCategory, X-ErrorCode\r\nX-OfficeVersion: 16.0.13727.40505\r\nX-CorrelationId: 1f0ef74d-9cfc-4c22-a17e-8ef12d06ae9f\r\nX-UserSessionId: 1f0ef74d-9cfc-4c22-a17e-8ef12d06ae9f\r\nX-OfficeCluster: eus2-000.PODS.edog.officeapps.live.com\r\nX-AspNet-Version: 4.0.30319\r\nX-Powered-By: ASP.NET\r\nDate: Thu, 28 Jan 2021 05:06:00 GMT\r\nContent-Length: 139\r\n\r\n", "port": 443, "cpe23": [ "cpe:2.3:a:microsoft:internet_information_server:10.0", "cpe:2.3:o:microsoft:windows" ], "isp": "Microsoft Corporation", "transport": "tcp", "cpe": [ "cpe:/a:microsoft:internet_information_server:10.0", "cpe:/o:microsoft:windows" ], "asn": "AS8075", "version": "10.0", "location": { "country_code3": null, "city": "Boydton", "region_code": "VA", "postal_code": null, "longitude": -78.375, "country_code": "US", "latitude": 36.6534, "country_name": "United States", "area_code": null, "dma_code": 560 }, "ip": 1758518476, "domains": [], "ip_str": "104.208.220.204", "_id": "7c29cbd8-51d2-44ed-ade2-d2f75eb6617a", "os": null, "_shodan": { "crawler": "cdd92e2d835a37d2798fa6c7105171f4d214012f", "options": {}, "id": "d31f59c7-6d19-4277-b89d-3f1b8413e5bf", "module": "https", "ptr": true }, "opts": { "vulns": [], "heartbleed": "2021/01/28 05:06:08 104.208.220.204:443 - ERROR: write tcp 104.208.220.204:443: broken pipe\n" } } ...
Request
$ shodan stream --ports 22,443

          
Response
62.99.208.114	22	62-99-208-114.static.upcbusiness.at	SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC+cCt9g0zdS4Wd7Kvuej6D118thiH1SdVeaFVYq5KbpTuf\ngHVhQYTaBtwH4jufBgluo2m0qxSogICTvzytQha/m+H8BOH6ujm/6feubcux6tDC/pE/fxmj0+5R\nNl+Cd4vdjXaMMxxuXW6zrHOBw41bjjflW+YES7kZXzbvbEExz0YOsBbhmucolXl/O0cuTuo6K8jy\nKYnb0USYqO5gnGzdIl9QhbJWHsaAgXaUtRK2OPGJl2SwM1tNmTQ6faMPHiV4a75LvxKMQEsYINj+\npDIGnKkoBsP21W4oG47JOMwffxTMgjv3k2SRR65Hal8obu0sEf6vLp4oWiCxB43ZdxQL\nFingerprint: 63:2a:85:f1:a7:b2:c3:e7:dc:0c:65:0f:8c:c4:87:b6\n\nKex Algorithms:\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tssh-dss\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
104.65.190.207	443	a104-65-190-207.deploy.static.akamaitechnologies.com	HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 05:12:33 GMT\r\nDate: Thu, 28 Jan 2021 05:12:33 GMT\r\nConnection: close\r\n\r\n
13.94.230.88	443		HTTP/1.1 404 Not Found\r\nDate: Thu, 28 Jan 2021 05:11:55 GMT\r\nServer: *\r\nStrict-Transport-Security: max-age=15724800\r\nAccept-Ranges: bytes\r\nContent-Type: text/html\r\nVary: User-Agent\r\nTransfer-Encoding: chunked\r\n\r\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.ports(ports=[22, 443], raw=False, timeout=None):
    print(banner)
          
Response
{
    "hash": 1394961798,
    "product": "Apache httpd",
    "http": {
        "robots_hash": None,
        "redirects": [],
        "securitytxt": None,
        "title": "301 Moved Permanently",
        "sitemap_hash": None,
        "robots": None,
        "server": "Apache",
        "host": "oasissinks.com",
        "html": '\n\n301 Moved Permanently\n\n

Moved Permanently

\n

The document has moved here.

