The banner is the main type of information that Shodan provides through the REST and Streaming API. This document outlines the various properties that are always present and which ones are optional.
- [String] The autonomous system number (ex. "AS4837").
- [String] Contains the banner information for the service.
- [Integer] The IP address of the host as an integer.
- [String] The IP address of the host as a string.
- [String] The IPv6 address of the host as a string. If this is present then the "ip" and "ip_str" fields wont be.
- [Integer] The port number that the service is operating on.
- [String] The timestamp for when the banner was fetched from the device in the UTC timezone. Example: "2014-01-15T05:49:56.283713"
- [String] An array of strings containing all of the hostnames that have been assigned to the IP address for this device.
- [String] An array of strings containing the top-level domains for the hostnames of the device. This is a utility property in case you want to filter by TLD instead of subdomain. It is smart enough to handle global TLDs with several dots in the domain (ex. "co.uk")
- [Object] An object containing all of the location information for the device.
- [Integer]The area code for the device's location. Only available for the US.
- [String] The name of the city where the device is located.
- [String] The 2-letter country code for the device location.
- [String] The 3-letter country code for the device location.
- [String] The name of the country where the device is located.
- [Integer] The designated market area code for the area where the device is located. Only available for the US.
- [Double] The latitude for the geolocation of the device.
- [Double] The longitude for the geolocation of the device.
- [String] The postal code for the device's location.
- [String] The name of the region where the device is located.
- [Object] Contains experimental and supplemental data for the service. This can include the SSL certificate, robots.txt and other raw information that hasn't yet been formalized into the Banner Specification.
- [String] The name of the organization that is assigned the IP space for this device.
- [String] The ISP that is providing the organization with the IP space for this device. Consider this the "parent" of the organization in terms of IP ownership.
- [String] The operating system that powers the device.
- [String] Either "udp" or "tcp" to indicate which IP transport protocol was used to fetch the information
- [Integer] The number of minutes that the device has been online.
- [String] The network link type. Possible values are: "Ethernet or modem", "generic tunnel or VPN", "DSL", "IPIP or SIT", "SLIP", "IPSec or GRE", "VLAN", "jumbo Ethernet", "Google", "GIF", "PPTP", "loopback", "AX.25 radio modem".
- [String] The title of the website as extracted from the HTML source.
- [String] The raw HTML source for the website.
- [String] The name of the product that generated the banner.
- [String] The version of the product that generated the banner.
- [String] The type of device (webcam, router, etc.).
- [String] Miscellaneous information that was extracted about the product.
- [String] The relevant Common Platform Enumeration for the product or known vulnerabilities if available. For more information on CPE and the official dictionary of values visit the
If the service uses SSL, such as HTTPS, then the banner will also contain a property called "ssl":
- [Object] The parsed certificate properties that includes information such as when it was issued, the SSL extensions, the issuer, subject etc.
- [Object] Preferred cipher for the SSL connection
- [Array] An array of certificates, where each string is a PEM-encoded SSL certificate. This includes the user SSL certificate up to its root certificate.
- [Object] The Diffie-Hellman parameters if available: "prime", "public_key", "bits", "generator" and an optional "fingerprint" if we know which program generated these parameters.
- [Array] A list of SSL versions that are supported by the server. If a version isnt supported the value is prefixed with a "-". Example: ["TLSv1", "-SSLv2"] means that the server supports TLSv1 but doesnt support SSLv2.
"org": "AT&T U-verse",
"isp": "AT&T U-verse",
"country_name": "United States",