\n\n', "location": "/", "components": {}, "html_hash": 565781495, "sitemap": None, "securitytxt_hash": None, }, "tags": [ "cloud" ], "timestamp": "2021-01-28T05:13:42.379509", "ssl": { "chain_sha256": [ "ad5781f7f03081cb44d28641803a76ef6297f237510f71d804b18024ce1f5483", "730c1bdcd85f57ce5dc0bba733e5f1ba5a925b2a771d640a26f7a454224dad3b", "0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739", ], "jarm": "07d14d16d21d21d00042d43d00000076e5b3c488a88e5790970b78ffb8afc2", "chain": [ "-----BEGIN CERTIFICATE-----\nMIIFNjCCBB6gAwIBAgISBHnuPOJ9vokyFdA0YbgbtYsmMA0GCSqGSIb3DQEBCwUA\nMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\nEwJSMzAeFw0yMDEyMjExNzE4NTVaFw0yMTAzMjExNzE4NTVaMBsxGTAXBgNVBAMM\nECoub2FzaXNzaW5rcy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCmXulskkbVDiq2t6WEegtPqjS4N8C9GiffdzhI5Raq8lL7Gt7mkvkOVKerFAZe\ngvOwZRI2LyRRHeuHGDObGJf2vEvAC4+EcJHBLnOibB8h3PvCkVV/Rb+1NtmkfKyv\nUyIP894uB5Zgsr6ldjWByLB951H7QybFbOpefFuj7q+r39D2FuTTAYFizWeyEjeo\neSIKwjvIY4siHeTjwG6gw6Q4QFwWGyK2O9AXm/bIPoDcFd9lKKapldcLtY+2n7NX\n+xLnrM67OKn8rttLrg43Pw+1+O8lFyF/+TpEwCUVweBpDx57VmulEpJ0m3vDSrf+\nGIxYdOI3HXn4Mc4CE2SDxaLPAgMBAAGjggJbMIICVzAOBgNVHQ8BAf8EBAMCBaAw\nHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD\nVR0OBBYEFIDJe2I/SDZT6mluR0P5SzVRfrlhMB8GA1UdIwQYMBaAFBQusxe3WFbL\nrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDov\nL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5v\ncmcvMCsGA1UdEQQkMCKCECoub2FzaXNzaW5rcy5jb22CDm9hc2lzc2lua3MuY29t\nMEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUH\nAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIIBBAYKKwYBBAHWeQIEAgSB\n9QSB8gDwAHYARJRlLrDuzq/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAF2hoaT\nGAAABAMARzBFAiBsoIuKHURakuYlI5tewVqDShto6C7aknnZhaVL/5/nHgIhAPB3\n6lsQg3nCZ0yZk/YFr2R47ZvKP3BhWnCnutmZDpy0AHYA9lyUL9F3MCIUVBgIMJRW\njuNNExkzv98MLyALzE7xZOMAAAF2hoaS/QAABAMARzBFAiAuIXOoAkur7UOxhaZ1\n6LCmpy/oZlZcvaDQjr46ZLqMqgIhAJzz/QSMwgrZAH608S9A1UQ8IG030JU6h11w\nNs0AFyIeMA0GCSqGSIb3DQEBCwUAA4IBAQAnkfvFcXrCdQ5SOa4ovN2ninWWQeOk\nQmLg2Tu0t+Fs72zbQj2+pvabqDpGdFAZeK3ZIgQxjwig2HmdVy292qxp53AOiZeZ\nrTyl/KLV4kjy9pB8KJTCG6nSpRaEOqLiTMWC+iuz8hBTJTXCLPu2/MXVTaQJjIFi\n3IMMREK56Nn4Pfq4iqtfYpcQWm15BjVPq0jF4p4EeyoicOE9wCks+zBUCxLN0lSF\n6XmvNH7xi3Rb8fY55KhcyocRJTelxhk3ndGs7ULcXe1Xw8nFJgwT0SkmDPkAoO43\n6qtOLW0O7QMA79CBDSk5Lo4gc5JmSt/nWgDrla1HNKsTNoJHglLmSKm1\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow\nMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT\nAlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs\njVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp\nTm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB\nU840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7\ngcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel\n/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R\noYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E\nBAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p\nZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE\np7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE\nAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu\nY3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0\nLmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf\nr52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B\nAQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH\nejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8\nS8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL\nqjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p\nO5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw\nUdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg==\n-----END CERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\nMIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow\nPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD\nEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O\nrz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq\nOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b\nxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD\naeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV\nHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG\nSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69\nikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr\nAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz\nR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5\nJDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo\nOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n-----END CERTIFICATE-----\n", ], "dhparams": { "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff", "public_key": "23dca7ad62f0a9647f00262a5da160dfbc8b473f6828644c2680e635b7c995db67f0e537f911e45e6990a3fbfa4d542c0f462c946b6435f6fba2ab24996dda89f9bca6263fd6e77f4141e1ed45087aa4a0797101b17c1c450bd3c2e57cc30df5acbf75da0211ea1a08ed64e3a97dfdc230e312ec9c8cddaa8fd33367d8a66d216483478f9c6bc8be72fdcadcc50ef6a8d5a0c6c486a80f38307c5a78d6f7e6ba5dd7d3290de51aedcaab5405329d1c9344766a8a75af7080af025c82bb8e3fe01d3b1b6cc1775ca3162d38b86ec466e61b196475c2d65f90a77ab595e0de8801e60098760af62a61979c60429966d2e78ee85e34f53d73499fff3632978bf1af", "bits": 2048, "generator": 2, "fingerprint": "RFC3526/Oakley Group 14", }, "versions": [ "-TLSv1", "-SSLv2", "-SSLv3", "-TLSv1.1", "TLSv1.2", "TLSv1.3" ], "acceptable_cas": [], "tlsext": [ { "id": 65281, "name": "renegotiation_info" }, { "id": 11, "name": "ec_point_formats" }, { "id": 35, "name": "session_ticket" }, { "id": 5, "name": "status_request" }, ], "ja3s": "452c3b3abf0ed48df1b925f6977db72b", "cert": { "sig_alg": "sha256WithRSAEncryption", "issued": "20201221171855Z", "expires": "20210321171855Z", "expired": False, "version": 2, "extensions": [ { "critical": True, "data": "\\x03\\x02\\x05\\xa0", "name": "keyUsage" }, { "data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02", "name": "extendedKeyUsage", }, { "critical": True, "data": "0\\x00", "name": "basicConstraints" }, { "data": "\\x04\\x14\\x80\\xc9{b?H6S\\xeainGC\\xf9K5Q~\\xb9a", "name": "subjectKeyIdentifier", }, { "data": "0\\x16\\x80\\x14\\x14.\\xb3\\x17\\xb7XV\\xcb\\xaeP\\t@\\xe6\\x1f\\xaf\\x9d\\x8b\\x14\\xc2\\xc6", "name": "authorityKeyIdentifier", }, { "data": '0G0!\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x15http: //r3.o.lencr.org0"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://r3.i.lencr.org/', "name": "authorityInfoAccess", }, { "data": '0"\\x82\\x10*.oasissinks.com\\x82\\x0eoasissinks.com', "name": "subjectAltName", }, { "data": "0C0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x0107\\x06\\x0b+\\x06\\x01\\x04\\x01\\x82\\xdf\\x13\\x01\\x01\\x010(0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttp://cps.letsencrypt.org", "name": "certificatePolicies", }, { "data": '\\x04\\x81\\xf2\\x00\\xf0\\x00v\\x00D\\x94e.\\xb0\\xee\\xce\\xaf\\xc4@\\x07\\xd8\\xa8\\xfe(\\xc0\\xda\\xe6\\x82\\xbe\\xd8\\xcb1\\xb5?\\xd33\\x96\\xb5\\xb6\\x81\\xa8\\x00\\x00\\x01v\\x86\\x86\\x93\\x18\\x00\\x00\\x04\\x03\\x00G0E\\x02 l\\xa0\\x8b\\x8a\\x1dDZ\\x92\\xe6%#\\x9b^\\xc1Z\\x83J\\x1bh\\xe8.\\xda\\x92y\\xd9\\x85\\xa5K\\xff\\x9f\\xe7\\x1e\\x02!\\x00\\xf0w\\xea[\\x10\\x83y\\xc2gL\\x99\\x93\\xf6\\x05\\xafdx\\xed\\x9b\\xca?paZp\\xa7\\xba\\xd9\\x99\\x0e\\x9c\\xb4\\x00v\\x00\\xf6\\\\\\x94/\\xd1w0"\\x14T\\x18\\x080\\x94V\\x8e\\xe3M\\x13\\x193\\xbf\\xdf\\x0c/ \\x0b\\xccN\\xf1d\\xe3\\x00\\x00\\x01v\\x86\\x86\\x92\\xfd\\x00\\x00\\x04\\x03\\x00G0E\\x02 .!s\\xa8\\x02K\\xab\\xedC\\xb1\\x85\\xa6u\\xe8\\xb0\\xa6\\xa7/\\xe8fV\\\\\\xbd\\xa0\\xd0\\x8e\\xbe:d\\xba\\x8c\\xaa\\x02!\\x00\\x9c\\xf3\\xfd\\x04\\x8c\\xc2\\n\\xd9\\x00~\\xb4\\xf1/@\\xd5D< m7\\xd0\\x95:\\x87]p6\\xcd\\x00\\x17"\\x1e', "name": "ct_precert_scts", }, ], "fingerprint": { "sha256": "ad5781f7f03081cb44d28641803a76ef6297f237510f71d804b18024ce1f5483", "sha1": "f6b44d2c688e03f9d42acd0cfe253c106c079426", }, "serial": 389939982519069921483757352690759710903078, "subject": { "CN": "*.oasissinks.com" }, "pubkey": { "type": "rsa", "bits": 2048 }, "issuer": { "C": "US", "CN": "R3", "O": "Let's Encrypt" }, }, "cipher": { "version": "TLSv1/SSLv3", "bits": 256, "name": "ECDHE-RSA-AES256-GCM-SHA384", }, "trust": { "revoked": False, "browser": { "mozilla": True, "apple": True, "microsoft": True }, }, "alpn": [], "ocsp": { "version": "1", "response_status": "successful", "responder_id": "C = US, O = Let's Encrypt, CN = R3", "cert_status": "good", "produced_at": "2021-01-26 18:18:00", "signature_algorithm": "sha256WithRSAEncryption", "next_update": "2021-02-02 18:00:00", "this_update": "2021-01-26 18:00:00", "certificate_id": { "hash_algorithm": "sha1", "issuer_name_hash": "48DAC9A0FB2BD32D4FF0DE68D2F567B735F9B3C4", "issuer_name_key": "142EB317B75856CBAE500940E61FAF9D8B14C2C6", "serial_number": "03A1663F117331B98AFCA0DEB4B02739C3BA", }, }, }, "cloud": { "region": None, "service": None, "provider": "Linode" }, "hostnames": [ "chemcore.com" ], "org": "Linode", "data": "HTTP/1.1 301 Moved Permanently\r\nDate: Thu, 28 Jan 2021 05:13:36 GMT\r\nServer: Apache\r\nLocation: http://www.chemcore.com\r\nContent-Length: 231\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n", "port": 443, "cpe23": [ "cpe:2.3:a:apache:http_server" ], "isp": "Linode", "transport": "tcp", "cpe": [ "cpe:/a:apache:http_server" ], "asn": "AS63949", "location": { "country_code3": None, "city": "Richardson", "region_code": "TX", "postal_code": None, "longitude": -96.7028, "country_code": "US", "latitude": 32.9473, "country_name": "United States", "area_code": None, "dma_code": 623, }, "ip": 1208922770, "domains": [ "chemcore.com" ], "ip_str": "72.14.178.146", "_id": "5299001e-fb7e-4da4-b78e-9b468b398982", "os": None, "_shodan": { "crawler": "1bab892ab6866024db9a99b462f1ef21bb739f5c", "options": { "hostname": "oasissinks.com", "scan": "FlKR9617YSIozzg3" }, "id": "18cefda1-2b9c-4b92-b431-d92032e9ba99", "module": "https", "ptr": True, }, "opts": { "vulns": [], "heartbleed": "2021/01/28 05:13:54 72.14.178.146:443 - SAFE\n", }, } } { "product": "OpenSSH", "hash": -620132291, "timestamp": "2021-01-28T05:21:09.281831", "hostnames": [ "ns3053083.ip-149-202-222.eu" ], "ssh": { "hassh": "b12d2871a1189eff20364cf5333619ee", "fingerprint": "ce:2c:92:a4:77:4d:f9:c2:d5:ef:4f:ce:99:07:ae:49", "mac": "hmac-sha2-256", "cipher": "aes128-ctr", "key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQC6JDa9LOkPFyvBTRufDWJr0nUBPaHbcdgL2pLRp7gu9kSJ\n5gSMdpZrAlhWrBnCCGzKeyItrgXzhlEDpD+tDA3jOTYk5faRxnsIAG5x0Y2PPAhmJsk79nApW7f1\nuNv5UoRFd5ZJEMP2P8uqGJU6hAGA628t4GYhlMcJrzrRh3WC+D6+jrRENUyl+s6i9ixvUr5nRWoV\n3bZNLTvvRxDkzqdLlltYv5YnT04rhfepOo7osp4l7/jsDlCdyH6eC7WCLTyBpwXxh9WPjINsrcVa\nqdffWY3kt91YY4zRqVCCMhhQDndn/86KC5B2WTCZPiTBcZqNPHpPJf7XziuFwuvFjtA9\n", "kex": { "languages": [ "" ], "server_host_key_algorithms": [ "ssh-rsa", "rsa-sha2-512", "rsa-sha2-256", "ecdsa-sha2-nistp256", "ssh-ed25519", ], "encryption_algorithms": [ "chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com", ], "kex_follows": False, "unused": 0, "kex_algorithms": [ "curve25519-sha256", "curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group16-sha512", "diffie-hellman-group18-sha512", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1", ], "compression_algorithms": [ "none", "zlib@openssh.com" ], "mac_algorithms": [ "umac-64-etm@openssh.com", "umac-128-etm@openssh.com", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1-etm@openssh.com", "umac-64@openssh.com", "umac-128@openssh.com", "hmac-sha2-256", "hmac-sha2-512", "hmac-sha1", ], }, "type": "ssh-rsa", }, "org": "OVH SAS", "data": "SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC6JDa9LOkPFyvBTRufDWJr0nUBPaHbcdgL2pLRp7gu9kSJ\n5gSMdpZrAlhWrBnCCGzKeyItrgXzhlEDpD+tDA3jOTYk5faRxnsIAG5x0Y2PPAhmJsk79nApW7f1\nuNv5UoRFd5ZJEMP2P8uqGJU6hAGA628t4GYhlMcJrzrRh3WC+D6+jrRENUyl+s6i9ixvUr5nRWoV\n3bZNLTvvRxDkzqdLlltYv5YnT04rhfepOo7osp4l7/jsDlCdyH6eC7WCLTyBpwXxh9WPjINsrcVa\nqdffWY3kt91YY4zRqVCCMhhQDndn/86KC5B2WTCZPiTBcZqNPHpPJf7XziuFwuvFjtA9\nFingerprint: ce:2c:92:a4:77:4d:f9:c2:d5:ef:4f:ce:99:07:ae:49\n\nKex Algorithms:\n\tcurve25519-sha256\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group16-sha512\n\tdiffie-hellman-group18-sha512\n\tdiffie-hellman-group14-sha256\n\tdiffie-hellman-group14-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\trsa-sha2-512\n\trsa-sha2-256\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n", "port": 22, "transport": "tcp", "info": "protocol 2.0", "isp": "OVH SAS", "cpe23": [ "cpe:2.3:a:openbsd:openssh:7.6p1 Ubuntu-4ubuntu0.3" ], "cpe": [ "cpe:/a:openbsd:openssh:7.6p1 Ubuntu-4ubuntu0.3" ], "asn": "AS16276", "version": "7.6p1 Ubuntu-4ubuntu0.3", "location": { "country_code3": None, "city": None, "region_code": None, "postal_code": None, "longitude": 2.3387, "country_code": "FR", "latitude": 48.8582, "country_name": "France", "area_code": None, "dma_code": None, }, "ip": 2513100291, "domains": [ "ip-149-202-222.eu" ], "ip_str": "149.202.222.3", "_id": "050f8982-a306-4f4e-bb29-8a32dc6d157a", "os": "Ubuntu", "_shodan": { "crawler": "91597136eb9b132d7cc954511e0d9cbe7ce2e377", "options": {}, "id": "b9885570-c914-41b5-a6d3-0755be1b4f92", "module": "ssh", "ptr": True, }, "opts": {}, } ...
GET/shodan/vulns/{vulns}
Filtered by Vulnerabilities

Only returns banner data for the list of specified vulnerabilities. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in a specific list of vulnerabilities.

Request URL
https://stream.shodan.io/shodan/vulns/{vulns}?key={YOUR_API_KEY}
      

  • vulns: [String] Comma-separated list of case-insensitive vulnerabilities; example "CVE-2017-7679,CVE-2018-15919"
Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/vulns/CVE-2017-7679,CVE-2018-15919?key={YOUR_API_KEY}"

          
Response
{
  "hash": -286560,
  "product": "Apache httpd",
  "http": {
    "status": 400,
    "robots_hash": -1022729730,
    "redirects": [
      {
        "host": "136.243.203.117",
        "html": "\n\n\n\t\n\t\n\n\n",
        "data": "HTTP/1.1 200 OK\r\nDate: Sun, 26 Dec 2021 13:50:37 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sat, 02 May 2020 19:49:04 GMT\r\nETag: \"9c-5a4af97139ebf\"\r\nAccept-Ranges: bytes\r\nContent-Length: 156\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n",
        "location": "/"
      }
    ],
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": "User-agent: *\nDisallow: /\n",
    "server": "Apache/2.4.25 (Debian)",
    "host": "136.243.203.117",
    "html": "\n\n\n\t\n\t\n\n\n",
    "location": "/index.php",
    "components": {
      "PHP": {
        "categories": []
      }
    },
    "html_hash": 823453261,
    "sitemap": null,
    "securitytxt_hash": null
  },
  "vulns": {
    "CVE-2019-0196": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.39",
        "http://www.openwall.com/lists/oss-security/2019/04/02/1",
        "http://www.securityfocus.com/bid/107669",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/97a1c58e138ed58a364513b58d807a802e72bf6079ff81a10948ef7c@%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTJPHI3E3OKW7OT7COQXVG7DE7IDQ2OT/",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.netapp.com/advisory/ntap-20190617-0002/",
        "https://support.f5.com/csp/article/K44591505",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422"
      ],
      "cvss": "5.0",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly."
    },
    "CVE-2017-7679": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99170",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
        "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header."
    },
    "CVE-2017-7659": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.securityfocus.com/bid/99132",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a@%3Cannounce.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "5.0",
      "summary": "A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process."
    },
    "CVE-2017-9788": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3913",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99569",
        "http://www.securitytracker.com/id/1038906",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:2708",
        "https://access.redhat.com/errata/RHSA-2017:2709",
        "https://access.redhat.com/errata/RHSA-2017:2710",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://httpd.apache.org/security/vulnerabilities_22.html",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb@%3Cannounce.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20170911-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "6.4",
      "summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service."
    },
    "CVE-2017-9798": {
      "verified": false,
      "references": [
        "http://openwall.com/lists/oss-security/2017/09/18/2",
        "http://www.debian.org/security/2017/dsa-3980",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
        "http://www.securityfocus.com/bid/100872",
        "http://www.securityfocus.com/bid/105598",
        "http://www.securitytracker.com/id/1039387",
        "https://access.redhat.com/errata/RHSA-2017:2882",
        "https://access.redhat.com/errata/RHSA-2017:2972",
        "https://access.redhat.com/errata/RHSA-2017:3018",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
        "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
        "https://github.com/apache/httpd/commit/29afdd2550b3d30a8defece2b95ae81edcf66ac9",
        "https://github.com/hannob/optionsbleed",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
        "https://security-tracker.debian.org/tracker/CVE-2017-9798",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0003/",
        "https://support.apple.com/HT208331",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
        "https://www.exploit-db.com/exploits/42745/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      ],
      "cvss": "5.0",
      "summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c."
    },
    "CVE-2018-11763": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
        "http://www.securityfocus.com/bid/105414",
        "http://www.securitytracker.com/id/1041713",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.netapp.com/advisory/ntap-20190204-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      ],
      "cvss": "4.3",
      "summary": "In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol."
    },
    "CVE-2017-3167": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99135",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed."
    },
    "CVE-2018-1312": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/7",
        "http://www.securityfocus.com/bid/103524",
        "http://www.securitytracker.com/id/1040571",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://access.redhat.com/errata/RHSA-2019:1898",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "6.8",
      "summary": "In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection."
    },
    "CVE-2018-1333": {
      "verified": false,
      "references": [
        "http://www.securitytracker.com/id/1041402",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180926-0007/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/"
      ],
      "cvss": "5.0",
      "summary": "By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33)."
    },
    "CVE-2017-3169": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99134",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
        "https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port."
    },
    "CVE-2019-0197": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.openwall.com/lists/oss-security/2019/04/02/2",
        "http://www.securityfocus.com/bid/107665",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://security.netapp.com/advisory/ntap-20190617-0002/",
        "https://support.f5.com/csp/article/K44591505"
      ],
      "cvss": "4.9",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue."
    },
    "CVE-2019-0220": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.openwall.com/lists/oss-security/2019/04/02/6",
        "http://www.securityfocus.com/bid/107670",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2019/04/msg00008.html",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.netapp.com/advisory/ntap-20190625-0007/",
        "https://support.f5.com/csp/article/K44591505",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422"
      ],
      "cvss": "5.0",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them."
    },
    "CVE-2019-0211": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html",
        "http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html",
        "http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.39",
        "http://www.openwall.com/lists/oss-security/2019/04/02/3",
        "http://www.securityfocus.com/bid/107666",
        "https://access.redhat.com/errata/RHBA-2019:0959",
        "https://access.redhat.com/errata/RHSA-2019:0746",
        "https://access.redhat.com/errata/RHSA-2019:0980",
        "https://access.redhat.com/errata/RHSA-2019:1296",
        "https://access.redhat.com/errata/RHSA-2019:1297",
        "https://access.redhat.com/errata/RHSA-2019:1543",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa@%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://seclists.org/bugtraq/2019/Apr/16",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.gentoo.org/glsa/201904-20",
        "https://security.netapp.com/advisory/ntap-20190423-0001/",
        "https://support.f5.com/csp/article/K32957101",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422",
        "https://www.exploit-db.com/exploits/46676/",
        "https://www.synology.com/security/advisory/Synology_SA_19_14"
      ],
      "cvss": "7.2",
      "summary": "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected."
    },
    "CVE-2017-15710": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/8",
        "http://www.securityfocus.com/bid/103512",
        "http://www.securitytracker.com/id/1040569",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "5.0",
      "summary": "In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all."
    },
    "CVE-2018-1283": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/4",
        "http://www.securityfocus.com/bid/103520",
        "http://www.securitytracker.com/id/1040568",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "3.5",
      "summary": "In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications."
    },
    "CVE-2017-7668": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99137",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "7.5",
      "summary": "The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value."
    },
    "CVE-2017-15715": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/6",
        "http://www.securityfocus.com/bid/103525",
        "http://www.securitytracker.com/id/1040570",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "6.8",
      "summary": "In Apache httpd 2.4.0 to 2.4.29, the expression specified in  could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename."
    },
    "CVE-2018-17199": {
      "verified": false,
      "references": [
        "http://www.securityfocus.com/bid/106742",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2019/01/msg00024.html",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.gentoo.org/glsa/201903-21",
        "https://security.netapp.com/advisory/ntap-20190125-0001/",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      ],
      "cvss": "5.0",
      "summary": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded."
    }
  },
  "timestamp": "2021-12-26T13:50:38.138557",
  "hostnames": [
    "cloud.sata.support.de"
  ],
  "org": null,
  "data": "HTTP/1.1 400 Bad Request\r\nDate: Sun, 26 Dec 2021 13:50:38 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'nonce-Uzg3RlR0SGV4eWk2ZkVQTzRYVHVweUl5Y2x0MVFuRUF5WGlhSmlKa0Rvcz06SkxTY0llR3RsMmZ5UkNTbXF5T2RrRlp4SWc4Z0lVQm9peW5VVkdNSU4rND0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\nReferrer-Policy: no-referrer\r\nX-Content-Type-Options: nosniff\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-Permitted-Cross-Domain-Policies: none\r\nX-Robots-Tag: none\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: ocywvd3d4ksh=eva1s52oicv8tdeb7g0b7e66bc; path=/; HttpOnly\r\nSet-Cookie: oc_sessionPassphrase=turMN1jcd3qqiI4qFzrzqLVxkULQrAqmYaBNYHnPK0glR4ABkZKVi1TWtcxL9p%2Fp3XJi9UE35rkiewLJaoKAb5d%2B74HSEZZI4GpPVWWasb7X6YAeC5MncH8FVtfFNS7O; path=/; HttpOnly\r\nSet-Cookie: nc_sameSiteCookielax=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax\r\nSet-Cookie: nc_sameSiteCookiestrict=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n",
  "port": 80,
  "transport": "tcp",
  "info": "(Debian)",
  "isp": "Hetzner Online GmbH",
  "cpe23": [
    "cpe:2.3:a:php:php",
    "cpe:2.3:a:apache:http_server:2.4.25"
  ],
  "cpe": [
    "cpe:/a:php:php",
    "cpe:/a:apache:http_server:2.4.25"
  ],
  "asn": "AS24940",
  "version": "2.4.25",
  "location": {
    "city": "Oberdorla",
    "region_code": "TH",
    "area_code": null,
    "longitude": 10.42163,
    "latitude": 51.16585,
    "country_code": "DE",
    "country_name": "Germany"
  },
  "ip": 2297678709,
  "domains": [
    "support.de"
  ],
  "ip_str": "136.243.203.117",
  "os": null,
  "_shodan": {
    "crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
    "options": {},
    "id": "bb74aed0-dd93-4d4b-a51e-dd3bb2e10e04",
    "module": "http",
    "ptr": true
  },
  "opts": {}
}
...
          
Request
$ shodan stream --vulns cve-2017-7679,cve-2018-15919

          
Response
173.249.157.11	2202	server2.creationforce.com	SSH-2.0-OpenSSH_7.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQCo5K7Ppgnaz5UNC/Lp2SpUWWQ5cH+dH0flWuWhfOKVuGjo\nZMAu/bMxYaKVgNUMb9Egd6uMcFJkdvTCSPr5mhb0jEEAV9lxTDwrJ+dHXU4u4g7YSUQACLF7IxDo\nzNcsNqZmiFdJh0Cv+njtEf+iBQkg0P7dLUP6EC4v+OayAZEUUaPqSQCh1++o1Od37UgMj1zAn9WC\neZ31p5hGNFrvLg0e7tYnnaQlukgTkJQ3IJ+E9s2/Id4dnKTqK9GBqsH2Co3La1/1TtxkUWVVCIrE\npY5LoTGkwJk+QQeo6CtYPpRvT62umNlbkTuCB/IF5BYPjZSnHxThmCtMB3dLylarEF1R\nFingerprint: 5d:c2:51:b0:e4:d0:07:a3:e9:58:65:da:f4:22:86:04\n\nKex Algorithms:\n\tcurve25519-sha256\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group16-sha512\n\tdiffie-hellman-group18-sha512\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha256\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\trsa-sha2-512\n\trsa-sha2-256\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\taes192-cbc\n\taes256-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\t3des-cbc\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
193.16.14.153	80	concatenating.heldcallip.com	HTTP/1.1 200 OK\r\nDate: Wed, 22 Dec 2021 03:23:27 GMT\r\nServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16\r\nX-Powered-By: PHP/5.4.16\r\nContent-Length: 162\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n
154.81.173.155	22		SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDG5PsqtH+nVoWThZJ39Bd0ej//JkdyAFAv9zZa/sZv+B19\nuhmZdWC3bu/T0GctnbmiirzdFvc03VOs4AVoud7/94ULB+seVjXoTVLRT/IeeScLygHAvogc9lKH\nnJQN6nou1Jv5qiyUvLbpA1kGo3KMF08aAkcQnYidvf8PgEltJCAjNEpCLyDLe0XqkIfNDYosz2Zt\nD/SMv5qFKvUkyVx29MXwrrVZjCveJ6Z0MT2G7muOasv+qLxG0yJllfEnKKqRYq/emLRjlPbtBMmC\nZrqE5xrNVqlxgp6vp4p9uuESRzgNFiw/GIg9/OnvIIb2yoSzdTXmBDarlnvExUQvQS/t\nFingerprint: 3d:53:eb:43:88:8b:7c:58:37:f4:79:2c:42:68:51:32\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.vulns(countries=['CVE-2017-7679', 'CVE-2018-15919'], raw=False, timeout=None):
    print(banner)
          
Response
{
  "hash": -286560,
  "product": "Apache httpd",
  "http": {
    "status": 400,
    "robots_hash": -1022729730,
    "redirects": [
      {
        "host": "136.243.203.117",
        "html": "\n\n\n\t\n\t\n\n\n",
        "data": "HTTP/1.1 200 OK\r\nDate: Sun, 26 Dec 2021 13:50:37 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sat, 02 May 2020 19:49:04 GMT\r\nETag: \"9c-5a4af97139ebf\"\r\nAccept-Ranges: bytes\r\nContent-Length: 156\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n",
        "location": "/"
      }
    ],
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "robots": "User-agent: *\nDisallow: /\n",
    "server": "Apache/2.4.25 (Debian)",
    "host": "136.243.203.117",
    "html": "\n\n\n\t\n\t\n\n\n",
    "location": "/index.php",
    "components": {
      "PHP": {
        "categories": []
      }
    },
    "html_hash": 823453261,
    "sitemap": null,
    "securitytxt_hash": null
  },
  "vulns": {
    "CVE-2019-0196": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.39",
        "http://www.openwall.com/lists/oss-security/2019/04/02/1",
        "http://www.securityfocus.com/bid/107669",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/97a1c58e138ed58a364513b58d807a802e72bf6079ff81a10948ef7c@%3Ccvs.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTJPHI3E3OKW7OT7COQXVG7DE7IDQ2OT/",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.netapp.com/advisory/ntap-20190617-0002/",
        "https://support.f5.com/csp/article/K44591505",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422"
      ],
      "cvss": "5.0",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly."
    },
    "CVE-2017-7679": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99170",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
        "https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header."
    },
    "CVE-2017-7659": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.securityfocus.com/bid/99132",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a@%3Cannounce.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "5.0",
      "summary": "A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process."
    },
    "CVE-2017-9788": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3913",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99569",
        "http://www.securitytracker.com/id/1038906",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:2708",
        "https://access.redhat.com/errata/RHSA-2017:2709",
        "https://access.redhat.com/errata/RHSA-2017:2710",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://httpd.apache.org/security/vulnerabilities_22.html",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb@%3Cannounce.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20170911-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "6.4",
      "summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service."
    },
    "CVE-2017-9798": {
      "verified": false,
      "references": [
        "http://openwall.com/lists/oss-security/2017/09/18/2",
        "http://www.debian.org/security/2017/dsa-3980",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
        "http://www.securityfocus.com/bid/100872",
        "http://www.securityfocus.com/bid/105598",
        "http://www.securitytracker.com/id/1039387",
        "https://access.redhat.com/errata/RHSA-2017:2882",
        "https://access.redhat.com/errata/RHSA-2017:2972",
        "https://access.redhat.com/errata/RHSA-2017:3018",
        "https://access.redhat.com/errata/RHSA-2017:3113",
        "https://access.redhat.com/errata/RHSA-2017:3114",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3239",
        "https://access.redhat.com/errata/RHSA-2017:3240",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
        "https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
        "https://github.com/apache/httpd/commit/29afdd2550b3d30a8defece2b95ae81edcf66ac9",
        "https://github.com/hannob/optionsbleed",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
        "https://security-tracker.debian.org/tracker/CVE-2017-9798",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0003/",
        "https://support.apple.com/HT208331",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
        "https://www.exploit-db.com/exploits/42745/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      ],
      "cvss": "5.0",
      "summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c."
    },
    "CVE-2018-11763": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
        "http://www.securityfocus.com/bid/105414",
        "http://www.securitytracker.com/id/1041713",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://security.netapp.com/advisory/ntap-20190204-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
      ],
      "cvss": "4.3",
      "summary": "In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol."
    },
    "CVE-2017-3167": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99135",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed."
    },
    "CVE-2018-1312": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/7",
        "http://www.securityfocus.com/bid/103524",
        "http://www.securitytracker.com/id/1040571",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://access.redhat.com/errata/RHSA-2019:1898",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "6.8",
      "summary": "In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection."
    },
    "CVE-2018-1333": {
      "verified": false,
      "references": [
        "http://www.securitytracker.com/id/1041402",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180926-0007/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3783-1/"
      ],
      "cvss": "5.0",
      "summary": "By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33)."
    },
    "CVE-2017-3169": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99134",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2478",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://access.redhat.com/errata/RHSA-2017:3195",
        "https://access.redhat.com/errata/RHSA-2017:3475",
        "https://access.redhat.com/errata/RHSA-2017:3476",
        "https://access.redhat.com/errata/RHSA-2017:3477",
        "https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
        "https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
        "https://www.nomachine.com/SU08O00185"
      ],
      "cvss": "7.5",
      "summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port."
    },
    "CVE-2019-0197": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.openwall.com/lists/oss-security/2019/04/02/2",
        "http://www.securityfocus.com/bid/107665",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://security.netapp.com/advisory/ntap-20190617-0002/",
        "https://support.f5.com/csp/article/K44591505"
      ],
      "cvss": "4.9",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue."
    },
    "CVE-2019-0220": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://www.openwall.com/lists/oss-security/2019/04/02/6",
        "http://www.securityfocus.com/bid/107670",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2019/04/msg00008.html",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.netapp.com/advisory/ntap-20190625-0007/",
        "https://support.f5.com/csp/article/K44591505",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422"
      ],
      "cvss": "5.0",
      "summary": "A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them."
    },
    "CVE-2019-0211": {
      "verified": false,
      "references": [
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
        "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
        "http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html",
        "http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html",
        "http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html",
        "http://www.apache.org/dist/httpd/CHANGES_2.4.39",
        "http://www.openwall.com/lists/oss-security/2019/04/02/3",
        "http://www.securityfocus.com/bid/107666",
        "https://access.redhat.com/errata/RHBA-2019:0959",
        "https://access.redhat.com/errata/RHSA-2019:0746",
        "https://access.redhat.com/errata/RHSA-2019:0980",
        "https://access.redhat.com/errata/RHSA-2019:1296",
        "https://access.redhat.com/errata/RHSA-2019:1297",
        "https://access.redhat.com/errata/RHSA-2019:1543",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa@%3Cusers.httpd.apache.org%3E",
        "https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e@%3Cdev.community.apache.org%3E",
        "https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
        "https://seclists.org/bugtraq/2019/Apr/16",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.gentoo.org/glsa/201904-20",
        "https://security.netapp.com/advisory/ntap-20190423-0001/",
        "https://support.f5.com/csp/article/K32957101",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422",
        "https://www.exploit-db.com/exploits/46676/",
        "https://www.synology.com/security/advisory/Synology_SA_19_14"
      ],
      "cvss": "7.2",
      "summary": "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected."
    },
    "CVE-2017-15710": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/8",
        "http://www.securityfocus.com/bid/103512",
        "http://www.securitytracker.com/id/1040569",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://usn.ubuntu.com/3937-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "5.0",
      "summary": "In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all."
    },
    "CVE-2018-1283": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/4",
        "http://www.securityfocus.com/bid/103520",
        "http://www.securitytracker.com/id/1040568",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "3.5",
      "summary": "In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications."
    },
    "CVE-2017-7668": {
      "verified": false,
      "references": [
        "http://www.debian.org/security/2017/dsa-3896",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
        "http://www.securityfocus.com/bid/99137",
        "http://www.securitytracker.com/id/1038711",
        "https://access.redhat.com/errata/RHSA-2017:2479",
        "https://access.redhat.com/errata/RHSA-2017:2483",
        "https://access.redhat.com/errata/RHSA-2017:3193",
        "https://access.redhat.com/errata/RHSA-2017:3194",
        "https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b@%3Cdev.httpd.apache.org%3E",
        "https://security.gentoo.org/glsa/201710-32",
        "https://security.netapp.com/advisory/ntap-20180601-0002/",
        "https://support.apple.com/HT208221",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
      ],
      "cvss": "7.5",
      "summary": "The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value."
    },
    "CVE-2017-15715": {
      "verified": false,
      "references": [
        "http://www.openwall.com/lists/oss-security/2018/03/24/6",
        "http://www.securityfocus.com/bid/103525",
        "http://www.securitytracker.com/id/1040570",
        "https://access.redhat.com/errata/RHSA-2018:3558",
        "https://access.redhat.com/errata/RHSA-2019:0366",
        "https://access.redhat.com/errata/RHSA-2019:0367",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
        "https://security.netapp.com/advisory/ntap-20180601-0004/",
        "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
        "https://usn.ubuntu.com/3627-1/",
        "https://usn.ubuntu.com/3627-2/",
        "https://www.debian.org/security/2018/dsa-4164"
      ],
      "cvss": "6.8",
      "summary": "In Apache httpd 2.4.0 to 2.4.29, the expression specified in  could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename."
    },
    "CVE-2018-17199": {
      "verified": false,
      "references": [
        "http://www.securityfocus.com/bid/106742",
        "https://httpd.apache.org/security/vulnerabilities_24.html",
        "https://lists.debian.org/debian-lts-announce/2019/01/msg00024.html",
        "https://seclists.org/bugtraq/2019/Apr/5",
        "https://security.gentoo.org/glsa/201903-21",
        "https://security.netapp.com/advisory/ntap-20190125-0001/",
        "https://usn.ubuntu.com/3937-1/",
        "https://www.debian.org/security/2019/dsa-4422",
        "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
        "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      ],
      "cvss": "5.0",
      "summary": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded."
    }
  },
  "timestamp": "2021-12-26T13:50:38.138557",
  "hostnames": [
    "cloud.sata.support.de"
  ],
  "org": null,
  "data": "HTTP/1.1 400 Bad Request\r\nDate: Sun, 26 Dec 2021 13:50:38 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'nonce-Uzg3RlR0SGV4eWk2ZkVQTzRYVHVweUl5Y2x0MVFuRUF5WGlhSmlKa0Rvcz06SkxTY0llR3RsMmZ5UkNTbXF5T2RrRlp4SWc4Z0lVQm9peW5VVkdNSU4rND0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\nReferrer-Policy: no-referrer\r\nX-Content-Type-Options: nosniff\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-Permitted-Cross-Domain-Policies: none\r\nX-Robots-Tag: none\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: ocywvd3d4ksh=eva1s52oicv8tdeb7g0b7e66bc; path=/; HttpOnly\r\nSet-Cookie: oc_sessionPassphrase=turMN1jcd3qqiI4qFzrzqLVxkULQrAqmYaBNYHnPK0glR4ABkZKVi1TWtcxL9p%2Fp3XJi9UE35rkiewLJaoKAb5d%2B74HSEZZI4GpPVWWasb7X6YAeC5MncH8FVtfFNS7O; path=/; HttpOnly\r\nSet-Cookie: nc_sameSiteCookielax=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax\r\nSet-Cookie: nc_sameSiteCookiestrict=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n",
  "port": 80,
  "transport": "tcp",
  "info": "(Debian)",
  "isp": "Hetzner Online GmbH",
  "cpe23": [
    "cpe:2.3:a:php:php",
    "cpe:2.3:a:apache:http_server:2.4.25"
  ],
  "cpe": [
    "cpe:/a:php:php",
    "cpe:/a:apache:http_server:2.4.25"
  ],
  "asn": "AS24940",
  "version": "2.4.25",
  "location": {
    "city": "Oberdorla",
    "region_code": "TH",
    "area_code": null,
    "longitude": 10.42163,
    "latitude": 51.16585,
    "country_code": "DE",
    "country_name": "Germany"
  },
  "ip": 2297678709,
  "domains": [
    "support.de"
  ],
  "ip_str": "136.243.203.117",
  "os": null,
  "_shodan": {
    "crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
    "options": {},
    "id": "bb74aed0-dd93-4d4b-a51e-dd3bb2e10e04",
    "module": "http",
    "ptr": true
  },
  "opts": {}
}
...
          
GET/shodan/custom?query={query}
Filtered by Query

Only returns banner data for the specified query. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in banners matching a specific query. It generally follows the query syntax of the main search engine except that here the query is case-sensitive! The list of available keys can be found at Search Filters. Put a "-" or "!" before the key to negate the filter terms.

Request URL
https://stream.shodan.io/shodan/custom/query={query}?key={YOUR_API_KEY}
      

  • query: [String] Space-separated list of case-sensitive key:value filters or data query; example "port:8080,443", "port:22 SSH-2.0-OpenSSH_6.4", "!country:VN"
Examples
Request
$ curl -G --data-urlencode "query=port:22 SSH-2.0-OpenSSH_6.4" "https://stream.shodan.io/shodan/custom?key={YOUR_API_KEY}"

          
Response
{
  "product": "OpenSSH",
  "hash": -1029792425,
  "timestamp": "2021-12-27T18:21:53.120661",
  "hostnames": [],
  "org": "PEG TECH INC",
  "data": "SSH-2.0-OpenSSH_6.4\\r\\n",
  "port": 22,
  "transport": "tcp",
  "info": "protocol 2.0",
  "isp": "PEG TECH INC",
  "cpe23": [
    "cpe:2.3:a:openbsd:openssh:6.4\\r\\n"
  ],
  "cpe": [
    "cpe:/a:openbsd:openssh:6.4\\r\\n"
  ],
  "asn": "AS54600",
  "version": "6.4\\r\\n",
  "location": {
    "city": "San Jose",
    "region_code": "CA",
    "area_code": null,
    "longitude": -121.89496,
    "latitude": 37.33939,
    "country_code": "US",
    "country_name": "United States"
  },
  "ip": 1804948851,
  "domains": [],
  "ip_str": "107.149.85.115",
  "os": null,
  "_shodan": {
    "crawler": "ada8582d54117e5eb7c72186882e76f0854a54ae",
    "options": {},
    "id": "37f17a39-b456-4dbf-85ea-6dfd2d3f362f",
    "module": "auto",
    "ptr": true
  },
  "opts": {
    "raw": "5353482d322e302d4f70656e5353485f362e340d0a"
  }
}
{
  "product": "OpenSSH",
  "hash": -1400530513,
  "vulns": {
    "CVE-2014-2532": {
      "verified": false,
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0143.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
        "http://www.securityfocus.com/bid/66355",
        "http://www.securitytracker.com/id/1029925",
        "http://www.ubuntu.com/usn/USN-2155-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
        "https://support.apple.com/HT205267"
      ],
      "cvss": 5.8,
      "summary": "sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character."
    },
    "CVE-2018-15919": {
      "verified": false,
      "references": [
        "http://seclists.org/oss-sec/2018/q3/180",
        "http://www.securityfocus.com/bid/105163",
        "https://security.netapp.com/advisory/ntap-20181221-0001/"
      ],
      "cvss": "5.0",
      "summary": "Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or \"oracle\") as a vulnerability.'"
    },
    "CVE-2017-15906": {
      "verified": false,
      "references": [
        "http://www.securityfocus.com/bid/101552",
        "https://access.redhat.com/errata/RHSA-2018:0980",
        "https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201801-05",
        "https://security.netapp.com/advisory/ntap-20180423-0004/",
        "https://www.openssh.com/txt/release-7.6"
      ],
      "cvss": 5,
      "summary": "The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files."
    },
    "CVE-2014-1692": {
      "verified": false,
      "references": [
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://openwall.com/lists/oss-security/2014/01/29/10",
        "http://openwall.com/lists/oss-security/2014/01/29/2",
        "http://secunia.com/advisories/60184",
        "http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
        "http://www.securityfocus.com/bid/65230",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/90819"
      ],
      "cvss": 7.5,
      "summary": "The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition."
    },
    "CVE-2014-2653": {
      "verified": false,
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0166.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://openwall.com/lists/oss-security/2014/03/26/7",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0425.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.securityfocus.com/bid/66459",
        "http://www.ubuntu.com/usn/USN-2164-1",
        "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513"
      ],
      "cvss": 5.8,
      "summary": "The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate."
    },
    "CVE-2016-10708": {
      "verified": false,
      "references": [
        "http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
        "http://www.securityfocus.com/bid/102780",
        "https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
        "https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20180423-0003/",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.openssh.com/releasenotes.html"
      ],
      "cvss": "5.0",
      "summary": "sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."
    },
    "CVE-2016-0777": {
      "verified": false,
      "references": [
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
        "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175592.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175676.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
        "http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
        "http://seclists.org/fulldisclosure/2016/Jan/44",
        "http://www.debian.org/security/2016/dsa-3446",
        "http://www.openssh.com/txt/release-7.1p2",
        "http://www.openwall.com/lists/oss-security/2016/01/14/7",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/archive/1/537295/100/0/threaded",
        "http://www.securityfocus.com/bid/80695",
        "http://www.securitytracker.com/id/1034671",
        "http://www.ubuntu.com/usn/USN-2869-1",
        "https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
        "https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
        "https://bto.bluecoat.com/security-advisory/sa109",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:07.openssh.asc",
        "https://security.gentoo.org/glsa/201601-01",
        "https://support.apple.com/HT206167"
      ],
      "cvss": "4.0",
      "summary": "The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key."
    },
    "CVE-2016-0778": {
      "verified": false,
      "references": [
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
        "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
        "http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
        "http://seclists.org/fulldisclosure/2016/Jan/44",
        "http://www.debian.org/security/2016/dsa-3446",
        "http://www.openssh.com/txt/release-7.1p2",
        "http://www.openwall.com/lists/oss-security/2016/01/14/7",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/archive/1/537295/100/0/threaded",
        "http://www.securityfocus.com/bid/80698",
        "http://www.securitytracker.com/id/1034671",
        "http://www.ubuntu.com/usn/USN-2869-1",
        "https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
        "https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
        "https://bto.bluecoat.com/security-advisory/sa109",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://security.gentoo.org/glsa/201601-01",
        "https://support.apple.com/HT206167"
      ],
      "cvss": "4.6",
      "summary": "The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings."
    }
  },
  "timestamp": "2021-12-27T18:21:39.929427",
  "hostnames": [],
  "ssh": {
    "hassh": "cca34b641961a75a15b91d1f1a13a3fb",
    "fingerprint": "03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1",
    "mac": "hmac-sha2-256",
    "cipher": "aes128-ctr",
    "key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\n",
    "kex": {
      "languages": [
        ""
      ],
      "server_host_key_algorithms": [
        "ssh-rsa",
        "ecdsa-sha2-nistp256"
      ],
      "encryption_algorithms": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "arcfour256",
        "arcfour128",
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com",
        "aes128-cbc",
        "3des-cbc",
        "blowfish-cbc",
        "cast128-cbc",
        "aes192-cbc",
        "aes256-cbc",
        "arcfour",
        "rijndael-cbc@lysator.liu.se"
      ],
      "kex_follows": false,
      "unused": 0,
      "kex_algorithms": [
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group1-sha1"
      ],
      "compression_algorithms": [
        "none",
        "zlib@openssh.com"
      ],
      "mac_algorithms": [
        "hmac-md5-etm@openssh.com",
        "hmac-sha1-etm@openssh.com",
        "umac-64-etm@openssh.com",
        "umac-128-etm@openssh.com",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-ripemd160-etm@openssh.com",
        "hmac-sha1-96-etm@openssh.com",
        "hmac-md5-96-etm@openssh.com",
        "hmac-md5",
        "hmac-sha1",
        "umac-64@openssh.com",
        "umac-128@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-ripemd160",
        "hmac-ripemd160@openssh.com",
        "hmac-sha1-96",
        "hmac-md5-96"
      ]
    },
    "type": "ssh-rsa"
  },
  "org": "Henan Telcom Union Technology Co., LTD",
  "data": "SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\nFingerprint: 03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
  "port": 22,
  "cpe23": [
    "cpe:2.3:a:openbsd:openssh:6.4"
  ],
  "info": "protocol 2.0",
  "isp": "Zhengzhou Fastidc Technology Co.,Ltd.",
  "transport": "tcp",
  "cpe": [
    "cpe:/a:openbsd:openssh:6.4"
  ],
  "asn": "AS56005",
  "version": "6.4",
  "location": {
    "city": "Tianjin",
    "region_code": "TJ",
    "area_code": null,
    "longitude": 117.17667,
    "latitude": 39.14222,
    "country_code": "CN",
    "country_name": "China"
  },
  "ip": 707994107,
  "domains": [],
  "ip_str": "42.51.33.251",
  "os": null,
  "_shodan": {
    "crawler": "49217c0cdcbcebaf23c2979ae16d4eba64180b1f",
    "options": {},
    "id": "202965c3-78b2-4938-936f-6899d2cec8e4",
    "module": "ssh",
    "ptr": true
  },
  "opts": {}
}
...
          
Request
$ shodan stream --custom "port:22 SSH-2.0-OpenSSH_6.4"

          
Response
137.175.113.46	22		SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQCqhhK+6gyE1MdcL8lqwLw10BBpj9k++QaHi6oCXPXVJbbJ\nW1AUhdk4tKiWVtyYWS9EZ4jQ9vGIWtQxxlqBp9iD8ffpiibFHYefhjfU/0QFwVTYoSx63CQzXO7+\n6zSnqVDUVmlSriGeBK3EyuiWWJYbgxag2BmVdluIWgktppAeWYkBcYv2BRW9AIM8JvGPFXJllSrs\n8jzRh+WWRnjC+Q5+kqN6urrVvugHzOWXBmwXOKD8bOVLiXxy15WIzBKmYSKeoKsU5J1tfb8wjT4Q\nDEcwEwvPd2ZH3W3OACZbHw7JhcEXw+1Qxz/wrxFA6xouKadz4OnB4Ct06HcEvp7avMrD\nFingerprint: 17:fc:ff:f7:e8:04:a1:c2:e6:d0:0c:7d:3f:7a:50:93\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
192.74.224.154	22		SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC0X2KQh7lXH9T3892mIbHxM7iVB4znBK3DYWMZ1pjZuzmY\ndCKT6grznVBMI6C76xpev81c+9CEhDunEv6mr3tWOuOk7qNZ5YvBziaXfM7FYM+1TpauX2DsxBAd\nZHOfd2ryRkULJYwhhSeZL1Ll/zlrxIkhWChRIb4PPnwWcoIeFDY9OlbQBaWeJKexxLnhTx0PLOX5\n8dOC2q24v8SUOXMuus+vOsz1LtnZRWGcOCfmMccGWwtgj2c4P1035A+kLrTbpq6eRaS/a9JlNJlG\n/UwzAeL3FAH3QlNIKEUBUG46VRadQ6GsfBmaWCMpRPXuBen6gqwGemNvRkf5e6qwUoWT\nFingerprint: 4e:e3:af:75:1f:ab:b2:39:ff:4f:f9:4f:81:ee:78:b2\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
23.95.27.143	22	23-95-27-143-host.colocrossing.com	SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDb0/uGkFtis2b+Bq0O9LKijxUqyumtJ1KW0FNcTm8z9Vik\nMobyt61lX1nSbFDs6mQkS34mfSahdPd0RpwmVCr62MQB3xPwqPyURPEz9ZO17VNeqvzyI9Oo8sA4\n3VizuJLv6bkZ/DZxYXKOBgmWwWmwiSq+Chj5GXGuCYM/FXnkEnhBFBO6dyuPz+tUO/nIULpyTZ5b\nhMD9ABvErm6vDXFFnCR3BEdi5zPjYir0mZzkBE1enlMOCYbLgaS0L2JER1Ote4AtBlexxhj6/6Ry\n4IRdJlgqymVfVq0KgpLGJN1VnF4I0KC2si52fTy3KSsi65xZcYnZrLeIkgf4Vm2ee5oz\nFingerprint: fd:1b:0c:49:c9:aa:07:1b:b2:ae:20:e5:2a:6b:43:f8\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.custom(query="port:22 SSH-2.0-OpenSSH_6.4", raw=False, timeout=None):
    print(banner)
          
Response
{
  "product": "OpenSSH",
  "hash": -1029792425,
  "timestamp": "2021-12-27T18:21:53.120661",
  "hostnames": [],
  "org": "PEG TECH INC",
  "data": "SSH-2.0-OpenSSH_6.4\\r\\n",
  "port": 22,
  "transport": "tcp",
  "info": "protocol 2.0",
  "isp": "PEG TECH INC",
  "cpe23": [
    "cpe:2.3:a:openbsd:openssh:6.4\\r\\n"
  ],
  "cpe": [
    "cpe:/a:openbsd:openssh:6.4\\r\\n"
  ],
  "asn": "AS54600",
  "version": "6.4\\r\\n",
  "location": {
    "city": "San Jose",
    "region_code": "CA",
    "area_code": null,
    "longitude": -121.89496,
    "latitude": 37.33939,
    "country_code": "US",
    "country_name": "United States"
  },
  "ip": 1804948851,
  "domains": [],
  "ip_str": "107.149.85.115",
  "os": null,
  "_shodan": {
    "crawler": "ada8582d54117e5eb7c72186882e76f0854a54ae",
    "options": {},
    "id": "37f17a39-b456-4dbf-85ea-6dfd2d3f362f",
    "module": "auto",
    "ptr": true
  },
  "opts": {
    "raw": "5353482d322e302d4f70656e5353485f362e340d0a"
  }
}
{
  "product": "OpenSSH",
  "hash": -1400530513,
  "vulns": {
    "CVE-2014-2532": {
      "verified": false,
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0143.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
        "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
        "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
        "http://www.securityfocus.com/bid/66355",
        "http://www.securitytracker.com/id/1029925",
        "http://www.ubuntu.com/usn/USN-2155-1",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
        "https://support.apple.com/HT205267"
      ],
      "cvss": 5.8,
      "summary": "sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character."
    },
    "CVE-2018-15919": {
      "verified": false,
      "references": [
        "http://seclists.org/oss-sec/2018/q3/180",
        "http://www.securityfocus.com/bid/105163",
        "https://security.netapp.com/advisory/ntap-20181221-0001/"
      ],
      "cvss": "5.0",
      "summary": "Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or \"oracle\") as a vulnerability.'"
    },
    "CVE-2017-15906": {
      "verified": false,
      "references": [
        "http://www.securityfocus.com/bid/101552",
        "https://access.redhat.com/errata/RHSA-2018:0980",
        "https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.gentoo.org/glsa/201801-05",
        "https://security.netapp.com/advisory/ntap-20180423-0004/",
        "https://www.openssh.com/txt/release-7.6"
      ],
      "cvss": 5,
      "summary": "The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files."
    },
    "CVE-2014-1692": {
      "verified": false,
      "references": [
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://marc.info/?l=bugtraq&m=144050155601375&w=2",
        "http://openwall.com/lists/oss-security/2014/01/29/10",
        "http://openwall.com/lists/oss-security/2014/01/29/2",
        "http://secunia.com/advisories/60184",
        "http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h",
        "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
        "http://www.securityfocus.com/bid/65230",
        "https://exchange.xforce.ibmcloud.com/vulnerabilities/90819"
      ],
      "cvss": 7.5,
      "summary": "The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition."
    },
    "CVE-2014-2653": {
      "verified": false,
      "references": [
        "http://advisories.mageia.org/MGASA-2014-0166.html",
        "http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
        "http://marc.info/?l=bugtraq&m=141576985122836&w=2",
        "http://openwall.com/lists/oss-security/2014/03/26/7",
        "http://rhn.redhat.com/errata/RHSA-2014-1552.html",
        "http://rhn.redhat.com/errata/RHSA-2015-0425.html",
        "http://secunia.com/advisories/59855",
        "http://www.debian.org/security/2014/dsa-2894",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
        "http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.securityfocus.com/bid/66459",
        "http://www.ubuntu.com/usn/USN-2164-1",
        "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513"
      ],
      "cvss": 5.8,
      "summary": "The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate."
    },
    "CVE-2016-10708": {
      "verified": false,
      "references": [
        "http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
        "http://www.securityfocus.com/bid/102780",
        "https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
        "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
        "https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
        "https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
        "https://security.netapp.com/advisory/ntap-20180423-0003/",
        "https://usn.ubuntu.com/3809-1/",
        "https://www.openssh.com/releasenotes.html"
      ],
      "cvss": "5.0",
      "summary": "sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."
    },
    "CVE-2016-0777": {
      "verified": false,
      "references": [
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
        "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175592.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175676.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
        "http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
        "http://seclists.org/fulldisclosure/2016/Jan/44",
        "http://www.debian.org/security/2016/dsa-3446",
        "http://www.openssh.com/txt/release-7.1p2",
        "http://www.openwall.com/lists/oss-security/2016/01/14/7",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/archive/1/537295/100/0/threaded",
        "http://www.securityfocus.com/bid/80695",
        "http://www.securitytracker.com/id/1034671",
        "http://www.ubuntu.com/usn/USN-2869-1",
        "https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
        "https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
        "https://bto.bluecoat.com/security-advisory/sa109",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:07.openssh.asc",
        "https://security.gentoo.org/glsa/201601-01",
        "https://support.apple.com/HT206167"
      ],
      "cvss": "4.0",
      "summary": "The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key."
    },
    "CVE-2016-0778": {
      "verified": false,
      "references": [
        "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
        "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
        "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
        "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
        "http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
        "http://seclists.org/fulldisclosure/2016/Jan/44",
        "http://www.debian.org/security/2016/dsa-3446",
        "http://www.openssh.com/txt/release-7.1p2",
        "http://www.openwall.com/lists/oss-security/2016/01/14/7",
        "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
        "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
        "http://www.securityfocus.com/archive/1/537295/100/0/threaded",
        "http://www.securityfocus.com/bid/80698",
        "http://www.securitytracker.com/id/1034671",
        "http://www.ubuntu.com/usn/USN-2869-1",
        "https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
        "https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
        "https://bto.bluecoat.com/security-advisory/sa109",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
        "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
        "https://security.gentoo.org/glsa/201601-01",
        "https://support.apple.com/HT206167"
      ],
      "cvss": "4.6",
      "summary": "The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings."
    }
  },
  "timestamp": "2021-12-27T18:21:39.929427",
  "hostnames": [],
  "ssh": {
    "hassh": "cca34b641961a75a15b91d1f1a13a3fb",
    "fingerprint": "03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1",
    "mac": "hmac-sha2-256",
    "cipher": "aes128-ctr",
    "key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\n",
    "kex": {
      "languages": [
        ""
      ],
      "server_host_key_algorithms": [
        "ssh-rsa",
        "ecdsa-sha2-nistp256"
      ],
      "encryption_algorithms": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "arcfour256",
        "arcfour128",
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com",
        "aes128-cbc",
        "3des-cbc",
        "blowfish-cbc",
        "cast128-cbc",
        "aes192-cbc",
        "aes256-cbc",
        "arcfour",
        "rijndael-cbc@lysator.liu.se"
      ],
      "kex_follows": false,
      "unused": 0,
      "kex_algorithms": [
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group1-sha1"
      ],
      "compression_algorithms": [
        "none",
        "zlib@openssh.com"
      ],
      "mac_algorithms": [
        "hmac-md5-etm@openssh.com",
        "hmac-sha1-etm@openssh.com",
        "umac-64-etm@openssh.com",
        "umac-128-etm@openssh.com",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-ripemd160-etm@openssh.com",
        "hmac-sha1-96-etm@openssh.com",
        "hmac-md5-96-etm@openssh.com",
        "hmac-md5",
        "hmac-sha1",
        "umac-64@openssh.com",
        "umac-128@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-ripemd160",
        "hmac-ripemd160@openssh.com",
        "hmac-sha1-96",
        "hmac-md5-96"
      ]
    },
    "type": "ssh-rsa"
  },
  "org": "Henan Telcom Union Technology Co., LTD",
  "data": "SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\nFingerprint: 03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
  "port": 22,
  "cpe23": [
    "cpe:2.3:a:openbsd:openssh:6.4"
  ],
  "info": "protocol 2.0",
  "isp": "Zhengzhou Fastidc Technology Co.,Ltd.",
  "transport": "tcp",
  "cpe": [
    "cpe:/a:openbsd:openssh:6.4"
  ],
  "asn": "AS56005",
  "version": "6.4",
  "location": {
    "city": "Tianjin",
    "region_code": "TJ",
    "area_code": null,
    "longitude": 117.17667,
    "latitude": 39.14222,
    "country_code": "CN",
    "country_name": "China"
  },
  "ip": 707994107,
  "domains": [],
  "ip_str": "42.51.33.251",
  "os": null,
  "_shodan": {
    "crawler": "49217c0cdcbcebaf23c2979ae16d4eba64180b1f",
    "options": {},
    "id": "202965c3-78b2-4938-936f-6899d2cec8e4",
    "module": "ssh",
    "ptr": true
  },
  "opts": {}
}
...
          

Network Alerts

These streams provide a Private Firehose that contain information about the networks that you're monitoring. Use the REST API to create/ delete/ update the list of networks that you want Shodan to monitor.

GET/shodan/alert
All Network Alerts

Subscribe to banners discovered on all IP ranges described in the network alerts. The network alerts are renewed periodically every 1 hour.

Request URL
https://stream.shodan.io/shodan/alert?key={YOUR_API_KEY}
      

Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/alert?key={YOUR_API_KEY}"

          
Response
{
    "hash": -553166942,
    "timestamp": "2021-01-28T05:39:12.152185",
    "hostnames": ["dns.google"],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "port": 53,
    "transport": "udp",
    "isp": "Google",
    "asn": "AS15169",
    "location": {
        "country_code3": null,
        "city": null,
        "region_code": null,
        "postal_code": null,
        "longitude": -97.822,
        "country_code": "US",
        "latitude": 37.751,
        "country_name": "United States",
        "area_code": null,
        "dma_code": null,
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": null,
        "software": null,
    },
    "ip": 134744072,
    "domains": ["dns.google"],
    "ip_str": "8.8.8.8",
    "_id": "23c49fa8-0c87-4b67-91b7-ab50d493ed7f",
    "os": null,
    "_shodan": {
        "crawler": "308515b6113c0645034fb8122d0ff0d5194e7e72",
        "options": {},
        "id": "0e055a10-9a16-4a8b-ae00-54ae10dd7f16",
        "module": "dns-udp",
        "ptr": true,
        "alert": {
            "id": "NKXOVKN5W4SPTOF2",
            "name": "scan 8.8.8.8",
        },
    },
    "opts": {"raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"},
}
{
    "hash": 1977582756,
    "timestamp": "2021-01-28T05:39:16.231331",
    "hostnames": ["one.one.one.one"],
    "org": "Mountain View Communications",
    "data": "\nRecursion: enabled\nResolver ID: VIE",
    "port": 53,
    "transport": "udp",
    "isp": "Mountain View Communications",
    "asn": "AS13335",
    "location": {
        "country_code3": null,
        "city": null,
        "region_code": null,
        "postal_code": null,
        "longitude": 143.2104,
        "country_code": "AU",
        "latitude": -33.494,
        "country_name": "Australia",
        "area_code": null,
        "dma_code": null,
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": "VIE",
        "software": null,
    },
    "ip": 16843009,
    "domains": ["one.one"],
    "ip_str": "1.1.1.1",
    "_id": "08d364c6-fb2a-4a88-9369-e831b53509d1",
    "os": null,
    "_shodan": {
        "crawler": "3901cdc9c9a3b8554f02333e2779a8659643ad15",
        "options": {},
        "id": "52fc8643-5a7d-45d8-9c2e-8b79bd9f6f27",
        "module": "dns-udp",
        "ptr": true,
        "alert": {
            "id": "TOZN4UUSGPMOYEAI",
            "name": "one one one one",
        },
    },
    "opts": {"raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"},
}
...
          
Request
$ shodan stream --alert all

          
Response
8.8.8.8	53	dns.google	\nRecursion: enabled
1.1.1.1	53	one.one.one.one	\nRecursion: enabled\nResolver ID: AMS
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.alert(aid=None, timeout=None, raw=False):
    print(banner)
          
Response
{
    "hash": 1592421393,
    "timestamp": "2021-01-28T05:51:32.330798",
    "hostnames": [
        "one.one.one.one"
    ],
    "org": "Mountain View Communications",
    "data": "\nRecursion: enabled\nResolver ID: AMS",
    "port": 53,
    "transport": "udp",
    "isp": "Mountain View Communications",
    "asn": "AS13335",
    "location": {
        "country_code3": None,
        "city": None,
        "region_code": None,
        "postal_code": None,
        "longitude": 143.2104,
        "country_code": "AU",
        "latitude": -33.494,
        "country_name": "Australia",
        "area_code": None,
        "dma_code": None,
    },
    "dns": {
        "resolver_hostname": None,
        "recursive": True,
        "resolver_id": "AMS",
        "software": None,
    },
    "ip": 16843009,
    "domains": [
        "one.one"
    ],
    "ip_str": "1.1.1.1",
    "_id": "9ac8f44b-91e7-4c08-9191-000569361d7e",
    "os": None,
    "_shodan": {
        "crawler": "bf213bc419cc8491376c12af31e32623c1b6f467",
        "options": {},
        "id": "a5bde924-d263-4493-adf0-c0fa54eca1a2",
        "module": "dns-udp",
        "ptr": True,
        "alert": {
            "id": "TOZN4UUSGPMOYEAI",
            "name": "one one one one",
        },
    },
    "opts": {
        "raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
    },
}
{
    "hash": -553166942,
    "timestamp": "2021-01-28T05:51:33.887203",
    "hostnames": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "port": 53,
    "transport": "udp",
    "isp": "Google",
    "asn": "AS15169",
    "location": {
        "country_code3": None,
        "city": None,
        "region_code": None,
        "postal_code": None,
        "longitude": -97.822,
        "country_code": "US",
        "latitude": 37.751,
        "country_name": "United States",
        "area_code": None,
        "dma_code": None,
    },
    "dns": {
        "resolver_hostname": None,
        "recursive": True,
        "resolver_id": None,
        "software": None,
    },
    "ip": 134744072,
    "domains": [
        "dns.google"
    ],
    "ip_str": "8.8.8.8",
    "_id": "75beec02-a928-4d2e-ab25-87234ff6b369",
    "os": None,
    "_shodan": {
        "crawler": "e69d8d673faaa42bde0e9c7ce075d3c7146e67d0",
        "options": {},
        "id": "1db7cf0d-b3a0-4772-981c-2d09bafa0c81",
        "module": "dns-udp",
        "ptr": True,
        "alert": {
            "id": "NKXOVKN5W4SPTOF2",
            "name": "scan 8.8.8.8",
        },
    },
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    },
}
...
          
GET/shodan/alert/{id}
Filtered by Alert ID

Subscribe to banners discovered on the IP range defined in a specific network alert. The network alert is renewed periodically every 1 hour.

Request URL
https://stream.shodan.io/shodan/alert/{id}?key={YOUR_API_KEY}
      
Parameters
  • id: [String] The unique ID of the network alert; example "OYPRB8IR9Z35AZPR"
Examples
Request
$ curl -X GET "https://stream.shodan.io/shodan/alert/OYPRB8IR9Z35AZPR?key={YOUR_API_KEY}"

          
Response
{
    "hash": 1592421393,
    "timestamp": "2021-01-28T05:45:56.563794",
    "hostnames": [
        "one.one.one.one"
    ],
    "org": "Mountain View Communications",
    "data": "\nRecursion: enabled\nResolver ID: AMS",
    "port": 53,
    "transport": "udp",
    "isp": "Mountain View Communications",
    "asn": "AS13335",
    "location": {
        "country_code3": null,
        "city": null,
        "region_code": null,
        "postal_code": null,
        "longitude": 143.2104,
        "country_code": "AU",
        "latitude": -33.494,
        "country_name": "Australia",
        "area_code": null,
        "dma_code": null
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": "AMS",
        "software": null
    },
    "ip": 16843009,
    "domains": [
        "one.one"
    ],
    "ip_str": "1.1.1.1",
    "_id": "8e231550-6f50-440d-b5da-46cc49b2243a",
    "os": null,
    "_shodan": {
        "crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
        "options": {},
        "id": "58ad7d05-7afd-4769-aabb-3045c498f770",
        "module": "dns-udp",
        "ptr": true,
        "alert": {
            "id": "TOZN4UUSGPMOYEAI",
            "name": "one one one one",
        },
    },
    "opts": {
        "raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
    }
}
{
    "hash": -553166942,
    "timestamp": "2021-01-28T05:46:06.018756",
    "hostnames": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "port": 53,
    "transport": "udp",
    "isp": "Google",
    "asn": "AS15169",
    "location": {
        "country_code3": null,
        "city": null,
        "region_code": null,
        "postal_code": null,
        "longitude": -97.822,
        "country_code": "US",
        "latitude": 37.751,
        "country_name": "United States",
        "area_code": null,
        "dma_code": null
    },
    "dns": {
        "resolver_hostname": null,
        "recursive": true,
        "resolver_id": null,
        "software": null
    },
    "ip": 134744072,
    "domains": [
        "dns.google"
    ],
    "ip_str": "8.8.8.8",
    "_id": "e26af2fa-dbcc-4a36-9631-33a46e505b91",
    "os": null,
    "_shodan": {
        "crawler": "44ad81631af4ebeda49a419b8565d5fcd7ac4d2e",
        "options": {},
        "id": "2db17089-b705-459e-9a44-f53ca3b42df1",
        "module": "dns-udp",
        "ptr": true,
        "alert": {
            "id": "NKXOVKN5W4SPTOF2",
            "name": "scan 8.8.8.8",
        },
    },
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    }
}
...
          
Request
$ shodan stream --alert OYPRB8IR9Z35AZPR

          
Response
1.1.1.1	53	one.one.one.one	\nRecursion: enabled\nResolver ID: LAX
8.8.8.8	53	dns.google	\nRecursion: enabled
...
          
Request
from shodan import Shodan

api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.alert(aid='OYPRB8IR9Z35AZPR', timeout=None, raw=False):
    print(banner)
          
Response
{
    "hash": -553166942,
    "timestamp": "2021-01-28T05:48:02.676422",
    "hostnames": [
        "dns.google"
    ],
    "org": "Google",
    "data": "\nRecursion: enabled",
    "port": 53,
    "transport": "udp",
    "isp": "Google",
    "asn": "AS15169",
    "location": {
        "country_code3": None,
        "city": None,
        "region_code": None,
        "postal_code": None,
        "longitude": -97.822,
        "country_code": "US",
        "latitude": 37.751,
        "country_name": "United States",
        "area_code": None,
        "dma_code": None,
    },
    "dns": {
        "resolver_hostname": None,
        "recursive": True,
        "resolver_id": None,
        "software": None,
    },
    "ip": 134744072,
    "domains": [
        "dns.google"
    ],
    "ip_str": "8.8.8.8",
    "_id": "f27ed718-1870-4b6a-b856-2a3ecc462e45",
    "os": None,
    "_shodan": {
        "crawler": "487814a778c983e2dcef234806292d88c5cbf3ec",
        "options": {},
        "id": "679127cc-dcc3-4c69-84f4-0011d3cf801c",
        "module": "dns-udp",
        "ptr": True,
        "alert": {
            "id": "NKXOVKN5W4SPTOF2",
            "name": "scan 8.8.8.8",
        },
    },
    "opts": {
        "raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
    },
}
{
    "hash": 1592421393,
    "timestamp": "2021-01-28T05:48:03.020873",
    "hostnames": [
        "one.one.one.one"
    ],
    "org": "Mountain View Communications",
    "data": "\nRecursion: enabled\nResolver ID: AMS",
    "port": 53,
    "transport": "udp",
    "isp": "Mountain View Communications",
    "asn": "AS13335",
    "location": {
        "country_code3": None,
        "city": None,
        "region_code": None,
        "postal_code": None,
        "longitude": 143.2104,
        "country_code": "AU",
        "latitude": -33.494,
        "country_name": "Australia",
        "area_code": None,
        "dma_code": None,
    },
    "dns": {
        "resolver_hostname": None,
        "recursive": True,
        "resolver_id": "AMS",
        "software": None,
    },
    "ip": 16843009,
    "domains": [
        "one.one"
    ],
    "ip_str": "1.1.1.1",
    "_id": "767063ae-26a1-4d61-8af9-1aaec9cfb9f3",
    "os": None,
    "_shodan": {
        "crawler": "d905ab419aeb10e9c57a336c7e1aa9629ae4a733",
        "options": {},
        "id": "ac7ada46-5c59-414f-939e-7b48afbcfe20",
        "module": "dns-udp",
        "ptr": True,
        "alert": {
            "id": "TOZN4UUSGPMOYEAI",
            "name": "one one one one",
        },
    },
    "opts": {
        "raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
    },
}
...
          
Next: Trends API Documentation



Contact Us

Shodan ® - All rights reserved